Furthermore, history shows that it is not uncommon to get clusters of extremely devastating incidents. Whether you believe it is the effect of global warming or not, we appear now to be in the midst of such a cluster. The extreme 2004 Florida hurricane season was followed by the Asian tsunami. The latest high-profile event is of course Hurricane Katrina's destruction of New Orleans.
The warning signs are often there. Louisiana was aware of the vulnerability of New Orleans, but had neither the resources nor planning to deal with a disaster of this magnitude. Apparently no-one was prepared to think that the worst might actually happen.
It is a fact of life that the most devastating disasters - natural or otherwise - cannot be foreseen in advance. How many US risk managers would have had a terrorist attack on the New York World Trade Center as an identified risk in their risk register? Did the Oreck Corporation, headquartered in New Orleans, ever think that it would be having to notify outlets that spare parts could be unavailable for some time? Risk managers are encouraged to identify risks, but perhaps there is also some argument for identifying impact, rather than specific cause, and planning against that.
When planning to mitigate against potential reputational hazards, where it is hard to second-guess exactly what might occur, some practitioners take the approach of grouping unidentified occurrences by response, for example, 'picked up in regional media', 'reported nationally', 'an international scandal', and plan their response accordingly. While identifying and managing the risks you can foresee is obviously a key part of the risk manager's job, perhaps there should be more planning for those risks that cannot be predicted - natural or otherwise - which can often be the most devastating to the organisation.
