Traditionally we consider risk as a product of the likelihood of something occurring and the consequence if it does. We use risk matrices which have remained unchanged since the 1970s. These matrices define risk scores and we use these to determine if risks are acceptable or not. Recommendations are made to decision makers and binary choices are made accordingly.

The increasing complexity of business operation is revealing cracks in this traditional approach. There is massive uncertainty over threats. We are forced to make ever wilder assumptions. We are struggling to prioritise where to place risk management resources. We are experiencing ever more surprises, so-called “black swans”, which avoid prediction. Risk treatment actions are increasingly unsuitable in practice.