One of the recurring questions in emergency management involves how we use risk assessments in planning. On the one hand, we need to focus on objective risk - risk that is most likely to occur and is credible. On the other hand, we understand that we are frequently dealing with events that fall into the high impact, low frequency category and there is little evidence on which to base a true risk analysis.
I've argued elsewhere that the "gloom and doom" approach doesn't sell to senior executives. I've also argued against scenario-based planning except in specific cases. However, I've never been able to articulate just what I felt was wrong with worst case scenarios. Thankfully, Bruce Schneier has done so in a recent blog titled Worst Case Thinking, an article that should be required reading for emergency managers.
Schneier makes four excellent points about worst-case scenarios:
- They focus on extreme but improbable risks and do not do a good job of assessing outcomes.
- They are based on flawed logic, assuming that is necessary to prove the scenario impossible.
- They can be used to support any position or its opposite.
- They validate ignorance by focusing on the unknown rather than on what is known.
Worst-case scenarios play on our fears and force us to make bad decisions. One can also argue that relying on a worst-case scenario is easier than making hard decisions that carry a certain amount of risk. We have a tendency to act as if the worst-case scenario is the most likely scenario and therefore we hesitate to act or, as has become the case over the last few years, to over-react.
It's worth remembering that use of risk management is one of the Principles of Emergency Management.