Where does risk management sit in the "Knowing vs. Not-Knowing" matrix, and what does it actually cover?
Risk management handles the known knowns — risks whose cause-and-effect we already understand and deal with daily.
* The four Knowing × Awareness quadrants — risk management owns only the known-knowns; resilience covers the black-swan corner. *
The matrix has four quadrants based on two axes — Wissen/Unwissen (do we know the mechanism?) and Bekannt/Unbekannt (are we aware of the risk at all?):
| Wissen (we understand it) | Unwissen (we don't) | |
|---|---|---|
| Bekannt (we're aware) | Cause-effect, daily handling → Risk Management | Known knowledge gap, dark figure → shrunk by research |
| Unbekannt (we're unaware) | Roughly known statistically but inaccessible per case (taboos, denial) → knowledge sharing | Black-swan territory — unforeseeable even with science → resilience, agility |
Why this matters: Risk management is powerful but limited — it can only manage what you can name and measure. Black swans (the bottom-right quadrant — unforeseeable even with science) live outside its reach, and resilience is the discipline that picks up there.
Tip: Rumsfeld's "known knowns / known unknowns / unknown unknowns" is the same idea: RM covers known-knowns; research shrinks known-unknowns; resilience prepares for unknown-unknowns.
Go deeper:
There are unknown unknowns (Wikipedia) — the known-knowns / known-unknowns / unknown-unknowns framing and its use in risk.- Black swan theory (Wikipedia) — the unpredictable, high-impact events that live in the unknown-unknowns corner.