“The Challenges of Relying on Historical Data in Risk Management” in Risk Management Magazine, 10/26/2026.
According to Alan Zucker, instructor in project management at the University of Georgia, companies should document their risk management process and regularly review the environment to identify new risks and update the risk register. Risks that are no longer relevant should be closed, while those risks that still appear on the register should be reassessed to determine their probability, impact and what events could trigger them. He also warned against dismissing any risks that are deemed highly unlikely but could have potentially ruinous impacts. “If warranted, create a ‘red team’ to question everything,” he said. “Do not discard low-probability events or edge conditions. The consequences of black swan events can be catastrophic.”
Companies need to reexamine how they conduct risk assessments and how they are presented, Zucker said. Risk assessments are often skewed by the way they are categorized, which in turn affects the way they are interpreted, weighted and controlled. Risk expectations based on qualitative assessments can be subject to biases because outcomes are prioritized in terms of “best,” “worst,” “most recent” and so on. He said this “residual scar tissue from past mistakes,” may create a risk aversion bias or make it look like the company is on a winning streak—neither of which may be true if based on real-time data, but may appear to be when based on trends in historical data.