Every few months, the risk management community returns to a familiar argument that if something cannot be quantified, it cannot be managed. It is a neat and reassuring proposition that creates the impression that risk can behave like finance or engineering, something that can be measured, modelled and optimised. Yet this view misrepresents how organisations fail in practice. Quantification is part of the discipline, but it is the second part. The first part is behavioural, cultural, narrative and organisational, and it is in this first part that most failures take shape.
Why Organisations Fail Long Before the Numbers Do
This is not an argument against quantitative methods. It is an argument for recognising their limits and understanding the far greater influence of human behaviour on organisational outcomes. After more than thirty years observing how firms succeed and fail, I have yet to see a crisis that arose simply because an organisation lacked a sophisticated model. I have seen many crises that arose because the organisation failed to notice something that was already visible in its own behaviour.
Why Organisations Fail Long Before the Numbers Do
The pattern is remarkably consistent. Carillion, Wirecard, Boeing, Wells Fargo, the Post Office Horizon scandal, NMC Health, the global financial crisis, Deepwater Horizon and the collapse of Silicon Valley Bank did not occur because someone mis-specified a model or selected the wrong distribution. They occurred because truth was distorted, weak signals were missed, appetites drifted, incentives diverged, cultural conditions silenced challenge and governance systems were overloaded or distracted. Quantitative tools were often functioning as intended, yet the human systems that surrounded them were not.
What Quantification Cannot See
Quantification cannot reveal truths that people are unwilling to express. It cannot detect the slow drift of narrative away from reality. It cannot model the loss of trust that leads staff to curate information rather than disclose it. It cannot show when an organisation has ceased to understand its own risk appetite, or when fear, complacency or internal politics have shaped behaviour more strongly than any stated policy. These are the sources of real fragility, and they sit beyond the reach of statistical techniques.
When Models Work and When They Do Not
This does not diminish the importance of quantification. Quantitative methods are often excellent when boundaries are clear, when data is reliable, when past patterns remain relevant, when systems behave in a broadly linear manner and when trust in reporting is sound. In those conditions, models provide discipline and insight. The difficulty is that modern organisations rarely operate in such conditions. Quantification tends to be most effective once the organisation already understands the contours of its risk. It helps measure what is known. It does not help discover what is being overlooked.
The Problem of Known Risks and the Illusion of Completeness
Over the years, I have advised a number of organisations whose boards received meticulously maintained, colour coded risk registers at every meeting. These documents were orderly, precise and apparently comprehensive. When I asked the chief executive or the chair when they had last discussed a risk that had not yet made its way onto the register, the answer was almost always the same. There was no mechanism for that conversation. The organisation had become highly disciplined in managing the risks it already recognised, but it had no equivalent process for examining the risks emerging in the spaces between functions. In several cases, significant problems arose not because a known risk had been poorly controlled, but because two or three supposedly unrelated risks interacted in ways that no one had anticipated. The register had not failed because it was inaccurate. It had failed because it was incomplete, and the organisation had mistaken a list of known risks for a full description of its exposure.
A Changing Environment and Outdated Mental Models
This experience illustrates a broader truth. The environments in which organisations now operate have changed, while model first thinking has not. Firms operate in extended ecosystems with complex supply chains, fourth- and fifth-party dependencies, cloud concentration, opaque data flows and algorithmic systems whose behaviours cannot always be predicted. They are exposed to geopolitical volatility, rapid narrative shifts and widespread erosion of institutional trust. These conditions create uncertainties that cannot be captured by historical data or familiar modelling assumptions. Quantification can assist, but it cannot anchor judgement in such an environment.
Structural Blind Spots in a Quantitative World
Quantitative approaches have further structural blind spots. Cultural suppression is invisible to models. Dashboards may present data clearly, yet the data itself may reflect the internal narrative rather than the underlying reality. In low trust environments, information becomes an artefact of organisational dynamics rather than a neutral representation of fact. Early indicators of trouble often appear in conversations, pauses, hesitations or the absence of challenge rather than in datasets. Appetite remains a behavioural contract rather than a numeric threshold, and when appetite is misunderstood or inconsistently applied, quantitative tolerances do not maintain discipline. Dependencies that sit outside the organisation’s line of sight cannot be modelled at all. Boards fail not because they cannot calculate complexity, but because they struggle to interpret it.
Risk Intelligence and the Need for a Wider Lens
Quantification therefore remains necessary but never sufficient. It needs to sit alongside interpretive intelligence. The discipline required today is one that blends quantitative insight with behavioural understanding, including the capacity to interpret how people perceive, communicate, suppress, distort or escalate risk. This is what I mean by risk intelligence. It brings together trust architecture, narrative analysis, appetite coherence, cultural and conversational diagnostics, ecosystem awareness, governance cognition and quantitative analysis. Each informs the others, but none can substitute for the rest.
Why RiskMetrica Combines Behavioural and Quantitative Insight
This is also the reason I chose to work with Mark Young in developing RiskMetrica. Mark brings a depth of quantitative expertise that complements my own focus on behaviour, governance and interpretation. Risk intelligence requires both forms of insight. Quantitative methods provide clarity, structure and analytical strength, but they need to be grounded in an accurate understanding of how an organisation behaves, how decisions are made and how signals flow. Mark’s work ensures that the platform can model and measure risks once they have been properly understood, while my contribution ensures that the organisation knows which risks matter, how they emerge and how they are shaped by culture and appetite. RiskMetrica has been designed to bring these two approaches together because modern organisations need both the analytical precision of quantitative methods and the human understanding that comes from observing real behaviour in context.
The Real Question Behind Every Model
The real question is not whether a particular risk can be quantified. The real question is whether the organisation understands the system it is attempting to quantify. Many models fail not because the mathematics is unsound, but because the nature of the problem has been misunderstood, or because the boundaries of the system are unclear, or because incentives have distorted the information feeding into the model. Truth may have been suppressed, narratives may have drifted, assumptions may have detached from reality or trust may have broken down. In such circumstances, it is entirely possible to construct sophisticated models that fail elegantly because they are designed to answer the wrong questions.
The Future of the Discipline
This is the gap in the discipline. It is where most failures originate, and it is where future successes will be found. The organisations that will thrive are those that can blend the behavioural and the analytical, the qualitative and the quantitative, the human and the technical. Risk management is not a branch of applied mathematics. It is a discipline concerned with helping organisations navigate uncertain futures, preserve trust, maintain coherence and make decisions that remain robust in the face of complexity. Quantification has an important place within that discipline. It should never be mistaken for the discipline itself.
Richard Anderson
Founder, AndersonRisk
This essay was first published on 18 January 2026 on my Substack.