---
title: Dealing With Unknowns In Risk Analysis - Part 2
description: In part 2 of this series, Jack Jones discusses strategic questions related to unknowns in risk analysis.
---

[The FAIR Institute Blog ](https://www.fairinstitute.org/blog)

# [Dealing With Unknowns In Risk Analysis - Part 2](https://www.fairinstitute.org/blog/dealing-with-unknowns-in-risk-analysis-part-2)

 Written by [Jack Jones](https://www.fairinstitute.org/blog/author/jack-jones) | Aug 24, 2016 9:30:00 PM

In [part 1 of this series](https://www.fairinstitute.org/blog/dealing-with-unknowns-in-risk-analysis) I discussed how to deal with unknowns in performing risk analysis. In this post, I’ll cover the problem of “unknowns” from a more strategic point of view. Specifically, evaluating and communicating the importance of overall risk landscape visibility.

**A continuum of visibility**

Imagine a business environment that includes:

- An application that processes sensitive consumer information 
- A database where the data is stored
- Servers and network infrastructure to support all of the above

An environment like this has some amount of inherent risk due to various types of potential adverse events. For the sake of this discussion, we’ll also assume that there are various controls in place to protect the environment from those adverse events.  

 

Now, let’s set up a “continuum of visibility” to draw comparisons between levels of visibility:

- Scenario 1:  We don’t know the environment exists
- Scenario 2:  We know it exists, but we have poor visibility into one or more risk factors (e.g., control conditions)
- Scenario 3:  We know it exists, and we have reasonably good visibility into the relevant risk factors

In each case, the level of actual loss exposure within this environment is what it is. In other words, our level of knowledge/uncertainty about risk doesn’t alter that environment’s current level of risk*. The assets at risk are what they are, the threats are what they are, and the controls are what they are. For the most part, what differs between these scenarios is our ability to do two things:

- Recognize and deal with changes in risk within this environment
- Appropriately prioritize this environment within our broader risk management portfolio

So, although risk within that environment “is what it is” right now, our ability to manage risk effectively — make informed decisions about risk as it changes, and within the portfolio overall — is affected by visibility. This means that our experience of loss over time, due to better or worse risk management, is affected by visibility.

**A teaser...**

I’m in the process of running some experiments to determine whether there is a tipping point for visibility — i.e., whether at some point in the continuum there are diminishing returns for improved visibility. This could potentially help organizations avoid over-spending on visibility. Stay tuned...  
 

* *Actually, a profound lack of visibility can in some cases represent additional loss exposure because of due diligence concerns.*  

[View full post](https://www.fairinstitute.org/blog/dealing-with-unknowns-in-risk-analysis-part-2)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Jack Jones"
  },
  "dateModified" : "2016-08-24T21:45:30.969Z",
  "datePublished" : "2016-08-24T21:30:00Z",
  "headline" : "Dealing With Unknowns In Risk Analysis - Part 2",
  "image" : {
    "@type" : "ImageObject",
    "height" : 667,
    "url" : "http://cdn2.hubspot.net/hubfs/1616664/Dealing_With_Unknowns_In_Risk_Analysis_-_Part_2.jpg",
    "width" : 1000
  },
  "mainEntityOfPage" : "https://www.fairinstitute.org/blog/dealing-with-unknowns-in-risk-analysis-part-2",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "FAIR Institute Blog"
  }
}
```