“… there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns—the ones we don’t know we don’t know.”

While initially ridiculed, I think that what Rumsfeld said neatly summarised a complex idea which is relevant to risk consulting, and it could have something to do with why an increasing proportion of clients are favouring risk specialists over other types of professional services firms.

In the business world, organisations are all trying to manage risks that fall into those three categories—things they know will happen (for example how a retailer needs to manage the extra strains on its supply chain during the busy Christmas period); things they know might happen, but the extent or timing is uncertain (for example, we know there will be a presidential election in the US in November, but we don’t know who the winner will be and therefore the policy implications and changes in regulation that might result); and then there are the unknown unknowns, things that will have profound effects on organisations in the future that we have no idea about yet.

Those risks that are known often cease to be considered risks at all—they’re just a normal part of doing business. For many clients, they’ll turn to their own internal resources to manage these risks, and if they do need external help, they’re probably more likely to turn to the broader consulting firms they’re familiar with rather than risk specialists. For known unknowns—those risks that business leaders can see coming down the road—clients may well be more likely to reach out to external advisors for help. While clearly there’s space for risk specialists in these areas, it’s also clear why other types of firms compete strongly here: The Big Four can help with managing the financial risks of a possible future recession; strategy firms can help you think about the risks of climate change to your business model; and technology firms can help defend your information systems from evolving cybersecurity threats. When thought about in this way, it’s perhaps unsurprising that last year only 3% of US clients told us they would be most likely to consider using boutique risk firms more for risk management work in the future.

However, the coronavirus pandemic is something that for many organisations was an “unknown unknown” risk. Few saw a pandemic on this scale coming, and even fewer could have conceived in advance a plan for how they would react to it. Of course, there have been pandemics in the past, and one could argue that business leaders should have known that sooner or later something like this would happen. Indeed, in parts of East Asia hit by the SARS outbreak in 2002/3, the risk of a pandemic was widely understood, and the public and private sectors arguably responded better as a result. In that region, a pandemic was a “known unknown” risk, and people planned accordingly.

In reaction to the pandemic, clients in the US appear to be turning to risk specialists more, perhaps because they’re well placed to assist in responding to a previously unthought-of risk. Thirteen percent of clients think they would be most likely to turn to risk specialists more in the future, compared to just 3% in 2019.

This highlights a possible competitive niche for risk specialists to exploit: helping clients turn unknown unknowns into known unknowns, and ensuring they’re adequately prepared for what the future might throw at them. If specialist risk firms can prove helpful to clients during the current pandemic, and show that they offer something different to other types of professional services firms, they can maintain that role going forward for all sorts of other risks that we don’t even know are coming our way yet.