Managing Known and Unknown Risks: A 2026 Guide

The Four Quadrants at a Glance

A working definition for each category in the banking context:

• Known knowns (risks identified and measurable with reasonable confidence)
• Known unknowns (risks named but not fully quantified)
• Unknown unknowns (risks not yet identified)
• Unknown knowns (risks someone inside the institution knows about but has not escalated or actioned)

Known Known Risks: The Quantified Quadrant

Known known risks are the quantified risks already captured in the risk inventory, mapped to controls, and supported by data.

The types of risk in banking that populate this quadrant include:

• Credit risk on a defined loan portfolio
• Interest rate risk under Federal Reserve stress scenarios
• AML transaction monitoring metrics
• Market risk on a trading book
• Capital adequacy versus regulatory requirements

Each has an established methodology, recognised scenarios, and reporting cadence. Banks manage them through:

• A risk appetite statement
• A control library
• Key risk indicators
• A calendar of stress tests

Internal audit and supervisory examination confirm the controls are operating as designed, anchored by a documented risk management system. However, a risk that is well-measured can still be miscalibrated. Known knowns are the safest quadrant to operate in only when the underlying assumptions are interrogated carefully.

Known Unknown Risks: Working with Ranges

Known unknowns are risks the institution has named but cannot fully quantify. A typical entry could be, “the next CRE downturn could affect collateral values”, where the risk is identified, but how far values will fall, in which markets, and on when are uncertain.

In 2026 this category includes:

• The pace of further Federal Reserve adjustments
• The timing and depth of CRE refinancing stress
• The rate of customer adoption of new payment rails
• The accuracy drift of generative AI models

Known unknowns risk management depends on techniques that work with ranges:

• Scenario analysis risk management pairs deterministic but illustrative scenarios to bound the range of outcomes.
• Sensitivity analysis isolates the input most likely to move the outcome.
• Monte Carlo simulation extends both for portfolios where the distribution itself is important.
• Qualitative likelihood-impact scoring fills the gap where data for quantitative work does not yet exist.

Governance has to match: a single threshold breach in a known-knowns world becomes an appetite range in a known-unknowns world, and reassessment triggers become standing items on the risk committee agenda.

Unknown Unknown Risks: Surfacing Blind Spots

Unknown unknowns are the most dangerous quadrant precisely because they cannot, by definition, appear in the risk register. A risk the institution has not identified cannot be quantified, monitored, or controlled.

Recent unknown unknowns examples in financial services demonstrate the problem:

• AI prompt injection attacks affecting customer-facing chatbots emerged before most institutions had identified them as a distinct threat.
• Fourth-party SaaS dependencies have created concentration exposures invisible from standard vendor inventories.
• Climate physical-risk transmission through commercial real estate has surfaced as a risk that most CRE underwriting frameworks did not previously capture.

Risks from this quadrant must progressively be moved into known unknowns where they can be managed. Several practitioner techniques are designed for this purpose:

• Horizon scanning systematises review of weak signals for risks that have not yet manifested at the institution.
• Premortems invert the planning frame by asking a team to imagine a failure has occurred and reason backwards.
• Cross-industry loss event analysis, using consortium data such as the Operational Riskdata eXchange (ORX) or supervisory loss data, surfaces events that have happened to peers.
• Red team exercises challenge management assumptions about strategy, products, and controls.

Internal audit alone does not surface unknown unknowns and audit confirms controls work for risks already identified. The risk identification methods banks use to find unknown unknowns sit upstream of audit.

Unknown Known Risks: When the Organisation Already Knows

Unknown knowns are the quadrant most organisations are reluctant to talk about. They are risks someone inside the institution knows about, but that have not been escalated, documented, or actioned.

Certain patterns recur to create these risks, for example:

• A line-of-business manager identifies a workaround for an end-of-life system but does not escalate it because the replacement is expected “next year.”
• A compliance analyst notices a regulatory interpretation being applied inconsistently across business units but does not raise it because the inconsistency benefits one of them.
• A data steward flags internally that a model’s training data is stale but is told a refresh is coming.

Unknown knowns emerge from information silos, fear of escalation, and an absence of psychological safety. Governance fixes target each of these aspects through:

• Anonymous risk reporting channels that remove the personal cost of escalation.
• RCSA challenge sessions that require business owners to defend their inventories to a sceptical audience.
• 360-degree attestations that break the dependence on a single owner.

Comparing the Four Quadrants

The four quadrants of managing known and unknown risks differ in how they are identified, who owns them, and what techniques convert them from invisible to actionable.

Frequently Asked Questions