In just the past six years, businesses worldwide have faced unprecedented disruptions, from the societal and economic shocks of the COVID pandemic to the geopolitical and supply chain risks arising from conflicts in the Middle East to the technological and operational upheaval of artificial intelligence. Such a risk environment has raised questions about traditional risk management methods, particularly the value organizations often place on the use of historical data. For decades, companies have based their risk management responses and scenario planning on lessons learned from past mistakes in both their own operations and those of other organizations. While that can still be useful, recent crises have exposed the limitations of that approach—namely, that historical data may not be a reliable indicator of current situations or future risks.
The Pitfalls of Historical Data
There are many ways in which historic data may prove more detrimental than useful. First, information can become too old to rely on. According to Richard Seiersen, chief risk technology officer at IT security firm Qualys, past data is only useful when history provides a long, stable record. “Looking at auto insurance is a good example: millions of similar drivers, decades of homogeneous claims, and a baseline rate that is surprisingly predictable,” he said. But other domains offer almost no empirical history at all. “Think about forecasting the probability of China invading Taiwan,” he said. “There is no long-run frequency data for that. There is not even a reliable class of 50 similar cases to pull from. It is irreducibly uncertain.”
Second, companies often put too much stock in their scenario and contingency planning based on past data. More likely than not, their responses to future crises caused by new and emerging risks have been developed based on disasters from a decade ago or longer. “Risk managers have always relied on historical loss data. However, in practical terms, we see every day how quickly this data loses relevance,” said Johnny Thomson, head of strategic planning at insurance and risk specialists RiskSTOP Group. “The risks faced by businesses evolve faster than the datasets designed to describe them. Climate volatility, supply chain fragility, skills shortages and shifting regulatory expectations now interact in ways that have no neat historical parallels. For many companies, the most important exposures today simply did not exist when their risk frameworks were designed.”
Third, data may not be as accurate and comprehensive as organizations believe it to be. If the information is patchy, incomplete, unverified, irrelevant or error-strewn, what benefits can it offer? The issue of data accuracy can become an even greater problem if companies are thinking of using AI tools. AI models train their responses based on historical data, but if the data that is input is bad, the output will be too. This creates one of the biggest challenges for companies. “When risk is interconnected, environmental, operational, compliance and reputational risks now feed into each other and fragmented datasets create blind spots,” said Paul Wnek, CEO of cloud tech consultancy Coalescence Cloud.
Before any organization rushes to apply AI or predictive models to these historical datasets, they must first ensure that their data is healthy, context-aware and connected to current operational realities. For risk management professionals working in regulated sectors, this is especially critical, as poor data health “not only undermines strategic accuracy—it introduces compliance gaps and operational exposure that could have been prevented with proper data hygiene,” he said.
Executives’ reluctance to depart with “trusted” methods may also create barriers as research indicates that boards are still heavily influenced by a reliance on historical data, despite its drawbacks, which may adversely affect strategic decision-making. According to professional services firm EY’s most recent Board of the Future study, corporate leadership is still too focused on short-term risks and short-term gains. This means executives rarely look too far into the future for risk trends and use recent historic data as a natural fallback, even though it may be less useful than they think. According to EY’s research, boards “suffer from a lack of opportunity for future-oriented thinking” and are “often trapped in a short-term, reactive cycle, hindering their ability to adequately prepare for disruptive trends or capitalize on transformative opportunities.”
Using Historical Data Effectively
Experts say historical data still has an important part to play in risk management—it is just important to recognize its limitations. Historical information still has value, but its role is diagnostic rather than predictive. “It helps explain how a failure occurred, not whether the same pattern will reappear,” Thomson said. “When organizations lean too heavily on past events to shape their future assumptions, they risk underestimating emerging threats or misallocating resources entirely.”
He believes the most resilient organizations are those that treat historical data “as a baseline, not a forecast,” and build simple, adaptable risk processes that “can adjust to conditions rather than anchor themselves to precedent.” Rather than just focusing on failures, resilient organizations also look at near-misses, weak signals and behavioral indicators, even when they do not fit established models. This gives a fuller picture of risks that occurred but were avoided, either by luck or by design. Further, the best risk-prepared companies focus on strengthening their day-to-day operational discipline because execution failures often matter more than historical prediction accuracy.
“The central problem is not that the past is useless—it is that the past can be dangerously comforting,” Thompson said. “Effective risk management now depends less on modeling familiar patterns and more on cultivating situational awareness, agility and an honest view of organizational vulnerabilities.”
Technology futurist Daniel Burrus believes a big problem is that a large proportion of risk planning is centered on “making assumptions based on other assumptions,” which can be dangerous. He categorizes future events in two ways: hard trends and soft trends. A hard trend is something that is certain to happen. Examples include the fact that AI is set to develop more quickly and become even more prolific, or that in terms of demographics, countries are going to see an increase in aging populations. Each example provides its own associated risks and opportunities that can be planned for.
Soft trends, on the other hand, are scenarios that are deemed likely to happen based on previous history, but which can change or be changed, ranging from the possibility of economic downturn and warfare to flood risk and supply chain disruption. Trying to mitigate these trends prompts companies to make assumptions based on guesswork that may not be reliable. Instead, Burrus said companies should prioritize hard trends and focus on agility rather than scenario planning to build resilience to mitigate potential disasters. Such an approach would automatically mean there is less onus placed on historical data.
While historical data provides context, many argue contemporary data provides better assurance. According to Judith Neumann, climate risk resiliency modeling expert at insurance tech vendor Guidewire Software, historical data has traditionally been split into two categories to aid risk management and help insurers price corporate risks. “Historic hazard” quantifies the physical events that could cause damage, while historic “loss data” quantifies the actual financial damage that occurred from those events.
However, the problem that companies now face is that using historic loss data to assess future risks is ineffective because the nature of risks has changed. For example, many hazards and their impacts are interrelated such as climate impacts coinciding with geopolitical or labor shocks. Since these scenarios rarely exist in historical datasets, traditional hazard analyses fail to account for them. As a result, potential impacts are understated.
Another issue is that boards have become fixated on the losses caused by specific risks, particularly in terms of the financial impact, rather than the consequences of what went wrong. “While historical views of threats go stale fast, the historical view of losses remains relevant,” said Asdrúbal Pichardo, CEO of cyberrisk quantification firm Squalify. This means companies tend to plan for contingencies based on worst-case scenarios of these risks occurring again and often in the same way.
Rethinking the Role of Historical Data
Such problems lead to the obvious question: If historic data is problematic, why not use current information? According to Yinglian Xie, CEO and co-founder of fraud and risk tech platform DataVisor, risk managers need to fundamentally rethink their approach by implementing continuous learning systems that adapt to emerging patterns in real-time rather than waiting for quarterly reviews of historical data. They also need to make sure such data is not siloed, which makes analysis more difficult. “Organizations should monitor further upstream, ingesting intelligence from authentication events and behavioral signals to detect risk activity before actual loss events occur, something historical data by definition cannot help you do,” she said.
“The challenge facing risk managers today is not that historical data has become useless, it is that relying primarily on backward-looking models in an era of rapidly evolving threats has become dangerously inadequate,” Xie added. “Traditional risk management systems have fundamental issues because they depend on static, human-written rules that are derived from past incidents. These systems are slow to adapt and cannot identify novel patterns.”
Real-time data monitoring can also allow organizations to tackle risks proactively. According to Vaidotas Sedys, chief risk officer at data tech firm Oxylabs, this is a necessity for cybersecurity, for example, which still tops most companies’ risk registers. Sedys said that a reactive approach is expensive in many ways and might bring financial and reputational damage, as well as harm to clients if their data is affected. Instead, companies should conduct “threat hunting” where cyber teams proactively identify potential risks and threat patterns to isolate them before they can cause any harm. “Systems that monitor the open source and detect early signals of growing risks in nearly real-time can alert cyber teams about shifts in the threat landscape,” he said. “Understanding what these shifts mean and how much they increase the threat remains the job for human intelligence—in other words, for experienced risk managers. In making these judgements, historical data can still play a role, but ultimately, reacting in real-time or being one step ahead requires alternative data.”
Experts believe that shifting more towards resilience planning will give companies greater capability to deal with new or compound shocks. Real resilience comes from up-to-date evidence that controls are working, backups will recover and operations can withstand disruption. Forward-looking risk signals, such as regulatory activity, supply chain capacity changes, social media sentiment and ESG ratings and risk indicators, will also often surface long before traditional performance metrics. “Risk managers should consider shifting from probabilistic to resilience-based risk management,” said Kevin Zhao, senior engagement manager at management consultancy Sapling Financial Consultants. “Rather than trying to forecast everything, risk managers should shift their mindset to assume some things will be unpredictable. The business must be able to withstand shocks.”
Companies will need to review their risk management practices and frameworks more regularly as historic data analysis becomes a less reliable indicator of future crises or how to deal with them. Further, the speed at which companies can absorb new data, update assumptions and adjust strategy will become increasingly more important than any single prediction.
According to Alan Zucker, instructor in project management at the University of Georgia, companies should document their risk management process and regularly review the environment to identify new risks and update the risk register. Risks that are no longer relevant should be closed, while those risks that still appear on the register should be reassessed to determine their probability, impact and what events could trigger them. He also warned against dismissing any risks that are deemed highly unlikely but could have potentially ruinous impacts. “If warranted, create a ‘red team’ to question everything,” he said. “Do not discard low-probability events or edge conditions. The consequences of black swan events can be catastrophic.”
Companies need to reexamine how they conduct risk assessments and how they are presented, Zucker said. Risk assessments are often skewed by the way they are categorized, which in turn affects the way they are interpreted, weighted and controlled. Risk expectations based on qualitative assessments can be subject to biases because outcomes are prioritized in terms of “best,” “worst,” “most recent” and so on. He said this “residual scar tissue from past mistakes,” may create a risk aversion bias or make it look like the company is on a winning streak—neither of which may be true if based on real-time data, but may appear to be when based on trends in historical data.
While all data is useful, some is more useful than others. Many experts believe historical data has its place in providing examples and context, but not necessarily as a way for companies to move forward—real-time data will do that more effectively. Risk managers and boards have traditionally placed great faith in the ability of historical data to provide practical responses for future crises, but its limitations are being realized in a world where new risks emerge quickly and some information becomes outdated just as fast.
Companies need to be able to read the signals and be more predictive about risk trends and the business environment. “Think more like a surfer: Read the swell, spot the anomaly, know when to paddle out and when to duck-dive,” said Michael Ashley Schulman, partner and chief investment officer at financial services firm Running Point Capital Advisors. “The real world is multiple moving targets wrapped in noise. In a world where the next big shock could come from TikTok, Taiwan, quantum computing, the White House or a shipping container stuck in a waterway, humility and truly out-of-the-box thinking might be your best hedge.”