For all of the qualms we may have at times with our federal government, he said, one thing it does well is in the Department of Defenseplanning war games. They make the generals sit down and they make them go through scenario after scenario and figure out the various tripwires and bottlenecks that could hamper their responseto an attack as well as what the collateral responses might be in taking any particular action.

The strength of the military is that its planning is dynamic, not static like the checklist method used in some audits. The military is always looking at contingencies and various scenariosat the same time recognizing that things can change drastically at any time. And their planning never stops.

This type of activity, where people across the organization routinely gather to envisage possible scenarios and outcomes seems viable. Here again, though, consideration would have to be given to company culture and politics, which is already a glitch with ERM. But if it works for the military, it might be worth consideringand in fact might already in place in some organizations.

Would this practice absolutely protect the organization from everything? No, because even the best generals cantforesee everything. It does, however, offer a good shot atpreparedness for whatever does come up.

My question to risk managers is: would this strategy work in your organization? Is your company already doing something similar? What might be holding your company back?