Where to next? In a crisis, it is likely relevant time will be compressed. Therefore, risk systems need to be robust and flexible to operate effectively under non-standard conditions. It is important to remember that the right risk technology is simply part of the solution; a holistic approach, under which risk is a concern of all across the business, is critical. After all, it is people, not the technology, who make the ultimate judgement call. More thought needs to be put into incorporating stress testing and scenario analysis to identify or provide an approximation of non-normal events, and how to minimise losses when they occur. What has tended to happen so far is that institutions and regulators have put measures into place that solve problems that have already occurred. What is needed is a forward looking approach. Plan for the unplanned. Plan for events that might happen in the future and don’t be left asking, ‘what if ’?