Update to my black swan post. I found an excellent quote in a risk book about hedge funds, A demon of our own design (as always no partner link) which reflects my black swan post. Richard Bookstaber writes about risk management for financial instruments: "The types of risk that could be readily measured were better controlled, but those were not the risks that mattered. The real risk is the on you can't see." Exactly what I said about software development. Risk people can't see or have trained themselves blind spots for.