Why it matters

Most plans are checked the optimistic way: you walk through how it is supposed to work and convince yourself each step holds. That tells you whether the plan can succeed. It does not tell you where it will break. Pre-Mortem (Fragility) runs the check the other way around — it assumes the thing has already collapsed and works backward to find the structural weaknesses that made the collapse possible. Not “will the team execute well?” but “is this structure sturdy under the kinds of stress it will actually face?” — where are the hidden single points of failure, the tight coupling, the concentrated exposure that turn one bad day into a total one.

For example: a company maps its supply chain and everything looks healthy — dozens of parts, multiple plants, a deep catalogue of products. Run the pre-mortem and you imagine the line has stopped dead. Tracing backward, you find that eleven of those parts, across four “different” suppliers, all originate from a single factory in one province. The org chart showed diversity; the failure showed a single point. When that one factory floods, the whole chain stops — and nothing in the optimistic walkthrough would ever have surfaced it.

  • What it reveals. The structural fragilities beneath a system or plan — the hidden single points of failure, the tight coupling, the concentrated exposure, and the vulnerability to rare high-impact shocks that an ordinary design review, reading the architecture as drawn, will not catch.
  • How it changes the read. You stop asking “how is this supposed to work?” and start asking “it has failed — what structural weakness let it fail, and what would the fix have to address?”
  • When to foreground it. A system, architecture, or arrangement about to be deployed, expanded, or leaned on harder, where the cost of a structural failure is high and you want the fragilities surfaced before they bite — not the optimistic walkthrough, the adversarial one.
  • What you’d miss without it. That the failure modes which matter most are usually the ones nobody actively imagined — the single dependency that looked redundant, the correlation the diagram did not show — and an optimism-anchored review systematically under-counts exactly these.
  • Where it misleads. Pushed without discipline it produces failure stories that are vivid but uncalibrated — the failures you can picture, which are not the same as the failures that will occur; and it surfaces fragilities, not fixes, so it can leave a sense of doom without the structural remediation that has to follow.

How it works

Start with the trick at the center of the method, which is almost embarrassingly simple. Before you launch the thing, gather everyone and say: it is a year from now, and this has failed — completely, publicly, and badly. Now tell me the story of how it happened. That single reframing, which the psychologist Gary Klein called a “pre-mortem,” does something a normal risk review cannot. When you ask a team “what might go wrong?”, people hedge — naming a risk feels disloyal, like predicting failure. But when failure is stated as a fact that has already happened and the only job left is to explain it, the hedging drops away and the real weaknesses come out. You are no longer forecasting; you are doing hindsight, in advance.

This version of the move is aimed at one specific quarry: structural fragility. Not “did the team execute well” but “is the structure itself brittle.” So as you narrate the collapse backward, you hunt for a particular family of weaknesses. Single points of failure — places where one part’s loss takes down a share of the system far larger than its size. Tight coupling — where parts are wired together so directly that a problem in one cannot be contained and propagates instantly into the others. Concentration — where what looked like many independent things turn out to depend on one shared thing (one supplier, one key, one data store, one assumption). Leverage — where a small adverse move gets amplified into a large loss. And exposure to tail events — the rare, high-impact shock, the “black swan,” that the routine forecast leaves out precisely because it is rare.

Take a portfolio that looks well diversified — a hundred holdings, spread across sectors. The optimistic read calls it safe because no single holding is large. Run the pre-mortem and you imagine the portfolio has cratered, then ask why. The answer is usually hidden correlation: in a real crisis the hundred holdings stop behaving like a hundred different bets and start moving together, all down at once, because they shared an exposure the diversification math never showed. The diagram said “diverse.” The stress revealed “one bet, wearing a hundred costumes.” That gap — between how independent things look on paper and how coupled they prove under stress — is exactly what this mode exists to find.

The deepest idea underneath all of this comes from Nassim Taleb, who gave fragility a precise meaning: a thing is fragile when it is harmed by volatility and disorder — when shocks, stress, and randomness make it worse, and the bigger the shock the more disproportionate the damage. A coffee cup is fragile; a single hard knock ends it. The crucial, liberating consequence is this: you can often see fragility in advance even when you cannot predict the shock that will trigger it. You do not need to forecast when the earthquake hits to know the building is unreinforced. You do not need to predict which supplier floods to see that the chain funnels through one factory. Taleb’s point in The Black Swan is that the triggering events — the rare, extreme ones — are essentially unforecastable; his point in Antifragile is that fragility itself is detectable, structural, and visible if you look. That is what makes the method work. It does not ask you to predict the unpredictable. It asks you to find the brittleness, which is sitting right there in the structure, waiting.

And it ends honestly. The output is not a fix — it is a diagnosis: here is what fails, here is the structural reason it fails, here is what cascades when it does, and here is what any real remediation would have to address. Naming a fragility you cannot fully eliminate is more useful than pretending the structure is sound.

Framework & implementation

Output contract

The deliverable is a fixed set of sections, so the analysis is auditable rather than a free-form scare story: an Imagined breakage narrative (the failure told backward as accomplished fact), a Structural fragility inventory (each fragility with its class, where it lives, and the mechanism by which it yields), Load pathways to breakage (for each fragility: the operating-envelope condition that triggers it, the structural property that yields, the immediate consequence, and the cascade through dependencies), Leading indicators per fragility (the observable signals that precede failure, the cost of acquiring each signal, and the lead time before yield), Structural mitigations (each tied to the fragility it addresses, with tradeoffs and implementation cost stated), Residual unmitigated fragilities (what no structural fix fully reaches, and whether that warrants rethinking the design), and Confidence per finding (how firmly each fragility is established versus inferred from unspecified detail).

Origin and evidence

The method braids three lineages. Gary Klein’s pre-mortem technique supplies the move itself — prospective hindsight, surfaced in his decision-research work and popularized in the Harvard Business Review — the reframing that makes a team name weaknesses it would otherwise hedge on. Nassim Nicholas Taleb supplies the conceptual core: The Black Swan (2007) on the rare, high-impact, retrospectively-explained event that dominates outcomes and resists forecasting, and Antifragile (2012) on fragility as the property of being harmed by volatility and disorder — and on the liberating fact that fragility is detectable in advance even when the triggering shock is not. Charles Perrow’s Normal Accidents (1984) supplies the systems-failure spine: in systems that are both interactively complex and tightly coupled, failures combine in unforeseen ways and serious accidents are not aberrations but a structural property of the design — which is precisely the family of fragility this mode hunts.

Applications and common uses

  • System and software architecture review. The native use: a service design, data architecture, or deployment topology stress-tested for single points of failure, hidden coupling, and cascade pathways before it carries production load.
  • Supply-chain and operations resilience. Surfacing the concentration that diagrams hide — the sole-source dependency, the single chokepoint, the “diverse” suppliers that converge on one origin.
  • Institutional and organizational design. On-call rotations, governance structures, staffing arrangements examined for the one-person dependency or the coupling that turns a small disruption into an outage.
  • Critical-infrastructure and public-systems planning. New platforms, dispatch systems, or service architectures pre-mortemed for the cascade that takes the whole system down at once.
  • High-consequence plans with structural moving parts. Any arrangement where the cost of a structural failure is high enough that finding the brittleness in advance is worth an adversarial pass.

Failure modes and when not to use it

  • Vivid-but-uncalibrated narratives. The technique surfaces the failures the analyst can imagine, which is not the same as the failures that will occur. The mode disciplines this by structuring the surfacing around named categories — single points of failure, hidden coupling, cascade pathways — and by demanding an explicit stress envelope rather than free-form catastrophizing.
  • The structural/process boundary blurs. Many real failures cross between “the structure is brittle” and “the team executed poorly.” The mode keeps its primary focus structural while flagging process implications that emerge naturally, rather than pretending the line is clean.
  • Doom without remediation. A fragility inventory can read as a verdict of hopelessness. The mode pairs each fragility with a mitigation and an honest residual, so the output is a starting point for hardening, not a sentence.

When not to reach for it. When the artifact is an action plan and the goal is to de-bias and strengthen it before commitment — write the failure post-mortem to harden the plan — route to pre-mortem-action, the future-exploration sibling that runs the same Klein move on plans rather than structures. When the real question is the full fragile / robust / antifragile classification with convex-versus-concave response to stress and a tail-risk audit, route to fragility-antifragility-audit, the depth-heavier Talebian sibling. And when a system has already failed and you want the backward causal trace of why, that is diagnosis of a past event — route to root-cause-analysis — not forward fragility surfacing.

  • Fragility / Antifragility Audit — the depth-heavier Talebian sibling in the same territory: when you want the full convex-versus-concave classification of how the system responds to volatility and a structured tail-risk reading, not a single imagined-failure narrative.
  • Pre-Mortem (Action Plan) — the same Klein prospective-hindsight move pointed at an action plan rather than a structure: imagine the project failed and write the post-mortem to de-bias and strengthen the plan before you commit.
  • Root Cause Analysis — the mode for after the fact: when a system has already failed and the task is tracing the failure backward to its structural cause, rather than surfacing fragilities before they bite.
  • Black Swan and Normal Accidents — the two lenses this mode leans on: keep the rare high-impact tail event in view, and treat serious failures in tightly coupled complex systems as structurally normal rather than exceptional.