A large loss is not evidence of a risk management failure because a large loss can happen even if risk management is flawless. I provide a typology of risk management failures and show how various types of risk management failures occur. Because of the limitations of past data in assessing the probability and the implications of a financial crisis, I conclude that financial institutions should use scenarios for credible financial crisis threats even if they perceive the probability of such events to be extremely small.