Ironic? Not really. Like most big companies, Shell has a contingency plan for physical disasters, which it implemented when Katrina hit, and no fancy scenarios were required to figure it all out. Far from being the kind of out there event that scenario planning is designed to reveal, a major hurricane making landfall at New Orleans was the most predictable and predicted disaster in recent memory. You can’t stop such an event, you can only deal with it, which Shell (like most major companies affected) is managing to do.

The larger point is that while Katrina was a monster among storms, it was a pipsqueak in the realm of risk analysis. The most important thing for managers to realize about Katrina is this: If it gets you thinking more intensively about risk, that’s great—but it is exactly the wrong kind of risk for you to focus on.

Understanding corporate risk has become a legitimate discipline in the past decade, with thousands of companies adopting “risk management” programs and hundreds appointing chief risk officers. To the CEOs who’ve done those things: Bravo—you realize that risk is one of the most powerful factors driving your stock price, and you were probably stunned when you confronted the total amount of risk your company faces. What amazes me is how many companies still don’t take full advantage of what risk management has taught us—specifically, five lessons that every company could apply to better understand and control its risks.

1. Turbocharge your imagination.

The events that do the worst damage are the ones no one even conceived of. Exhibit A is 9/11. The idea that a passenger jet might crash into the World Trade Center had been thought of; it was a fairly obvious possibility, especially since a plane had once crashed into the Empire State Building. What no one imagined was the combination of large planes with nearly full fuel tanks plus the impact of the crashes jarring fireproofing from the girders, and how this could bring the towers down. In retrospect, it obviously could have been imagined. It just wasn’t.

Fortune

2. Build scenarios.

Cold War military strategists originated scenario planning, so by now the technique is well developed. Properly guided, it can help managers see important possible events they wouldn’t otherwise have thought of—in Shell’s case, famously, the Arab oil embargo of the 1970s. It’s important to emphasize that no scenario told Shell’s managers the embargo would happen; this is a strategic-planning technique, not Nostradamus. But one of the scenarios the strategy group did cook up envisioned an accident in Saudi Arabia that raised the price of oil, causing Arab producers to rethink why they set prices as they did. Shell managers carried the analysis further and realized that Arab producers, angry with the U.S. for its support of Israel in the SixDay War, might believe they could serve many purposes at once by launching an embargo or restricting supply.

To repeat, nothing in the exercise told Shell managers to expect an embargo. But because they had done the exercise, they could see how events might lead to one, and when it happened, they were much better prepared than their competitors to respond. They had seen this movie already, so they slowed refinery expansion and adapted their refineries to handle many types of crude, while competitors vacillated. The common view in the industry is that Shell came through the oil shock far better than any other major producer.

To get into the scenario mindset, check the scenarios others have built. Shell publishes the outline of its annual exercise, and while it’s intended to help a global energy company, it’s widely applicable. The latest version foresees a world shaped by three large forces: a demand for efficiency and corporate performance as capitalism spreads and capital markets become global, a demand for community as developing nations seek a more peaceful future, and a demand for security as the world seemingly becomes more dangerous. Those forces will inevitably conflict. What might happen when they do? How might it affect your company?

Another recent set of deeply developed scenarios that will stimulate your mind comes from the National Intelligence Council, picturing possible futures for 2020. Will globalization advance peacefully and prosperously with China and India becoming economic superpowers? Or will the U.S. continue to dominate the new global order? Or will spreading nuclear weapons lead to a world so secure it’s Orwellian? Your company’s future is no more than two steps removed from the answers to those questions.

Fortune

3. Think in probabilities.

If you can imagine an event, you can try to assign a probability to it, if not in absolute terms—0.1%, 3%, 50%—then at least relative to other events. Sounds obvious.

The problem is that it’s excruciatingly difficult in real life because our brains aren’t wired that way. Nassim Nicholas Taleb, in his book Fooled by Randomness, cites an example: Ask a sample of travelers at an airport how much they’d pay for an insurance policy that would give their beneficiary $1 million if they die from any cause on their trip. Then ask another sample how much they’d pay for a policy that would pay $1 million if they’re killed by terrorists on their trip. People will pay more for the second policy, though that clearly makes no sense. We just do not think rationally about probabilities, a tendency every manager must fight.

4. Use the power of markets.

You’ve heard of the remarkable success of predictive markets, where real people bet real money on the likelihood of specific events. Around for years, these markets attracted lots of acclaim after calling the squeaker 2004 presidential election. You can check them—InTrade.com is the best known—to see if they’re offering contracts on events that might affect your business. For example, InTrade recently showed chances of private Social Security accounts being enacted by December 2006 at about 17%.

But you can also create such markets, focused on exactly the questions you want answered, among your own employees (generally with small amounts of money furnished by the company). Hewlett-Packard has used internal markets to forecast sales more accurately than the marketing manager could; Eli Lilly has used them to predict the success of drug research with uncanny accuracy. Well-designed predictive markets can give managers new insight into specific risks and how they might affect the company.

5. Create a culture that insists on facing reality.

A tall order, admittedly. But much of the recent thinking on corporate risk assumes that in a volatile and fast-changing world, a great many events simply cannot be prepared for. Try though you may to imagine possible futures, you can never entirely succeed. The key then becomes responding quickly and effectively to the bolt from the blue, and the No. 1 impediment—incredible yet obvious—is failing to accept that the trouble has happened. Even in New Orleans, immediately after Katrina passed by, we saw TV images of people dancing in Bourbon Street; they thought everything would be okay.

A tendency to avoid reality, to minimize bad news, is embedded deep in corporate culture. But while most cultural change must start at the top, I believe this change can start anywhere. The penalty for not changing seems to be getting stiffer.

Take all these steps, and you’ll be vastly better prepared for tomorrow than 95% of your competitors. But even if you take none of them right away, sit down in the next seven days, preferably with a few colleagues, and catalog as many risks for your business as you can think of—strategic, financial, operational, reputational, regulatory. You will never again think about your company’s risks in the same way, and I guarantee that you’ll feel forced to act. Make that response part of Katrina’s legacy.

A version of this article appears in the Oct. 3, 2005 issue of Fortune.