Known Unknowns Matrix

  Before approving a plan, identify which unresolved assumption would require the largest change if it proved false.

        In covert operations, incomplete information is a working condition. An operative may have a detailed account of yesterday’s activity, a credible assessment of present capability, and very little evidence about what happens next. Problems develop when those different levels of knowledge disappear inside a confident briefing.

  The known unknowns matrix separates information into four categories: known knowns, known unknowns, unknown knowns, and unknown unknowns. Each category calls for different work. Established information needs maintenance. Recognized gaps need precise questions. Overlooked information needs examination. Unanticipated conditions require plans that can absorb disruption.

The classification is relative to a particular operative, team, and decision. Information can be familiar to one specialist and absent from the planning team’s assessment. A fact can also be established for one time and place while remaining unverified elsewhere.

  The matrix gives observation and orientation a practical framework to work with. It exposes where a judgment depends on inference, identifies what deserves further attention, and keeps unresolved uncertainty visible when a decision has to be made.

Write the decision and its deadline above the matrix, remove entries that can’t affect either the action or its safeguards.

        Begin with the decision the assessment must support. “Understand the situation” is too broad to control collection. “Determine whether the current communications arrangement can support tomorrow’s reporting requirement” gives the team a defined problem, a time limit, and a reason to investigate specific gaps.

The matrix is a working method for organizing uncertainty. It doesn’t calculate risk, certify a source, or establish that an assessment is complete. A neatly populated page can still contain weak evidence and poorly framed questions.

  Before assigning categories, distinguish what was reported from what the team concluded. Preserve that distinction through subsequent briefings.

• Observation – what a person or system directly recorded, with the time and relevant conditions attached.
• Report – what a source communicated, the existence of the report doesn’t establish the truth of its contents.
• Assessment – the conclusion drawn from available information, including the reasoning that connects the evidence to the conclusion.
• Assumption – a proposition accepted provisionally to support planning, with its unverified status stated explicitly.

“The equipment passed its morning check” and “the equipment will remain available throughout the assignment” belong in different evidentiary categories. The second statement extends beyond the observation.

• Specific Claim – write one proposition that can be examined; separate availability, capacity, and reliability into distinct entries.
• Evidence Reference – identify the supporting record and its date, using appropriate handling controls for sensitive material.
• Decision Effect – state what would change if the claim were confirmed, rejected, or left unresolved.
• Responsible Owner – assign someone to resolve the gap or maintain the assessment.
• Review Trigger – specify the deadline or observable change that requires another look.

These fields prevent the matrix from becoming a static inventory. Every consequential entry has a reason to exist and a defined next action.

  Claim Separation – split any entry joined by “and” when its components depend on different evidence; otherwise, confirmation of one part can conceal uncertainty in the rest.

Attach a time boundary to every operational fact whose usefulness depends on conditions remaining unchanged.

        Known knowns are claims supported well enough to serve as established inputs to the current decision. Their scope matters. A verified inventory establishes what was counted at a particular time – it doesn’t automatically establish serviceability, readiness, or future availability.

Operatives should be exact about what confirmation actually covers. Familiarity with a claim, repeated briefing, and senior endorsement don’t expand its evidentiary basis.

• Time Boundary – record when the information was valid and what subsequent developments could make it stale.
• Coverage Boundary – identify the locations, people, equipment, or periods actually examined.
• Source Independence – check whether apparently separate reports originate from the same observation or source.
• Measurement Limits – preserve relevant limitations in visibility, sampling, instrument performance, or source access.
• Contradictory Evidence – retain unresolved inconsistencies alongside the claim so they remain visible during planning.

Three reports repeating one account provide one underlying account. Counting the repetitions as independent confirmation inflates the apparent support.

  Likelihood describes the assessed chance of an event. Confidence describes the strength of the evidence and reasoning supporting that assessment. An event can be assessed as likely while confidence remains low because reporting is limited.

State these separately and explain the uncertainty. A confident delivery doesn’t improve the source base. When new evidence undermines an established claim, reopen it and identify which decisions relied on its previous status.

  Dependency Check – identify the established claim used by the greatest number of planning decisions and review its supporting evidence before spending time refining peripheral details.

Specify what evidence would answer a collection question before assigning someone to pursue it.

        Known unknowns are recognized gaps. You can name the missing information and explain why it matters. A capability may be confirmed while its availability, limitations, or intended use remain unresolved.

This category gives collection its most direct tasking. The quality of that tasking depends on how precisely the gap is written. “We need more information” produces activity without a clear completion standard.

• Missing Variable – identify the exact unresolved parameter, relationship, or condition.
• Decision Branch – describe how different answers would change the plan.
• Acceptable Evidence – define what information would meaningfully resolve the question and what would remain insufficient.
• Useful Deadline – establish when the answer must arrive to influence action.
• Unresolved Outcome – determine how the team will proceed if the answer remains unavailable.

For example, “Can the designated support service provide the required capacity during the planned work period?” is a usable question. It identifies a requirement that can be checked. General reassurance that the service is dependable leaves capacity and timing unanswered.

  A response can narrow uncertainty without resolving it. Confirmation that a system is available doesn’t establish that it can carry the required workload. Evidence that someone possesses a capability doesn’t establish an intention to use it.

Update the entry with what changed, then preserve the remaining question. Avoid closing a requirement because information arrived or because the answer sounds broadly reassuring.

Some gaps will remain open at the decision deadline. Record the assumption being used, the consequences if it’s wrong, and the condition that requires a tactical pause or revised plan.

  Answer Discrimination – write two plausible answers beside each priority question and identify the different action each would produce; identical actions usually indicate a lower-value collection requirement.

Before opening a new requirement, check whether another team already holds the answer under a different description.

        In this framework, unknown knowns are information already held somewhere within the available knowledge base whose relevance hasn’t been recognized or brought into the decision. A detail may be buried in an old report, retained as a specialist’s experience, or separated from the record that gives it meaning.

The category is relative to the people making the assessment. One operative may know that a recurring equipment fault follows a particular maintenance condition while the planning team treats each failure as unrelated. The knowledge exists, but it isn’t informing the plan.

• Record Reconciliation – compare relevant logs and reports using consistent names, dates, and definitions.
• Experience Elicitation – ask specialists which conditions require exceptions to the written process and what taught them those exceptions.
• Unresolved Detail Review – revisit observations previously set aside because their significance wasn’t clear.
• Handoff Examination – identify qualifications or exceptions that disappeared when information passed between teams.
• Authorized Cross-Check – connect relevant knowledge through approved access and coordination channels while preserving necessary compartmentation.

A maintenance note and an availability report may appear unrelated until their dates are compared. That comparison can produce a new hypothesis about reliability. The hypothesis still requires examination before it’s treated as an established explanation.

  Experienced operatives sometimes recognize a problem before they can explain their judgment. Treat that reaction as a prompt to identify the cues involved. Record what attracted attention, what comparison the operative made, and what alternative explanation could account for it.

Tacit knowledge becomes more useful when another person can examine its basis. Unexplained intuition should remain distinguishable from a supported finding.

Document the recovered insight where the next team can locate it. Rediscovering the same limitation during every assignment wastes time and makes performance depend on whoever happens to be present.

  Exception Capture – during debrief, record the workarounds experienced personnel used without being instructed; each may reveal an undocumented limitation in the standard process.

Test whether the fallback depends on the same infrastructure, supplier, or assumption as the primary plan.

        Unknown unknowns are relevant conditions or possibilities the team hasn’t recognized as questions. They can arise from unfamiliar technology, an overlooked dependency, an unexpected interaction, or a mistaken understanding of how the environment works.

You can’t write a complete list of genuinely unrecognized problems. Once a possibility has been identified clearly enough to investigate, it has become a known unknown. The practical work is to widen the assessment and reduce the damage an incomplete understanding can cause.

• Independent Framing – have a qualified reviewer describe the problem before seeing the preferred explanation.
• Dependency Mapping – identify the services, people, and resources the plan requires, including dependencies shared by its alternatives.
• Anomaly Retention – preserve observations that don’t fit the current assessment and assign a proportionate review.
• Failure Reconstruction – assume the plan produced an unacceptable result and work backward through plausible causes.
• Domain Review – involve relevant expertise outside the immediate team when the problem crosses technical or organizational boundaries.

These methods can expose overlooked questions. They don’t establish that every important possibility has been considered, and an unusual observation doesn’t automatically imply hostile activity.

  Build room for correction into the assignment. Where conditions permit, retain time, reserve capacity, and a reversible first step. Specify who can suspend activity when the working assessment stops explaining what the team is observing.

Examine whether alternatives can survive the same disruption. Two services supplied through one underlying network can fail together. An alternate provider may offer little protection when both depend on the same facility or authorization.

Adaptive option generation becomes more useful when each option’s dependencies are visible. Additional choices provide limited value if they reproduce the same vulnerability.

  Recovery Capacity – identify what the team would need to reassess after losing its preferred explanation, including access to records, decision authority, and enough time to interpret new information.

End collection when further answers can no longer change the pending decision within the time available.

        Collection resources are finite. A gap deserves attention when resolving it could materially improve the decision, reduce a consequential uncertainty, or reveal that the proposed action is unsuitable.

The most interesting question may have little bearing on the assignment. Likewise, the easiest question to answer can consume attention because it creates visible progress. Prioritize according to operational consequence and the usefulness of the answer.

• Consequence of Error – assess what happens if the working assumption is wrong, including effects on personnel, resources, and mission output.
• Decision Sensitivity – identify whether a plausible answer would change the action, timing, scope, or safeguards.
• Time Remaining – compare the likely collection timeline with the last point at which an answer remains useful.
• Resolution Potential – judge whether available methods can meaningfully reduce the uncertainty.
• Collection Burden – account for effort, access requirements, exposure, and the work displaced by pursuing the question.

Use these factors to make priorities explainable. An elaborate score can conceal uncertain inputs beneath precise-looking numbers. A short written justification often makes disagreements easier to identify.

  Establish what constitutes sufficient information for the pending decision. Some questions require direct verification because an incorrect assumption would create unacceptable consequences. Others can remain unresolved if the action is limited, reversible, and supported by adequate safeguards.

If a critical gap can’t be resolved, modify the plan to reduce its dependence on that answer. The appropriate response may be a smaller initial commitment, additional reserve capacity, or a delay.

Rapid decision-making requires a clear account of residual uncertainty. The briefing should state what remains unanswered and how that affects the chosen action.

  Requirement Retirement – close or downgrade collection tasks when the supported decision changes; otherwise, teams can continue answering questions for a plan that no longer exists.

When an entry changes category, trace every recommendation that depended on its previous status.

        Consider a team preparing for an assignment that requires reliable communications support. The pending decision is whether the current arrangement can sustain the required reporting schedule.

The matrix should classify individual claims within that problem. Labeling the entire communications arrangement “known” would hide several separate uncertainties.

  Classify each claim according to the evidence available to the team at the time of assessment. In this communications example, separate confirmed equipment performance from unresolved operating limits and information that hasn’t reached the planning team.

Recovering the technician’s notes creates a more precise requirement: determine whether the reported condition applies to the equipment and workload in question. A relevant test may resolve part of that requirement. Any remaining uncertainty stays attached to the decision.

  Review the matrix before a consequential commitment, when conflicting information comes, when a dependency changes, and when an agreed review period expires. Frequency should match how quickly the relevant conditions can change.

An updated matrix has little value if the operative executing the assignment still holds the old assessment. Distribution is part of completing the revision.

  During debrief, compare the assessment with what actually occurred. Identify which evidence was useful, which assumptions failed, and which warnings were available but overlooked.

Use the record to improve future questions, review triggers, and information handoffs. The matrix becomes more valuable when the team can identify recurring weaknesses in its own assessments.

  Revision Trace – retain the previous assessment alongside its replacement so the team can distinguish genuinely new information from facts that were available and misinterpreted.

Keep unresolved gaps in the final briefing, with an owner, a consequence, and a defined reason to reopen the decision.

        Known unknowns tradecraft requires accuracy about the limits of an assessment. The matrix earns its place when it changes collection priorities, recovers overlooked knowledge, or exposes a dependency that requires a different plan. Maintain it around an actual decision, preserve inconvenient evidence, and make revisions reach the people who need them.

//   Record what would change your assessment before the outcome gives you a reason to rewrite it.

  + Covert Operative Kit [ ] gear shop »»