The fifth risk is the danger you weren't even tracking

Lewis borrows his title from a Department of Energy risk officer who was asked to list the top risks facing his agency. After naming familiar catastrophic threats, loose nuclear weapons, a nuclear-armed North Korea, collapse of the Iran nuclear agreement, and cyberattacks on the electrical grid, the official named a fifth: poor program management, the un-glamorous risk of an agency simply failing to execute its basic responsibilities well because of neglect, understaffing, or incompetence.

Lewis uses this list structurally: the most catastrophic risks a government faces often aren't exotic disasters but mundane failures of attention and management that quietly compound until a crisis reveals them. The Department of Energy alone oversees nuclear stockpile security and cleanup of contaminated former weapons sites, work invisible to the public until something goes wrong.

This idea threads through the whole book, that competent, boring management is itself a form of catastrophe prevention, and that undermining it is a risk few people think to worry about until it's too late.

Takeaway: the disaster nobody saw coming is usually the one caused by nobody managing the risk they were supposed to be watching.