Peter L. Bernstein’s Against the Gods: The Remarkable Story of Risk is the history of the idea that risk can be measured, from a world in which the future belonged to the gods and the oracles to one in which it is estimated, priced, insured, hedged and, as the book’s last chapters warn, mistaken for something more knowable than it is. Published in 1996 by an investment manager and economic historian, it traces the people who built the tools: the gamblers and mathematicians of the seventeenth century who invented probability, the actuaries and astronomers who found the normal curve, the polymath who found regression to the mean, the economists who distinguished measurable risk from true uncertainty, and the psychologists who showed how badly people use any of it. For an internal auditor the book is the back story of every method the profession uses, from sampling to expected loss to the heat map, and it explains why those methods carry the assumptions they do. This guide summarises the book without reproducing it, sets out the story and its ideas, maps them to audit practice, and ends with a worked example of a manufacturer’s audit function using the book’s history as a diagnostic of its own risk management.
In this guide
- The book in one page
- Who Peter Bernstein was, and where the book came from
- The structure: five eras
- The story, in twelve steps
- Three episodes, read closely
- The nine ideas worth keeping
- The vocabulary: fourteen terms defined for practitioners
- What it means for internal audit: the assumptions inside the tools
- Risk and uncertainty: the distinction the profession keeps forgetting
- Insurance: the first industry built on the book’s ideas
- The criticisms, and what has happened since 1996
- Editions, reading time and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Brightwater Foods asks which century its risk management is in
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is it about? | The intellectual history of risk: how humanity moved from treating the future as fate to treating it as a set of outcomes with probabilities, and what that shift made possible, including insurance, finance, science and the modern corporation. |
| Who are the people? | Fibonacci, who brought Arabic numerals to Europe; Cardano, the gambler who first wrote down the odds; Pascal and Fermat, who solved the problem of points in 1654 and founded probability; Graunt and Halley, who built the first mortality tables; the Bernoullis, who gave us the law of large numbers and the idea of utility; de Moivre, Gauss and Galton, who found the bell curve and regression to the mean; Keynes and Knight, who separated risk from uncertainty; Markowitz, who made diversification a mathematics; and Kahneman and Tversky, who showed how people actually choose. |
| What is the argument? | That the mastery of risk is the defining achievement of the modern world, that it rests on a small number of ideas that took centuries to develop, and that the ideas have limits which their users forget at their cost. |
| Where does it end? | With the derivatives markets of the 1990s and a warning: the tools assume that the future resembles the past and that people behave rationally, and neither assumption is reliable. |
| Why read it as an auditor? | Because every quantitative method the profession uses, sampling, expected loss, confidence levels, regression, diversification, utility, was built by someone in this book for a purpose, with assumptions that are still inside it. |
| Reading time | About thirteen hours for the 380-page paperback; the chapters are self-contained and can be read selectively. |
Who Peter Bernstein was, and where the book came from
Bernstein, who died in 2009, ran an investment counselling firm for decades, was the first editor of the Journal of Portfolio Management, and wrote a series of books on the history of economic ideas, of which this was the most successful. Against the Gods was published by John Wiley and Sons in 1996 and in paperback in 1998, sold more than half a million copies, and became the standard popular history of its subject. Bernstein wrote as a practitioner with a scholar’s habits: he had used the tools he describes, he knew their inventors’ papers, and he was sceptical of the confidence that the tools inspire in people who have not read how they were built. His later books on the history of gold and of the Erie Canal and on the capital ideas of modern finance continued the method. The book predates the financial crises that tested its warnings, which makes its last chapters read, now, as prophecy.
The structure: five eras
| Part | Period | What it covers | What it contributes |
|---|---|---|---|
| To 1200: Beginnings | Antiquity to the Middle Ages | Why the Greeks, with their mathematics, never developed probability; the role of numerals and of gambling; fate and the gods | The world before risk was measurable |
| 1200 to 1700: A Thousand Outstanding Facts | The Renaissance and after | Cardano, Galileo on dice, Pascal and Fermat’s correspondence of 1654, Pascal’s wager, Graunt’s mortality tables, insurance at Lloyd’s coffee house | The invention of probability and of its first commercial use |
| 1700 to 1900: Measurement Unlimited | The Enlightenment and after | Jacob Bernoulli’s law of large numbers, Daniel Bernoulli’s utility and the St Petersburg paradox, de Moivre’s bell curve, Bayes, Laplace, Gauss, Galton’s regression to the mean, Quetelet’s average man | The tools of measurement and their first statistical laws |
| 1900 to 1960: Clouds of Vagueness and the Demand for Precision | The twentieth century | Knight on uncertainty, Keynes on probability and animal spirits, von Neumann and Morgenstern’s game theory, Markowitz’s portfolio selection, Arrow on uncertainty and insurance | The economics of risk and the limits of measurement |
| Degrees of Belief: Exploring Uncertainty | The 1960s onward | Kahneman and Tversky on how people choose, the derivatives markets, Black-Scholes, the question of whether risk management has made the world safer | The behavioural turn and the warning |
The story, in twelve steps
| Step | Who and when | The idea | Where an auditor meets it |
|---|---|---|---|
| 1 | Fibonacci, 1202 | Hindu-Arabic numerals and the arithmetic of trade reach Europe | Everything that follows |
| 2 | Cardano, mid-1500s | The first written calculation of odds, for dice; the idea of a sample space | Probability as a count of outcomes |
| 3 | Pascal and Fermat, 1654 | The problem of points: how to divide the stakes of an interrupted game; expected value | Expected loss; the arithmetic of a risk score |
| 4 | Graunt and Halley, 1660s to 1690s | Mortality tables from the London bills of mortality and the Breslau records; life expectancy; the pricing of annuities | Loss data as the basis for estimates; actuarial reserving |
| 5 | Jacob Bernoulli, 1713 | The law of large numbers: with enough trials the observed frequency approaches the probability | Why samples work, and why small ones do not; the sampling guide |
| 6 | Daniel Bernoulli, 1738 | Utility: the value of a gain depends on what you already have; the St Petersburg paradox | Risk appetite; why the same loss is different for different organisations |
| 7 | De Moivre, 1733; Gauss, 1809 | The normal distribution and the measurement of error; least squares | Confidence levels; the assumption behind most statistical tests |
| 8 | Bayes, 1763 | Updating a probability with evidence | Revising a risk rating as evidence arrives; the Superforecasting summary |
| 9 | Galton, 1880s | Regression to the mean | Why last year’s worst unit improves on its own |
| 10 | Knight and Keynes, 1921 | Risk (measurable) versus uncertainty (not); probability as degree of belief | The limit of every quantitative method |
| 11 | Markowitz, 1952 | Diversification as mathematics: portfolio risk depends on correlation, not only on individual risks | Aggregation in ERM; concentration risk |
| 12 | Kahneman and Tversky, 1979 | Prospect theory: people do not choose by expected utility | How management decides; the Thinking, Fast and Slow summary |
Three episodes, read closely
Three of the book’s episodes repay a closer reading, because each contains the origin of a tool an auditor uses without thinking about where it came from.
Pascal, Fermat and the problem of points (1654). The question the two mathematicians settled by letter was practical: if a game of chance is interrupted before it ends, how should the stakes be divided? Earlier answers had looked backward, to how many rounds each player had won; Pascal and Fermat looked forward, to the probability of each player winning had the game continued, and divided the stakes in proportion. That forward-looking division is expected value, and it is the idea beneath every expected-loss calculation and every likelihood-times-impact score. Bernstein’s point is that the problem was solved by asking what could happen rather than what had happened, which is the shift an audit function makes when it moves from an incident log to a risk assessment. The weakness of the method is the one the Hubbard summary develops: it needs probabilities and amounts, and a score of three times four is neither.
The two Bernoullis (1713 and 1738). Jacob Bernoulli proved that the observed frequency of an event converges on its true probability as the number of trials grows, which is the law that makes sampling a method rather than a hope; he also worked out, in his own urn example, that 25,550 trials were needed for moral certainty, and in practice the answer for rare events is more than anyone has. His nephew Daniel asked a different question: why would a rational person refuse a gamble with an infinite expected value, the St Petersburg paradox, and answered that the value of money depends on how much one already has, so that the same loss means different things to different players. That is utility, and it is the idea behind risk appetite: an organisation’s tolerance for a loss is a function of its position, and a risk framework that scores impact without reference to what the organisation can survive has skipped Daniel Bernoulli. The ERM guide treats appetite as a statement about survival for that reason.
Galton and regression to the mean (1880s). Francis Galton, studying heredity, found that the children of very tall parents were tall but less so, and that the children of very short parents were short but less so; extreme values in one generation were followed by less extreme values in the next, for purely statistical reasons. It is one of the most important and least understood ideas in the book, and an auditor sees it misread every year. The worst-performing unit improves after a management change; the branch with the most errors improves after an audit; the quarter after a record loss is better. Some of the improvement is the intervention and much of it is Galton, and the only way to tell them apart is a comparison group or a reference class, which the root cause guide asks for before an improvement is attributed to anything.
The nine ideas worth keeping
- Risk became measurable when the future stopped being fate. The shift from oracle to probability is the precondition for insurance, investment, planning and audit; the book’s first argument is that it was a cultural change before it was a mathematical one.
- Probability began as counting. Cardano and Pascal counted outcomes; the method works where outcomes can be enumerated and fails where they cannot, which is most of business life.
- The law of large numbers is a promise about the long run. Bernoulli proved that frequencies converge with enough trials; his own example needed 25,550 of them for moral certainty, and in practice there are never enough for rare events.
- Utility explains why the same risk is different for different people. A loss that ruins one organisation is a rounding error to another; risk appetite is Daniel Bernoulli’s idea in corporate form.
- The bell curve describes errors, not the world. Gauss built it for astronomical measurements; its spread to finance and risk brought the assumption that extremes are rare, which they are not.
- Regression to the mean is everywhere and always misread. Galton found it in heredity; it explains most of what managers attribute to their interventions.
- Risk is not uncertainty. Knight’s distinction is the most important sentence in the book for an auditor: where the distribution is unknown, probability is a judgment, and a number attached to a judgment is still a judgment.
- Diversification is about correlation. Markowitz showed that the risk of a whole depends on how its parts move together, which is why aggregation, not scoring, is the hard part of ERM.
- People do not use the tools as the tools assume. Kahneman and Tversky closed the circle: the mathematics of rational choice describes nobody, and the book’s warning is that the models work only until the people in them behave like people.
A reader who takes only one thing from the nine should take the seventh. The profession’s frameworks, its scoring scales and its reporting formats all treat likelihood as a property of the risk, when for most of the risks that matter it is a property of the assessor’s knowledge. Knight’s distinction is not a philosophical nicety; it decides whether a number in a register can be checked against anything. A frequency can be checked against the next year’s count. A belief can only be checked against the reasoning that produced it, which is why the professional judgment guide asks for that reasoning to be written down before the outcome is known. Bernstein’s history ends where that discipline begins.
The vocabulary: fourteen terms defined for practitioners
| Term | Origin in the book | What it looks like in an audit |
|---|---|---|
| Probability | Cardano, Pascal, Fermat | The likelihood axis, when it means anything |
| Expected value | Pascal and Fermat’s division of stakes | Expected loss as probability times impact |
| Sample space | Cardano’s enumeration of dice outcomes | The population a test draws from |
| Law of large numbers | Jacob Bernoulli | Why sample sizes matter |
| Utility | Daniel Bernoulli | Risk appetite and tolerance |
| Normal distribution | De Moivre, Gauss | Confidence levels; the assumption of thin tails |
| Regression to the mean | Galton | Improvement that is not caused by the intervention |
| Bayesian updating | Bayes, Laplace | Revising a rating on new evidence |
| Mortality table | Graunt, Halley | Loss data; actuarial reserving |
| Risk versus uncertainty | Knight, Keynes | Measurable exposures versus judgments |
| Diversification | Markowitz | Correlation in aggregation and concentration |
| Game theory | Von Neumann and Morgenstern | Counterparties who respond to what you do |
| Prospect theory | Kahneman and Tversky | How management decides under risk |
| Derivatives | The book’s closing chapters | Hedging and the transfer of risk; see the market risk guide |
What it means for internal audit: the assumptions inside the tools
The practical value of the history is that it exposes the assumptions each tool carries, and the table sets them beside the audit activities that rely on them. The risk assessment guide, the sampling guide and the ERM guide carry the methods.
| Audit tool | Where it came from | The assumption inside it | What the auditor should check |
|---|---|---|---|
| Risk scoring by likelihood and impact | Pascal and Fermat’s expected value, simplified | That likelihood and impact can be estimated and multiplied | Whether the scales are quantities or labels; the Hubbard summary |
| Statistical sampling | Bernoulli’s law of large numbers; the normal approximation | A stable population with a known error structure | Sample size against the rare event; whether the population is homogeneous |
| Confidence levels | De Moivre and Gauss | Normally distributed errors | Whether the exposure is thin-tailed; see the Black Swan summary |
| Loss data and reserving | Graunt and Halley | The past frequency predicts the future | Completeness of the data; regime changes |
| Risk appetite statements | Daniel Bernoulli’s utility | That the organisation’s tolerance can be stated as a function of loss | Whether the statement is specific enough to test against |
| Aggregation in ERM | Markowitz’s correlation | That correlations are known and stable | Stressed correlations; the When Genius Failed summary |
| Trend analysis | Galton’s regression | That movements are signal | Regression to the mean before attributing improvement |
| Management’s decisions | The rational-choice model | That people maximise expected utility | Loss aversion and framing; the Kahneman summary |
Risk and uncertainty: the distinction the profession keeps forgetting
Frank Knight, in 1921, distinguished risk, where the distribution of outcomes is known and the exposure can be measured and insured, from uncertainty, where it is not and cannot be; Keynes, the same year, argued that probability is a degree of rational belief rather than a frequency, and that many probabilities cannot be expressed as numbers. Bernstein treats the distinction as the hinge of the book, and it is the hinge of risk management too. An audit function works in both domains at once: transaction error rates, fraud frequencies in large populations and the behaviour of well-understood processes are risk, and the statistical tools apply; the effect of a new regulation, the success of a strategy, the loyalty of a key customer and the behaviour of a counterparty under stress are uncertainty, and the tools produce numbers that are judgments in costume. The error the book warns against is treating the second as the first, and the remedy is labelling: a register that marks which estimates are frequencies and which are beliefs, and reports them differently, has read Knight. The ERM guide and the risk register guide describe the labelling.
Insurance: the first industry built on the book’s ideas
The book’s chapters on insurance are the ones most directly about risk transfer, and they explain a business that every audit function deals with and few understand from the inside. Marine insurance existed before probability, as a bet between a shipowner and a wealthy backer; what changed in the late seventeenth century was that Edmond Halley, using the records of births and deaths from the city of Breslau, produced a table from which the price of an annuity could be computed rather than guessed, and that the coffee house of Edward Lloyd became a place where such bets were priced by people with information. Insurance as an industry rests on three of the book’s ideas at once: the law of large numbers, which makes a pool of independent risks predictable even when each is not; utility, which explains why a policyholder pays more than the expected loss to be rid of a risk; and the distinction between risk and uncertainty, which marks the boundary of what can be insured at all.
For an auditor the chapters have two uses. The first is the audit of the organisation’s own insurance programme, where the questions the book implies are whether the limits reflect what the organisation can survive, whether the pooled risks are as independent as the premium assumes, and whether the uninsurable exposures, the uncertainties, have been identified and accepted deliberately rather than by omission. The second is the recognition that an insurer, a bank, a pension fund or a self-insured corporation is running the same arithmetic as Halley and Lloyd’s, and that the arithmetic fails in the same places: when risks that were assumed independent turn out to be correlated, as mortgages did in 2008, and when the past frequency stops describing the future, as pandemics and cyber losses have shown. The resilience guide and the reputation risk guide both treat uninsurable exposures as the ones that need a plan rather than a policy, which is the book’s distinction applied.
The criticisms, and what has happened since 1996
Specialists may find their field compressed: the history of probability is deeper and more contested than the narrative allows, and the great-man structure, one inventor per idea, flatters the record. The treatment of the twentieth century is thinner than the earlier chapters, and the closing discussion of derivatives dates quickly. What has happened since is the book’s vindication. The crises of 1998, 2008 and 2020 each demonstrated that the tools built on the normal curve and on stable correlations fail when the assumptions behind them do, which is the book’s last chapter stated as events. Taleb’s books, which the Fooled by Randomness summary and the Black Swan summary cover, are the polemical sequel to Bernstein’s warning, and Hubbard’s is the methodological one. Read as history the book has aged well; read as a guide to practice it needs those successors beside it.
Editions, reading time and how to read it
| What | Details | Best for |
|---|---|---|
| Hardback | John Wiley and Sons, 1996, about 380 pages | The first edition |
| Paperback | Wiley, 1998 | The edition most readers own |
| Reading plan | The Pascal and Fermat chapter, the Bernoulli chapters, the Galton chapter, the Knight and Keynes chapter, and the last three chapters | An auditor with two evenings |
| Companion reading | The Fooled by Randomness summary and the Black Swan summary for the limits; the Hubbard summary for the method | From history to practice |
A one-hour discussion guide for an audit team
- Ten minutes: the inventory. List every quantitative method the function uses, and beside each the chapter of the book it comes from. The exercise shows how few ideas the methods rest on.
- Fifteen minutes: risk or uncertainty. Take the organisation’s top ten risks and sort them into Knight’s two categories. Discuss how the register treats the second group.
- Ten minutes: the normal assumption. Name the places in the organisation’s risk measurement where a bell curve is assumed, and whether the exposure has fat tails.
- Fifteen minutes: regression to the mean. Find a unit or process that improved after an intervention in the last two years and discuss how much of the improvement was Galton’s.
- Ten minutes: the register. Decide whether to add a field marking each estimate as frequency or belief; the risk register guide shows where it goes.
Worked example: Brightwater Foods asks which century its risk management is in
Brightwater Foods is a fictional $180 million food manufacturer with three plants, a single internal auditor supported by a co-sourced provider, and a risk management process that the board described as mature. The auditor, asked to assess it, used the book’s history as a diagnostic: for each element of the process, which of Bernstein’s ideas was it using, and which was it missing?
| Element of the process | The idea it used | The idea it was missing | What changed |
|---|---|---|---|
| The risk register scored one to five on likelihood and impact and multiplied | Expected value (1654), as labels rather than quantities | Bernoulli’s utility: the same score for a $50,000 and a $5 million exposure | Impact rescaled in dollars; the Hubbard summary‘s one-for-one substitution adopted for the top twelve |
| Food-safety risk was rated on five years of incident data | Graunt’s mortality table: the past frequency as the estimate | Knight’s uncertainty: a recall is a regime change the data does not contain | The risk marked as a belief, assessed by scenario; a mock recall scheduled |
| Customer concentration was noted but not aggregated with credit and supply risks on the same customers | Nothing | Markowitz’s correlation: the risks move together | An aggregation of all exposures to the two largest customers added to the board pack |
| A plant’s safety record had improved sharply after a new manager arrived | Causal attribution | Galton’s regression: the plant had been the worst of three the year before | The improvement reported with the prior-year context; the manager’s credit reduced to what the data supported |
| Insurance limits were set on the broker’s advice | Halley’s annuity pricing, delegated | Utility again: the limits did not reflect what loss the company could survive | A survival threshold stated by the board; limits reviewed against it |
| The board reviewed the register annually | None of the book | Bayes: nothing was updated between reviews | Quarterly updates for the risks marked as beliefs, with the evidence that changed them |
The auditor’s report placed the company’s risk management, in the book’s terms, somewhere in the seventeenth century: it had expected value and loss data and nothing that came after. The board found the framing more useful than a maturity score, because it said what was missing rather than how much. Six changes followed, none expensive, and the register the board saw the following year distinguished what the company could measure from what it could only judge, which is the distinction the book was written to preserve.
Frequently asked questions
Is Against the Gods a technical book?
No. It explains each idea in words with a few simple examples and almost no formulae; it is a history for general readers, written by a practitioner who used the tools.
What is the most important chapter for an auditor?
The chapter on Knight and Keynes, which draws the line between measurable risk and uncertainty. Most errors in risk management, and in audit’s assessment of it, come from putting exposures on the wrong side of that line.
How does the book relate to Taleb’s?
Bernstein wrote the history and ended with a warning about the tools’ assumptions; Taleb wrote the polemic about what happens when the warning is ignored. The Fooled by Randomness summary and the Black Swan summary are the sequels.
Does the book help with risk appetite?
Yes, through Daniel Bernoulli’s utility: the value of a gain or loss depends on the position of the person bearing it, which is why appetite must be stated in terms of what the organisation can survive rather than in abstract scores. The ERM guide covers the statement.
Has the book dated?
The history has not; the closing chapters on derivatives have. The crises since 1996 confirmed the warning in the last chapter, which is the part most worth reading now.
Where does the book sit in the reading list?
At the start of the risk group in the internal audit reading list: read it first for the history, then Taleb for the limits and Hubbard for the method.
Related guides
- Fooled by Randomness: Summary and Lessons for Auditors — the limits of the tools, in trading-floor form
- The Black Swan: Summary and What It Means for Auditors — the rare events the normal curve omits
- The Failure of Risk Management: Summary for Auditors — the method that uses the history well
- Thinking, Fast and Slow: Summary for Auditors — the book’s behavioural chapters, in full
- Internal Audit’s Role in ERM — risk, uncertainty and aggregation in practice
- Internal Audit Sampling Techniques — Bernoulli’s law applied
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
Leave a Reply