2020 INTRODUCTION | Upstream Intervention

Studying the surface of a pair of dice does not position you to say much about the outcome of a roll, network scientist Duncan Watts writes.1 While this is obvious, an awareness of this has not featured in the design of non-financial risk management systems, such as the industry standard Three Lines of Defense (3LoD) model FIGURE 7 p. 25. A principal problem with the 3LoD approach is that it is based on the idea that company org charts accurately reflect how people operate in practice, day-to-day.2 By failing to focus on “the company behind the chart,”3 3LoD models produce false comfort and immense frustration at a huge cost. Operational risk management frameworks based on the 3LoD may produce adequate systems of record, useful for assigning accountability, recording risk events, and conducting forensic inquiries after risk management failures become evident. But because they fail to account for the dynamics of social influence (‘culture’), they do little to permit for proactive insight into the likelihood of such events.

In our efforts to anticipate human behavior, we rely on common sense, “the loosely organized set of facts, observations, experiences, insights, and pieces of received wisdom that each of us accumulates over a lifetime, in the course of encountering, dealing with, and learning from, everyday situations.”4 When such common sense fails us—as it regularly does—we throw up our hands in disbelief and resignation: “I don’t know how to explain human behavior.” The implication is that human behavior is deemed explicable only when it conforms with our expectations and, when it does not, we conclude that it is simply inexplicable. But this is the problem with common sense: