Picture a company with a thousand rules. It cannot watch all thousand with the same care, and it should not. Picture two of them: the rule about which pen to sign with, and the rule about who may hand a customer's details to a stranger. One of them, broken, is nothing. The other is a fine and a front page.
9 of 9
likely 3 times bad 3: a 9
So the company starts with the risk, which just means two questions about each rule. How likely is it to be broken? How bad would it be? Score each from 1 to 3 and multiply. A 9 gets watched every week. A 1 gets a line in the handbook. The attention goes where the score is.
Likely: 2→Bad: 3→Score: ?
A rule is quite likely to be broken, 2 out of 3, and breaking it would be very bad, 3 out of 3. What is its score?
out of 9
Right. Six. Two times three. It sits just under the 9s, which is where a company puts a check that runs every month rather than every week.
Set how likely a rule is to be broken and how bad it would be. The score is the one times the other, from 1 to 9.
1 of 9
likely 1 times bad 1
How likely: 1: Rare · How bad: 1: Small
Likely 1, bad 1: score 1 of 9. A line in the handbook.
2 of 9
likely 1 times bad 2
How likely: 1: Rare · How bad: 2: Serious
Likely 1, bad 2: score 2 of 9. A line in the handbook and a yearly look.
3 of 9
likely 1 times bad 3
How likely: 1: Rare · How bad: 3: The licence
Likely 1, bad 3: score 3 of 9. Watched a few times a year.
2 of 9
likely 2 times bad 1
How likely: 2: Possible · How bad: 1: Small
Likely 2, bad 1: score 2 of 9. A line in the handbook and a yearly look.
4 of 9
likely 2 times bad 2
How likely: 2: Possible · How bad: 2: Serious
Likely 2, bad 2: score 4 of 9. Watched a few times a year.
6 of 9
likely 2 times bad 3
How likely: 2: Possible · How bad: 3: The licence
Likely 2, bad 3: score 6 of 9. Checked every month.
3 of 9
likely 3 times bad 1
How likely: 3: Likely · How bad: 1: Small
Likely 3, bad 1: score 3 of 9. Watched a few times a year.
6 of 9
likely 3 times bad 2
How likely: 3: Likely · How bad: 2: Serious
Likely 3, bad 2: score 6 of 9. Checked every month.
9 of 9
likely 3 times bad 3
How likely: 3: Likely · How bad: 3: The licence
Likely 3, bad 3: score 9 of 9. Checked every week, by name.
A rule that is almost never broken, but would cost the licence if it were. Where does it sit?
Score 3. The same as a rule that is often broken and barely matters, for the opposite reason.
Right. Likely 1 times bad 3 is 3, and likely 3 times bad 1 is also 3. Both get a few looks a year. The score does not care which dial made it.
Score 1. It almost never happens.
Not yet. One dial has been read. The other says the licence, which is a 3, and 1 times 3 is 3.
Score 9. Losing the licence is the worst thing.
Not yet. The worst outcome at the rarest likelihood is a 3. A 9 is the worst outcome that is also likely, and that is a different rule.
Move both controls.
Before the control9 score of 9
After the control3 score of 9
Now the company adds a control. A control is anything that makes a rule harder to break or easier to catch: a password, a second signature, a limit, a check. There is the risk before the control, and the risk left after it. The gap between the two is the only thing a control is for.
Picture a sales team that is offered gifts. Move what the company puts in place and watch the gifts rule's score. Made up to show the shape.
9 of 9
likely 3 times bad 3
What the company puts in place: Nothing
No control: likely 3, bad 3, score 9. A gift can be taken and nobody would know.
6 of 9
likely 2 times bad 3
What the company puts in place: A written limit
A written limit: likely falls to 2. Most people keep to a rule they were told. Bad is still 3: a gift that is taken is still hidden.
4 of 9
likely 2 times bad 2
What the company puts in place: A limit and a register
A register: bad falls to 2. A gift that is written down is seen early, so the harm stops at one gift. Likely stays at 2; a record catches, it does not prevent.
2 of 9
likely 1 times bad 2
What the company puts in place: Limit, register, and a manager signs off
A manager's sign-off: likely falls to 1. Someone else has to agree before the gift is taken. Score 2.
What did the register change?
How likely. People take fewer gifts when they are counted.
Not yet. In the frames the likely dial stayed at 2 when the register came in. It was the written limit that cut how likely. A register is a record, and a record catches; it does not prevent.
How bad, not how likely. A gift that is written down is caught early, so the harm stops at one gift.
Right. The bad dial went from 3 to 2 when the register came in, and the likely dial did not move. A record does not stop a hand; it makes the hand visible.
Nothing. The score fell because of the limit.
Not yet. The limit took the score from 9 to 6. The register took it from 6 to 4. Two controls, two moves, and the register's was the second.
Move the control.
1,000 rules, scored
↓→
The ten that score 9
A real company does this for every rule and ends up with a list, scored. The list is the map of where the compliance team spends its time. Nobody can watch a thousand rules. Everyone can watch the ten that score 9, and that is where the checks, the training and the records go first.
Each card is a control. Does it make the break less likely, or make it less bad when it happens?
One card at a time. Tap the pile it belongs to.
Card 1 of 6
A password on the customer file
A daily check of yesterday's payments
Two signatures on any payment over £10,000
A line staff can ring when they see something wrong
Training new staff before they touch the till
Insurance against a data leak
A password on the customer file → Less likely
Not yet. Less likely. A lock on the door means fewer hands get to the file at all; it does nothing once someone is in.
A daily check of yesterday's payments → Less bad
Not yet. Less bad. The payment has already gone; the check finds it the next morning, so a wrong payment is one, not a month of them.
Two signatures on any payment over £10,000 → Less likely
Not yet. Less likely. A second person has to agree before the money moves, so a bad payment needs two people instead of one.
A line staff can ring when they see something wrong → Less bad
Not yet. Less bad. The wrong thing has happened; the line means it is heard early and stops early.
Training new staff before they touch the till → Less likely
Not yet. Less likely. A hand that knows the rule before the first customer breaks it less often; training happens before, not after.
Insurance against a data leak → Less bad
Not yet. Less bad. Insurance does not stop a leak. It pays part of the bill once there has been one.
3Less likely
vsvs
3Less bad
Right. Three and three. Locks, signatures and training act before the break; checks, a phone line and insurance act after it. A good list has both kinds, because neither one gets a score to 1 on its own.
Rule Amonthly, a front page
vsvs
Rule Bdaily, nothing
A hospital has two rules. A: only a patient's own doctors may read their records; broken about monthly, each time a front page. B: visitors sign the book at reception; broken daily, nothing happens. Where does the first hour of attention go?
Rule A. It is rarer, but it is worse, and the score is higher.
Right. Likely 2, bad 3: a 6. Rule B is likely 3, bad 1: a 3. The rule you see broken most is not the one that costs most.
Rule B. It is broken every day.
Not yet. Likely 3, bad 1, which is a 3. Rule A is a 6. The score exists so that the rule broken loudest does not win the attention.
Both the same. A rule is a rule.
Not yet. The scoring exists because they are not the same. A hospital that watches them alike is giving the visitors' book the care the records deserve.
Lesson complete
A rule's risk is how likely it breaks times how bad that is. A control shrinks one or both.