If only I had been there...

How often have you seen this: some kind of problem situation arises, and then the people outside the problem swiftly produce lots of insights about all the things that the people in place did wrong.

Classic examples include shaking wise heads at the board and management of Kodak, which failed to respond to the rise of digital photography; Nokia and Research in Motion (Blackberry), which failed to address the threat of touchscreen smartphone competitors; and Blockbuster, which didn't anticipate the pivot from physical video rentals to online streaming.

Or the financial crisis of 2008-2009, and the failure of banks, insurers and regulators to recognise the deadly cocktail of low interest rates, lax lending standards, conflicts of interest with ratings agencies, and more, and the "inevitable" crash that followed.

Somehow we think that, if we had been there, we would have been the canary in the coal mine. We would have had the foresight to identify the risk. We would have had the courage to speak up. We would have had the skill to execute the strategy needed to pivot. We would have been smarter, braver and more adept than the boards and management of Kodak, Nokia, RIM, Blockbuster and Lehman.

This is par for the course in business school case studies, when professors and students take turns to dissect and criticise the "obvious" mistakes made by management. I think that's fine. Having gone to two business schools myself, I genuinely believe that it is one of the very important roles of academia to study the past, consider "what if's", and get students to think critically.

But this "if only I had been there" mentality is not confined to academia. Whenever there's some debacle or other, one thing we can count on is a stream of commentators who will swarm online to decry the insufficiency of vision, controls or initiatives. That but for those inadequacies, the failure would not have occurred.

Some organisational scandal? If only people had spoken up.

Some corporate failure or operational lapse? If only this additional control had been established.

Some business fade to irrelevance? If only the management strategy had pivoted in time.

Well of course. When we look at a problem after it has crystallised, it's easy to see where the gap was. It's much harder to tell where a leak will spring when a container is still intact. Not impossible, I'll grant you that, but much harder.

Additional regulations, controls, constraints or even strategy committees are not a universal panacea. Why? First, because the most serious problems tend to materialise in the "unknown unknown" zone. Nassim Taleb famously termed these "Black Swan" events, which unfortunately occur a lot more often than standard deviation probabilities suggest.

Conversely, the controls, responses and initiatives that we *do* think of, tend to fall in the "known known", or at best, "known unknown" zone. So quite naturally, if we just keep tacking on more stuff, it's far more likely that we're only reinforcing the bits that are less likely to crack, while the real vulnerabilities still lurk beneath the surface.

Second, let's suppose it's possible to tack on lots of oversight and controls to blanket the business, in an attempt to cover even "unknown unknowns". This creates another problem.

When you have a control for an *unknown* weakness, people by definition don't know *why* they're performing the control. It becomes a checkbox. Over time, the control becomes mechanical, and no one even notices it any more. It's like the "check engine" light on a car that goes unnoticed, because it's been flashing for years, and no one knows what the light is for.

Third, particularly in relation to controls - a surfeit of controls dilutes individual accountability and creates control fatigue. Everyone thinks someone else will pick it up. Or there are so many controls to perform that no one can tell which are important, and which are not. Everything is equally important, and so nothing is particularly important.

To be clear: it is absolutely critical to have a robust process to identify risks and implement controls, and to instil a corporate culture that buys into pro-active risk management and deep-rooted conduct and ethics, and has the agility to pivot and respond to changing business risks and conditions. But it's equally important to acknowledge the limitations of human foresight, and the futility of furiously beating against the wind of an unknown enemy.

A side-point. Can AI maker-checkers address the issue of control fatigue? After all, AI experiences no fatigue. A colleague recently pointed out something interesting to me. He said that while AI can obviously be an amazing tool, he was wary about very broadly implementing AI as a maker or checker, because of its effect on human dynamics.

He observed that when a human checks on another human, the maker or checker tends to be a little more careful, knowing that another human is making/checking. There is a kind of emotional investment in that other human. I don't want to let that human down.

But if it's just a machine... sometimes that human dynamic is lost. Ah, the computer will pick up, no need to be so intentional. It's impossible to prove that this dynamic always manifests. But it definitely resonates with my gut about how humans naturally behave. Think about what swift and lazy spellers and typers we've become because of auto-correct... and the mistakes that auto-correct makes!

To conclude: problems will come up from time to time. The most serious of these problems will typically materialise out of the "unknown unknown" zone, otherwise we would have done something about it.

Blanketing business operations with controls or simply "trying everything" as a strategy is one option, but it is generally counterproductive, because it causes management to be unable to tell what's important and what's not.

Really, all we can do is to employ the best people we can afford, to identify the risks that the most skilful of us can foresee, and implement targeted (and not blanketed) initiatives and controls at the most serious of those risks, whether they be regulatory, operational, or existential business risks.

And finally, we have to recognise that for all our best intentions and efforts, we can sometimes still be wrong. It's the nature of Black Swans. It's an uncomfortable truth that while we must make every effort to mitigate the risk, anyone could be the next Lehman, Kodak, Nokia, RIM or Blockbuster. Instead of shaking our heads at them, we can only keep our minds open to the very strong possibility that we could be missing something, and humbly acknowledge, "There, but for the grace of God, go I!"

"Listen to advice and accept discipline, and at the end you will be counted among the wise. Many are the plans in a man's heart, but it is the LORD's purpose that prevails." Proverbs 19:20-21