/* ─── Writing Page — editorial content section ─── */
/* Migrated from WordPress archive (posts + topic pages). */
const ARTICLES = [
/* ─── Posts ─── */
{
slug: 'why-your-risk-register-doesnt-help-you-decide',
title: 'Why Your Risk Register Doesn\'t Help You Decide',
date: '2026-06-13',
summary: 'Enron had one. Boeing had one. The Australian banks had dozens. The apparatus was fully assembled and fully useless when it mattered most.',
author: 'Grant Purdy',
body: [
'Enron\'s auditors praised the quality of its enterprise \'risk management\'. Boeing\'s 737 MAX programme operated within a full \'risk management\' framework. Australia\'s Royal Commission into banking misconduct found that every major bank had \'risk\' committees, Chief Risk Officers, comprehensive \'risk\' reporting, and assurance processes.',
'Enron collapsed. 346 people died in two Boeing crashes. The Australian banks had been engaged in systematic unethical and arguably criminal conduct for years.',
'These organisations did not fail because they lacked \'risk management\'. They had all of it. Every register, every matrix, every committee, every report. The paraphernalia was fully assembled and fully useless when it mattered most. The question is why.',
'## How a belief system sustains itself',
'It has only been in the past few decades, and rather by accident, that certain practices to improve decision-making acquired the label of \'risk management\'. Insurers, probably the earliest source of institutional advocacy for improved decision-making, referred to whatever was being insured as \'the risk\'. When they advocated practices to make outcomes more predictable, they called it \'risk management\'. The label caught on. Legislators, regulators, and consultants adopted it to label their own decision-making \'wisdom\'.',
'The word \'risk\' thus acquired so many meanings that the core word of an increasingly popular expression was effectively meaningless. \'Risk management\' champions appear to have adopted the same approach as Humpty Dumpty: "When I use a word, it means just what I choose it to mean, neither more nor less."',
'At the heart of the problem is that it has been the advocates of \'risk management\', rather than the organisations and their Deciders at which it is targeted, who have become master.',
'Despite having no solid foundation or universal meaning, the advocates created a perception that \'risk management\' was good and should therefore be adopted. Organisations were encouraged to superimpose a \'risk management framework\' comprising various edifices: \'risk committees\' of the Board, \'Chief Risk Officer\' positions, policies, reporting requirements and so on. The Purpose for establishing this paraphernalia was seldom transparent, explicit, or understood. \'Risk management\' thus became not a discipline but a belief system, and belief systems inevitably start with the answer rather than with careful and objective definition of the problem.',
'## The lucrative circle',
'Four groups sustain this belief system, each with strong self-interest. Insurers need to price premiums. Regulators need to demonstrate oversight. Academics need to publish. Consultants need to bill. Each group has legitimate reasons to study uncertainty. None of them is trying to help a specific executive make a specific decision on a specific timeline.',
'Whereas good decision-making has always been dependent on good thinking, consultants fostered the fiction, often with evangelical zeal, that mastery of the artificial edifices and jargon of their scheme of \'risk management\' was the key to organisational success. The compliance obligation created a further effect that turbocharged the whole arrangement. Organisations were forced to seek \'expert\' guidance to avoid penalties for non-compliance. More consulting work preparing for certification. More work certifying. More work helping with remedial actions where the client fell short. While not a virtuous circle, certainly a lucrative one.',
'Some national stock exchanges included practice of \'risk management\' as a necessary condition for listing. The entirely untested belief was that practising \'risk management\', in whichever guise, was prima facie evidence of sound management. Enron proved that assumption spectacularly wrong. Its auditors at Arthur Andersen, a firm once widely respected, had been fulsome in their praise of Enron\'s \'risk management\' practices. Both collapsed. The paraphernalia was there. It did nothing except provide the illusion that due diligence had been done, which is worse than having done nothing at all, because at least then the Deciders would have known they still needed to decide.',
'## The register that nobody reads',
'The \'risk register\' is one of the more common and time-consuming pieces of paraphernalia that Deciders are expected to create or consult. These pieces of paper seem to have taken upon a life of their own. Organisations generate far too many columns of information, most of which nobody uses. The test is simple: can a normal person read across the page and understand the conversation that took place? In most registers the answer is no, because narrow spreadsheet columns force compromises in both quality and understanding.',
'The register is created at a point in time, and few if any registers record the prevailing Context, which will inevitably change and invalidate the diagnosis. Last year\'s register has literal meaning for next year\'s decisions: very little. Furthermore, the list of \'risks\' can only ever be a sample. The practical task of filling out the columns distracts Deciders from achieving sufficient certainty that their decision will deliver the required outcomes.',
'Context statements, risk treatment plans, control assurance plans are much, much more important and valuable. But regrettably, most organisations do not keep those. They keep the register, because the register is what the auditor checks.',
'## Why it cannot be fixed',
'The unmistakeable evidence is that most organisations do not even attempt to adopt any type of \'risk management\' belief system. Of the relatively few that either buy in or are forced in by regulators, few if any master its intricacies or fundamentally change the way they operate. They might \'talk the walk\' but do not in fact \'walk the walk\'.',
'The reasons are not mysterious. The paraphernalia is complicated and unnatural. The first ISO \'risk management\' standard contained 29 labels that relate to either ordinary words given a special meaning or to contrived expressions involving the word \'risk\'. Even the label \'risk\' is so ill-defined as to require five accompanying notes to its own definition, each of which either contradict or confuse. Much of what comes with \'risk management\' is illogical and defies common sense, easily recognised as such by most people. The dichotomy of \'risk and opportunity\', for instance, is about as logical as pairing bulldozers with cauliflowers.',
'At the human level, it can seem that \'risk management\' advocates are saying "here is the answer, now fit your problem into that." As a result, \'risk management\' does not pass the pub test in the eyes of most Deciders. It hinders rather than helps them to function and so it is either ignored or paid lip service. Despite adoption of some of the trappings, pronouncement of policies, references in the annual report, sporadic use of the jargon, little if any change occurs in the way decisions are actually made.',
'Any attempt to cross-map the Universal Decision-Making Method with \'risk management\' will have no benefit. It will confuse and complicate and have the effect of keeping alive what is trying to be shed. The question was never "how do we manage risk?" The question was always "how do we make better decisions?" Once you see that clearly, the register becomes what it always was: compliance paperwork dressed up as governance.',
'Roger Estall and I wrote Deciding because nearly five decades of advisory work taught us that the organisations that made the best decisions were not the ones with the most elaborate \'risk management\' apparatus. They were the ones whose Deciders actually did the thinking. The Universal Decision-Making Method we developed exists to make that thinking structured, explicit, and defensible, without the millstone.',
'---',
'*Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.*',
],
},
{
slug: 'what-is-decision-coaching',
title: 'What Is Decision Coaching?',
date: '2026-06-06',
summary: 'Decision coaching is not more analysis. It is a structured process that makes you work through your own reasoning until it holds up or falls apart.',
author: 'Joseph Purdy',
body: [
'Every piece of decision support I have ever used gave me more information. None of it made me think harder.',
'Reports, registers, scenario models, pros-and-cons lists. All of it tells you what could happen. None of it forces you to do the hard part: figure out what you are actually trying to achieve and what you are assuming to be true about how you will get there.',
'That gap between having information and actually deciding is where decision coaching sits. It is not more analysis. It is a structured process that walks you through your own reasoning until that reasoning either holds up or falls apart.',
'## Consulting delivers analysis. Decision coaching makes you think.',
'Most decision support follows the same pattern. You bring a problem to someone. They go away, study it, and come back with a document. A consultant delivers a report. A risk team delivers a register. An advisor delivers recommendations. You get a stack of paper and a feeling of due diligence. You still have not decided.',
'My father, Grant Purdy, spent nearly fifty years helping boards, regulators, mining companies, and banks work through decisions. He and his co-author Roger Estall watched the same thing happen over and over: smart, experienced people accumulate analysis until they run out of time, then decide under pressure on instinct. The analysis gave them the feeling of progress. It did not bring them one step closer to an actual decision.',
'In their book Deciding, they argue that this happens because analysing and deciding are different activities. The tools designed for one are structurally incapable of performing the other. A consultant can tell you everything that might go wrong with closing a plant. That is analysis. Decision coaching makes you articulate what you are trying to achieve by closing it, what you are assuming will happen when you do, and whether those assumptions can bear the weight of the decision. That is deciding.',
'## What decision coaching looks like in practice',
'The Universal Decision-Making Method that Grant Purdy and Roger Estall developed has five steps. Each one has to earn the next.',
'Purpose first. Before anything else, you articulate what you are actually trying to achieve, and for whom. This sounds obvious. In practice it is the step almost everyone skips. When I built the Walk, the product based on this method, early versions let people breeze through Purpose in ten seconds and spend all their time on risk and assumptions. My dad\'s feedback was one line: "You need to start with purpose. That\'s your purpose, not that of the decision." Without a clear Purpose, every option looks roughly equivalent because you have no basis for comparison.',
'Tentative decisions. State what you are actually thinking of doing. Not a brainstormed list of twelve options. The one or two things you are genuinely considering.',
'Assumptions. Every decision rests on assumptions. Some are well-founded. Some are guesses you have never examined. The Universal Decision-Making Method provides a significance matrix that classifies each assumption on two dimensions: how significant is it to the outcome, and how well-supported is it? The trigger question: if this assumption turned out to be wrong, how would it affect what you are trying to achieve? An assumption that could swing the decision by millions is Critical. An assumption about minor logistics is Limited.',
'A public safety organisation that Grant Purdy advised had been allocating 0.03% of its budget to one safety programme. When they surfaced their assumptions using the significance matrix, one Critical assumption about the effectiveness of existing controls turned out to be completely unsupported. They raised the allocation to 0.5%. Mortality in that area dropped 60%.',
'Sufficient certainty. The question is not "have we identified all the risks?" It is "do we have sufficient certainty to proceed?" You do not need to know everything. You need to know enough, given what is at stake. Australia once restricted blood imports to eliminate the risk of contamination. The policy achieved its narrow goal but the resulting shortages increased mortality overall. The Deciders had pursued maximum certainty in one direction and created worse outcomes in another. "Sufficient" is calibrated to the decision, not to an abstract standard of rigour.',
'Implement and monitor. Name the conditions that would tell you your decision needs revisiting. If assumption X turns out to be wrong, what will you do? This is how decisions stick instead of getting relitigated every few weeks when someone gets nervous.',
'## Why assumptions, not risks',
'Most decision support starts with risk: what could go wrong? Grant Purdy has spent decades arguing that this framing is fundamentally broken. In Deciding, he calls the entire risk management apparatus a belief system. It starts with the answer, "you should manage risk," and works backwards. Four groups sustain it: insurers who need to price premiums, regulators who need to demonstrate oversight, academics who need to publish, and consultants who need to bill. Each has legitimate reasons to study uncertainty. None of them is trying to help a specific person make a specific decision on a specific timeline.',
'A risk register catalogues things that might go wrong. It assigns likelihood and consequence ratings on a five-by-five grid. At no point does it help anyone decide anything, because that was never what it was designed to do. It was designed to demonstrate that uncertainty had been "considered." Consideration and decision-making are different activities. Grant has written about this at length.',
'Decision coaching starts from the other direction. What are you trying to achieve? What are you assuming? Where are you most vulnerable?',
'The difference is not semantic. After the 2011 Brisbane floods, an inquiry into the Wivenhoe Dam produced 177 recommendations. None of them helped anyone decide anything. They were analysis, generated after the fact, pointing in every direction. If the original Deciders had been coached through their assumptions before the event, the conversation would have been about a handful of Critical assumptions connected to a specific Purpose, not a catalogue of everything that could theoretically go wrong.',
'## Decision coaching is not advice',
'There is a reason the Walk does not tell you what to decide. Grant\'s position, developed across nearly fifty years of advisory practice, is that the person who has to live with the decision is the person who should make it. A coach does not know the answer. A coach makes sure the Decider has actually done the thinking.',
'I built the Walk around this principle. It does not generate options or recommend a path. It asks you to name what you are trying to achieve, state what you are assuming, and work out whether those assumptions hold. The output is a Decision Record: one page that captures what you decided, what you assumed, how significant each assumption was, and what would trigger a review. It is not a report for your shelf. It is reasoning you can defend.',
'That is the gap most tools miss. They give you more information when what you actually need is a process that forces you to examine what you already believe. Decision coaching does not add to the pile. It makes you sort through it.',
'If you are facing a decision and want to see what this looks like in practice, the Walk might help.',
'---',
'*Joseph Purdy is the founder of the Walk at Sufficient Certainty. His father, Grant Purdy, is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.*',
],
},
{
slug: 'how-to-make-a-difficult-business-decision',
title: 'How to Make a Difficult Business Decision',
date: '2026-05-30',
summary: 'The $80,000 consultant report was designed to demonstrate due diligence, not to help you decide. Here is what actually works.',
author: 'Grant Purdy',
body: [
'A VP of operations described her situation to me last year. She had a plant-closure decision on her desk and a board meeting in six weeks. She had spent $80,000 on a strategy consultant who delivered a 60-page report. Her risk team produced a 47-item register with a colour-coded heat map. She had a SWOT analysis, three scenario models, and a stack of papers she had not opened since the week they arrived.',
'She still could not decide.',
'I have spent nearly 50 years helping executives who need to make a difficult business decision, and I see this pattern everywhere. Smart, experienced people accumulate analysis until they run out of time, then decide under pressure on instinct, ignoring most of what they paid for. The analysis gave them the feeling of having done due diligence. It did not bring them one step closer to deciding.',
'Here is why: analysing and deciding are different activities. The tools designed for one are structurally incapable of performing the other. Until you recognise this distinction, no amount of consulting spend will help.',
'## The apparatus that replaced thinking',
'Risk management, as widely practised, is a belief system. I use that phrase deliberately. Belief systems start with the answer and work backwards. The answer, in this case, is that organisations should “manage risk.” Everything follows from that premise: the registers, the matrices, the frameworks, the consulting engagements, the board reports.',
'Notice what never gets asked. What decision are you trying to make?',
'The entire apparatus skips that question. It catalogues things that might go wrong. It assigns likelihood and consequence ratings on a five-by-five grid. It produces a register that sits in a shared drive or gets tabled at a board meeting. At no point does it help anyone decide anything, because that was never what it was designed to do. I have written about this at length elsewhere.',
'In Deciding, I traced how this industry sustains itself through four groups with strong self-interest: insurers who need to price premiums, regulators who need to demonstrate oversight, academics who need to publish, and consultants who need to bill. Each group has legitimate reasons to study uncertainty. None of them is trying to help a specific executive make a specific decision on a specific timeline. The compliance obligation created a lucrative circle, and the circle now perpetuates itself regardless of whether the work it produces helps anyone.',
'If risk management is the answer, what was your question?',
'That is not a rhetorical line. It is a diagnostic. If you cannot answer it clearly, you are commissioning analysis for its own sake.',
'## The evidence is in plain sight',
'Enron had Arthur Andersen publicly praising the quality of its enterprise risk management. Boeing’s 737 MAX programme operated within a full risk management framework across the entire organisation. 346 people died in two crashes. Australia’s Royal Commission into banking misconduct found that every major bank had risk management committees, chief risk officers, comprehensive reporting, and assurance processes. Those banks had been engaged in systematic unethical and criminal conduct for years.',
'These organisations did not fail because they lacked risk management. They had all of it. Every register, every matrix, every committee, every report. The apparatus was fully assembled and fully useless when it mattered most.',
'The VP of operations has the same problem at smaller scale. Her 60-page report gives her the feeling of due diligence. That feeling is not the same as having decided. Her 47-item register gives her the sense that she has identified what could go wrong. That sense is not the same as knowing what she is actually assuming and whether those assumptions can bear the weight of her decision.',
'## What good Deciders actually do',
'Roger Estall and I developed the Universal Decision-Making Method over decades of advisory practice. We did not set out to critique risk management. We set out to answer a more useful question: what do people who decide well actually do?',
'The answer was consistent. Good Deciders do not begin with a list of things that might go wrong. They begin with Purpose. They ask: what am I trying to achieve, and for whom?',
'This is Chapter 4 of Deciding, and we titled it “It’s the Purpose, Stupid!” because the number of organisations that skip this step is staggering. They jump straight to cataloguing hazards without ever articulating what they are trying to accomplish. The VP’s consultant wrote 60 pages about what might go wrong with closing the plant. Nobody wrote a single paragraph about what she was trying to achieve by closing it.',
'After Purpose comes a harder discipline: stating, out loud, what you are assuming to be true. Every decision rests on assumptions. The VP assumes her plant’s market will not recover. She assumes relocation costs will fall within a certain range. She assumes the workforce cannot be redeployed. Some of these are well-founded. Some are guesses she has never examined. Until she sorts the two, she cannot know where her decision is actually vulnerable.',
'The Universal Decision-Making Method provides a significance matrix that classifies each assumption on two dimensions: how significant is it to the outcome, and how well-supported is it? The matrix uses a single trigger question: if this assumption turned out to be wrong, how would it affect what I am trying to achieve? An assumption about raw material costs that could swing the decision by millions is Critical. An assumption about minor procurement logistics is Limited. The VP’s 47-item register treated every entry with equal weight. The significance matrix forces her to distinguish between assumptions that could break her decision and ones that barely matter.',
'A public safety organisation I advised had been allocating 0.03% of its budget to one safety programme. When we worked through their assumptions, one Critical assumption about the effectiveness of existing controls turned out to be completely unsupported. They raised the allocation to 0.5%. Mortality in that area dropped 60%. No risk register would have surfaced that. A register would have listed “inadequate safety controls” alongside dozens of other entries, all coloured amber, none connected to a real decision about real resources.',
'## Sufficient certainty, not maximum certainty',
'The question is not “have we identified all the risks?” It is “do we have sufficient certainty to proceed?” Confusing the two costs lives.',
'Australia once restricted blood imports to eliminate the risk of contamination. The policy achieved its narrow goal: no contaminated blood entered the supply. But the resulting shortages increased mortality overall. The Deciders had pursued maximum certainty in one direction and created worse outcomes in another. They were managing risk. They were not deciding well.',
'Sufficient certainty means something precise: for each significant assumption, do I have enough evidence to proceed, given what is at stake? Sometimes the answer is yes. Sometimes the answer is to investigate one specific assumption further. Sometimes the answer is to proceed now and monitor, because waiting will cost more than acting on an imperfect assumption. The point is that “sufficient” is calibrated to the decision, not to an abstract standard of rigour.',
'This is how to make a difficult business decision. Not by accumulating analysis until an answer reveals itself, because it never does. Not by building a register of everything that might go wrong, because that list has no end and no connection to what you are actually trying to decide. You decide by naming what you are assuming, testing whether those assumptions hold, and determining whether you have sufficient certainty to act. That is decision quality. Not the volume of analysis, but the rigour of the reasoning.',
'The VP of operations does not need another report. She needs a Decision Record: one page that records what she decided, what she assumed, how significant each assumption was, and what would trigger a review. That is what her board needs. Not 60 pages of analysis. One page of reasoning.',
'---',
'*Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.*',
],
},
{
slug: 'vale-roger-estall',
title: 'Vale Roger Estall',
date: '2023-06-23',
summary: 'A tribute to Roger Estall, co-author of Deciding, who passed away on 21 June 2023.',
author: 'Grant Purdy',
body: [
'Roger Estall, my dear friend, mentor, collaborator and co-author, passed away suddenly on Wednesday, 21 June 2023, while visiting Christchurch, New Zealand.',
'His sudden death leaves a big hole in the world.',
'Roger saved more lives in New Zealand than anyone else, through his advocacy for smoke alarms and fire sprinkler systems. He chaired the New Zealand Fire Service Commission. He led comprehensive reforms that resulted in significant annual reductions in fire fatalities. He was a founding chairman of the NZ Society for Risk Management. He delivered the prestigious annual Hopkins Lecture. He was a member or chair of 25 national and international standards committees.',
'He taught me never to compromise on logic and to challenge anything that, quite simply, did not make sense. This mentoring extended to many others whom Roger helped develop critical thinking skills.',
'Roger and I wrote Deciding together. The book was his final published work. The method it describes is the product of decades of shared work, shared frustration with the risk-management orthodoxy, and shared conviction that people deserve a plainer way to think about their decisions.',
'We can only aspire to make the positive impact on mankind that Roger achieved.',
'Rest in peace, my dear friend. You will be missed for ever.',
],
},
{
slug: 'coso-erm-covid19',
title: 'COSO ERM in a COVID-19 world',
date: '2020-05-10',
summary: 'Why enterprise risk management frameworks did not and could not help organisations decide what to do about COVID-19.',
author: 'Grant Purdy',
originalUrl: '/why-coso-will-not-and-cannot-help-people-make-better-decisions-about-covid-19/',
body: [
'Paul Sobel, the COSO Chairman, asserted recently that ERM frameworks can provide valuable principles during organisational recovery from crises. I disagree. ERM is fundamentally flawed and cannot improve decision-making. The evidence for this claim is nearly fifty years of observation and the pandemic itself.',
'ERM is a marketing-driven belief system without scientific validation. The term originated as a label invented by RIMS to distinguish new business services. COSO adopted it to reinvigorate the Internal Control Framework after the Enron scandal. Neither origin inspires confidence in the concept\u2019s intellectual foundations.',
'Two failures are critical. First, the word "risk" lacks consistency. It possesses dozens of formal definitions, which renders it useless as a transactional term in a conversation about what to do. Second, one-size-fits-all risk management systems cannot integrate into the distinct operational processes of distinct organisations. They sit beside the business. They do not enter it.',
'The evidence of ineffectiveness is not hidden. Across nearly fifty years in this field, I have observed that organisations practising "risk management" maintain entirely separate decision-making processes. The register is in one room. The decision is in another. Consistent surveys show persistently low ERM maturity levels, yet the leadership\u2019s dismissal is attributed to them not understanding the concept. They understand it. They recognise it as ineffective.',
'COVID-19 was the test. When the pandemic arrived, organisations did not consult their risk registers, risk appetite statements, or business continuity plans. They focused on reducing vulnerability and identifying opportunities. They made decisions. The risk-management apparatus was not present in the room where the decisions happened, because it has never been present in that room.',
'No credible evidence demonstrates that ERM improves organisational performance. Correlations between ERM adoption and success reflect already-successful companies\u2019 capacity to afford such systems, or regulatory compliance. Not genuine value creation.',
'The alternative is to help people make better decisions directly. State the purpose. Name the assumptions. Decide what to monitor. That is what the Universal Decision-Making Method does. It does not require a framework, a committee, or an acronym.',
],
},
{
slug: 'iia-three-lines-model',
title: 'The IIA\u2019s Three Lines Model is as badly flawed as its old one',
date: '2020-07-27',
summary: 'A critique of the Institute of Internal Auditors\u2019 updated model and why it still fails to address how organisations actually decide.',
author: 'Grant Purdy',
originalUrl: '/the-iias-nee-three-lines-model-is-as-badly-flawed-as-its-old-one/',
body: [
'The Institute of Internal Auditors recently updated its Three Lines of Defense Model, renaming it the "Three Lines Model." I was asked to comment on weaknesses in the original model and identified several fundamental flaws. The refresh has not fixed them.',
'The original model fails to reflect how organisations actually make decisions. It creates unhelpful silos, particularly in the second line, that assume responsibilities rightfully belonging to management. Rather than emphasising how organisations ensure decisions achieve their purpose through monitoring, the model emphasises organisational structure and departmental labels.',
'Internal audit need not exist as a separate entity. While independent decision reviews may have value, an "internal regulator" proves counterproductive. The useful question is not "who audits whom" but "are the decisions we made still producing the outcomes we intended?"',
'The terms "controls" and "risks" have become divorced from their original decision-making context. Controls represent decisions made previously. Treating them as independent "things" wastes resources monitoring elements that may no longer matter. What matters is whether the assumptions behind those decisions still hold.',
'The monitoring that organisations actually need addresses three areas: implementation failures in primary decision elements, secondary element breakdowns or deterioration, and contextual changes affecting decision validity. None of these require a Three Lines Model. They require a monitoring plan built into the decision before it is made.',
'Despite the opportunity for improvement, the refreshed model is equally problematic. The document relies on sophistry rather than common sense, using undefined terms like governance and risk management interchangeably. Terms appear as nouns, verbs, and adjectives inconsistently. Phrases like "risk-based thinking" are invented concepts lacking clarity.',
'The "Applying the Model" section abandons previous strictness, permitting organisations to adapt the guidance however they prefer. This suggests the authors recognised its impracticality.',
'The updated model remains what the original was: a web of interconnected and ambiguous words and half-formed thoughts. The ambiguity serves consultants and internal auditors by justifying their continued existence while failing to provide practical guidance for organisational decision-making.',
],
},
{
slug: 'should-ia-perform-risk-assessment',
title: 'Should internal audit perform a risk assessment?',
date: '2020-05-10',
summary: 'Roger Estall on why the real question is not who assesses risk, but whether the organisation makes good decisions.',
author: 'Roger Estall',
originalUrl: '/should-ia-perform-a-risk-assessment/',
body: [
'John Fraser was asked recently whether internal audit should perform risk assessments, assuming an effective Enterprise Risk Management function exists. He argued that IA should provide assurance that ERM processes work effectively and validate that key controls assumed to be functioning actually operate as intended.',
'Strip away the terminology and the core purpose becomes clearer. The ultimate purpose of whatever "ERM" and "IA" are meant to mean or be can surely only legitimately be that the organisation makes the best decisions it can.',
'Organisational success depends on consistent quality decision-making across all levels. In Deciding, Grant and I outline a Universal Decision-Making Method applicable to all decision-makers. We call them Deciders, because that is what they are.',
'There is a parallel to manufacturing quality control. Processes shifted decades ago from inspecting finished products to ensuring quality throughout production. The inspection model was expensive, slow, and caught problems too late. The quality-throughout model prevented them.',
'Organisational monitoring should follow the same logic. Focus on decision-making quality rather than post-decision evaluation. Monitor the assumptions that decisions rest on, not the outputs that have already happened. By the time you are inspecting the output, the decision is old and the damage, if any, is done.',
'Governance bodies should directly assess decision-making capability rather than outsourcing reassurance to hired auditors or risk managers. The question is not "should internal audit perform a risk assessment?" The question is "are the people making decisions in this organisation doing it well, and how would we know?"',
],
},
{
slug: 'unburdened-by-risk-management-myths',
title: 'Making decisions unburdened by \u2018risk management\u2019 myths',
date: '2020-09-25',
summary: 'On the Universal Decision-Making Method and why mastery of it distinguishes successful from unsuccessful decision-makers.',
author: 'Grant Purdy',
originalUrl: '/making-decisions-unburdened-by-risk-management-myths/',
body: [
'Roger and I presented at RAW2020, co-facilitating a workshop on the Universal Decision-Making Method. The workshop drew on our shared investigation, across decades, of decisions that produced poor outcomes or went significantly wrong.',
'What we found, consistently, was not that the wrong option had been chosen. It was that assumptions had gone unnamed, unranked, and unmonitored. The decision-maker had relied on things being true without writing down what those things were. When one of them turned out to be false, the decision failed, and nobody could explain why, because nobody had recorded what the decision was resting on.',
'The Universal Decision-Making Method is not a new invention. It is a description of what all decision-makers do, whether they are aware of it or not. A pilot deciding whether to divert. A board deciding whether to acquire. A family deciding whether to move. The steps are the same: state the purpose, name the opportunity, surface the assumptions, decide what level of certainty is sufficient, build monitoring into the decision before it leaves your desk.',
'The difference between successful and unsuccessful decision-makers is not intelligence, experience, or access to information. It is awareness and skill in applying the method. The unsuccessful decision-maker applies it unconsciously and incompletely. The successful one applies it deliberately.',
'Attempting to take account of and resolve uncertainty via the concept of "risk" and the constructs of "risk management" is neither an effective nor a logical path. Risk management distracts from the method. It substitutes registers for reasoning and matrices for judgement. It creates a parallel process that runs beside the decision instead of inside it.',
'The alternative is straightforward. Help decision-makers apply the method they are already using, but apply it with awareness and skill. That is what the book does. That is what the Walk does.',
],
},
{
slug: 'conversations-with-mark-siwik',
title: 'Conversations with Mark Siwik',
date: '2020-09-25',
summary: 'A three-part conversation on risk management and decision-making, hosted by SandRun Risk.',
author: 'Grant Purdy',
originalUrl: '/conversations-with-mark-siwik/',
externalLinks: [
{ label: 'Part 1: Background and experience', url: 'https://www.sandrunrisk.com/blog/conversation-on-risk-management-with-grant-purdy-part-i' },
{ label: 'Part 2: Deciding and the method', url: 'https://www.sandrunrisk.com/blog/conversation-on-risk-management-with-grant-purdy-part-ii' },
{ label: 'Part 3: Practical strategies', url: 'https://www.sandrunrisk.com/blog/conversation-on-risk-management-with-grant-purdy-part-iii' },
],
body: [
'Mark Siwik, CEO of SandRun Risk, hosted a three-part conversation series on the SandRun Risk Blog. We discussed nearly fifty years of applying decision-making principles in practice, the book, and what organisations get wrong when they try to manage "risk" instead of making better decisions.',
'The conversations covered my background and nearly five decades of experience, the approach set out in Deciding, and practical strategies for making better organisational decisions. Mark asked good questions and gave the material room to breathe.',
],
},
/* ─── Topic pages, published as backdated articles ─── */
{
slug: 'risk-management-millstone',
title: 'The \u2018risk management\u2019 millstone',
date: '2020-03-28',
summary: 'How an informal label for diverse, conflicting concepts acquired the appearance of something of substance, and why it weighs organisations down.',
author: 'Grant Purdy',
body: [
'\u201CRisk management\u201D is a much-heard expression these days. Despite having no consistent meaning or form, organisations are encouraged by its advocates to adopt its complicated structures and language, ostensibly to address uncertainty. And yet, despite the investment and inconvenience that is involved in pursuing \u201Crisk management,\u201D achieving sufficient certainty is seldom the result.',
'It has only been in the past few decades, and even then rather by accident, that some of the ideas and practices to improve decision-making acquired the label of \u201Crisk management.\u201D An explanation for these particular words lies in the practice of insurers to refer to whatever was being insured as \u201Cthe risk.\u201D When an insurer agrees to provide insurance, they describe themselves as being \u201Con risk.\u201D',
'In advocating different approaches to decision-making, insurers sought to change \u201Cthe risk\u201D to their advantage. They did this via client selection, incentive pricing and policy wording to make the outcome of their contracts with their clients more predictable. By describing the myriad of practices they were coercing their clients to adopt as \u201Crisk management,\u201D insurers shifted the focus from their own interest to something ostensibly associated with their client\u2019s management of their organisation.',
'Furthermore, this new compound noun, \u201Crisk management,\u201D acquired the appearance of something of substance that was tangible, definitive, beneficial and noble. The label caught on. It became adopted in a generally random way by legislators, regulators, and advocacy groups to label their own decision-making \u201Cwisdom.\u201D It was also seized on by consultants because it provided the illusion of something of substance and authority which could therefore be sold.',
'In the same way that the \u201Crisk management\u201D label became attached to many different ideas, so too did the word \u201Crisk\u201D acquire many meanings. This created the odd situation that the core word of an increasingly popular, yet ill-defined, expression was effectively meaningless. Rather than being a descriptor of a solid foundation of tested academic endeavour, the expression \u201Crisk management\u201D has never been much more than an informal label for diverse, constantly changing and often conflicting concepts and methods that are vaguely related to uncertainty.',
'At the heart of the problem is that it has been the advocates of \u201Crisk management,\u201D rather than the organisations and their Deciders at which it is targeted, who have become \u201Cmaster.\u201D The word means what the advocate chooses it to mean. The organisation follows.',
],
},
{
slug: 'deciders',
title: 'Who are the Deciders?',
date: '2020-03-25',
summary: 'Everyone who has some part in determining how an organisation takes advantage of its opportunities is a Decider. From the board room to the work face.',
author: 'Grant Purdy',
body: [
'In organisations, everyone who has some part in determining how the organisation takes advantage of its opportunities in order to pursue its Purpose is a Decider. Deciders are found throughout organisations, from top to bottom. They include directors, executives, managers and supervisors, and in the government sector, everyone from Prime Ministers to those at the work face developing policy and delivering services. At the personal level, everyone is a Decider in pursuit of their own well-being and that of their families.',
'Being a Decider is a tricky business. All Deciders face certain broad realities. Only by making decisions can an organisation pursue and realise its Purpose. And yet no decision can ever provide total certainty as to its immediate or ultimate effect. Not all decisions have equal importance. The decisions that Deciders make require sufficient certainty according to their importance.',
'It follows that the best Deciders are those who are always clear as to the higher Purpose of their organisation; who are able to test their tentative decision against that Purpose; who are ever mindful of uncertainty and therefore what is fact and what is assumption; who recognise the many forms of uncertainty in relation to each decision, including that the future may be very different to the present.',
'Good Deciders understand the many ways to reduce uncertainty, if that is required. They appreciate that there is often a trade-off between greater certainty and the costs of achieving this. They are mindful of the context in which they are making the decision and in which it will be implemented. They have an instinct to engage with others in the course of making decisions, to gain knowledge and create and test options.',
'Good Deciders understand that all Deciders use the same method. They recognise that decisions have primary and secondary components: those intended to deliver the desired outcome, and those that make it more likely that what is desired is what is achieved. The difference between a good Decider and a poor one is not intelligence or access to information. It is awareness of the method, and skill in applying it.',
],
},
{
slug: 'purpose',
title: 'It all depends on Purpose',
date: '2020-03-01',
summary: 'Every organisation possesses an underlying reason for existence. Every decision must connect to it.',
author: 'Grant Purdy',
body: [
'Every organisation possesses an underlying reason for existence, a Purpose that endures beyond shifting goals and strategies. Pursuing organisational Purpose requires recognising and leveraging opportunities through deliberate decision-making.',
'When strategy misaligns with core Purpose, organisations lose direction and risk failure. The Boeing 737 MAX situation is instructive. The decisions that led to the crisis were not made by people who lacked a risk register or a risk committee. They were made by people whose decision-making had drifted from the organisation\u2019s core Purpose.',
'Deciders must maintain explicit clarity about organisational Purpose. Not merely general awareness, but the kind of clarity that can be stated in a sentence and tested against. Every decision across strategy, structure, governance, and implementation must connect to and validate against Purpose.',
'Shared understanding of Purpose proves essential during decision-making conversations. If the people in the room do not agree on what the organisation is actually for, they cannot agree on whether a particular decision advances or detracts from it. The first step of the Universal Decision-Making Method is to state the Purpose the decision serves. This is not a formality. It is the anchor for everything that follows.',
],
},
{
slug: 'monitoring',
title: 'The role of monitoring',
date: '2020-03-01',
summary: 'Monitoring means checking that what was assumed when the decision was made is what is occurring. Decisions are not fire and forget.',
author: 'Grant Purdy',
body: [
'Monitoring involves active surveillance. For Deciders, it means checking that what was assumed when the decision was made is what is occurring. Decision outcomes differ from intentions due to four main sources of variance.',
'First, defective decision-making processes. Incorrect measurements, flawed analysis, or poor conversations lead to decisions built on sand. Second, implementation failures. Decisions that were sound in principle but poorly translated into action. Third, component degradation. Elements of the decision that were functioning at the time but have since deteriorated. Fourth, changed context. The world around the decision moved, and the assumptions the decision rested on no longer hold.',
'Effective Deciders address these questions before the decision is finalised, not after something goes wrong: What requires monitoring? How should monitoring occur? Who receives results? How is variance identified? What response strategy applies? What lessons emerge?',
'Monitoring enables anticipating outcome changes before they occur, allowing Deciders to respond and maintain sufficient certainty that desired outcomes will result. A decision without a monitoring plan is a decision that will drift. The monitoring plan is part of the decision, not an afterthought.',
],
},
{
slug: 'disruption',
title: 'Disruption: anticipating the unexpected',
date: '2020-03-01',
summary: 'Skilled decision-makers reduce organisational vulnerability and recognise opportunities emerging from disruption.',
author: 'Grant Purdy',
body: [
'Life is never a straight line. Unexpected events can intervene. Skilled decision-makers should reduce organisational vulnerability when making decisions, recognise opportunities emerging from disruption, and apply lateral thinking to create advantageous disruption for competitors.',
'Conventional Business Continuity Management is misnamed. It only addresses response protocols, not comprehensive organisational continuation. The framework focuses narrowly on returning to pre-disruption conditions rather than adapting forward. It introduces unnecessary jargon and siloed thinking disconnected from mainstream operations. It creates false security through acronyms and rigid processes.',
'The alternative is integrating disruption anticipation into the Universal Decision-Making Method rather than maintaining separate structures. When you name your assumptions and monitor them, you are already watching for the unexpected. When you record which assumptions are Critical and what would trigger a review, you have a disruption-response plan built into the decision itself.',
'A proactive approach works better than a defensive one. The question is not \u201Chow do we return to normal after something bad happens?\u201D The question is \u201Cwhich of our assumptions are most likely to change, and what will we do when they do?\u201D',
],
},
];
/* Hide future-dated articles; sort newest first */
const TODAY = new Date().toISOString().slice(0, 10);
const VISIBLE_ARTICLES = ARTICLES.filter(a => a.date <= TODAY);
VISIBLE_ARTICLES.sort((a, b) => new Date(b.date) - new Date(a.date));
const WritingPage = ({ onNavigate, articleSlug }) => {
const isMobile = useMediaQuery(680);
const s = {
hero: {
paddingTop: isMobile ? 'var(--space-8)' : 'var(--space-10)',
paddingBottom: 'var(--space-7)',
},
h1: {
fontFamily: 'var(--font-serif-display)',
fontSize: isMobile ? '2rem' : 'clamp(2rem, 4.5vw, 2.75rem)',
fontWeight: 500,
lineHeight: 1.15,
letterSpacing: 'var(--tracking-tight)',
color: 'var(--fg-primary)',
margin: '0 0 var(--space-4) 0',
},
subtitle: {
fontFamily: 'var(--font-serif)',
fontSize: 'var(--text-base)',
color: 'var(--fg-secondary)',
lineHeight: 'var(--leading-relaxed)',
margin: 0,
maxWidth: 'var(--measure)',
},
entryLink: {
display: 'block',
padding: 'var(--space-6) 0',
borderBottom: '1px solid var(--border-light)',
textDecoration: 'none',
cursor: 'pointer',
minHeight: '44px',
},
entryTitle: {
fontFamily: 'var(--font-serif)',
fontSize: isMobile ? '1.15rem' : '1.35rem',
fontWeight: 500,
lineHeight: 1.3,
color: 'var(--fg-primary)',
margin: '0 0 var(--space-2) 0',
},
entryMeta: {
fontFamily: 'var(--font-sans)',
fontSize: '12px',
color: 'var(--fg-tertiary)',
marginBottom: 'var(--space-2)',
},
entrySummary: {
fontFamily: 'var(--font-serif)',
fontSize: 'var(--text-sm)',
lineHeight: 'var(--leading-relaxed)',
color: 'var(--fg-secondary)',
margin: 0,
maxWidth: 'var(--measure)',
},
articleH1: {
fontFamily: 'var(--font-serif-display)',
fontSize: isMobile ? '1.75rem' : 'clamp(2rem, 4.5vw, 2.5rem)',
fontWeight: 500,
lineHeight: 1.15,
letterSpacing: 'var(--tracking-tight)',
color: 'var(--fg-primary)',
margin: '0 0 var(--space-5) 0',
maxWidth: '26ch',
textWrap: 'balance',
},
byline: {
display: 'flex',
alignItems: 'center',
gap: 'var(--space-3)',
marginBottom: 0,
},
bylinePhoto: {
width: '36px',
height: '36px',
borderRadius: '50%',
objectFit: 'cover',
},
bylineName: {
fontFamily: 'var(--font-sans)',
fontSize: '13px',
fontWeight: 500,
color: 'var(--fg-primary)',
},
bylineDate: {
fontFamily: 'var(--font-sans)',
fontSize: '12px',
color: 'var(--fg-tertiary)',
},
bodyPara: {
fontFamily: 'var(--font-serif)',
fontSize: 'var(--text-base)',
lineHeight: 'var(--leading-relaxed)',
color: 'var(--fg-primary)',
margin: '0 0 var(--space-5) 0',
maxWidth: 'var(--measure)',
textWrap: 'pretty',
},
sectionH2: {
fontFamily: 'var(--font-serif)',
fontSize: isMobile ? '1.1rem' : '1.25rem',
fontWeight: 600,
lineHeight: 1.3,
color: 'var(--fg-primary)',
margin: 'var(--space-8) 0 var(--space-4) 0',
maxWidth: 'var(--measure)',
},
articleDivider: {
border: 'none',
borderTop: '1px solid var(--border-light)',
margin: 'var(--space-6) 0',
maxWidth: 'var(--measure)',
},
bioLine: {
fontFamily: 'var(--font-serif)',
fontSize: 'var(--text-sm)',
lineHeight: 'var(--leading-relaxed)',
color: 'var(--fg-secondary)',
fontStyle: 'italic',
margin: '0 0 var(--space-5) 0',
maxWidth: 'var(--measure)',
textWrap: 'pretty',
},
backLink: {
fontFamily: 'var(--font-sans)',
fontSize: '13px',
color: 'var(--fg-tertiary)',
textDecoration: 'none',
cursor: 'pointer',
background: 'none',
border: 'none',
padding: 'var(--space-2) 0',
minHeight: '44px',
display: 'inline-flex',
alignItems: 'center',
transition: 'color var(--duration-fast) var(--easing)',
},
end: { paddingBottom: 'var(--space-10)' },
extLink: {
fontFamily: 'var(--font-serif)',
fontSize: 'var(--text-base)',
color: 'var(--accent)',
textDecoration: 'underline',
textUnderlineOffset: '0.15em',
display: 'block',
marginBottom: 'var(--space-3)',
lineHeight: 'var(--leading-relaxed)',
},
originalCredit: {
fontFamily: 'var(--font-sans)',
fontSize: '12px',
color: 'var(--fg-tertiary)',
fontStyle: 'italic',
marginBottom: 'var(--space-6)',
},
};
const formatDate = (dateStr) => {
const d = new Date(dateStr + 'T00:00:00');
return d.toLocaleDateString('en-GB', { day: 'numeric', month: 'long', year: 'numeric' });
};
const authorPhoto = (name) =>
name === 'Grant Purdy' ? '/assets/grant-purdy.jpg?v=2' :
name === 'Roger Estall' ? '/assets/roger-estall.jpg?v=2' :
name === 'Joseph Purdy' ? '/assets/joseph-purdy.jpg' : null;
/* ─── Article view ─── */
if (articleSlug) {
const article = VISIBLE_ARTICLES.find(a => a.slug === articleSlug);
if (!article) {
return React.createElement(Section, { style: { ...s.hero, ...s.end } },
React.createElement('p', { style: s.subtitle }, 'Article not found.'),
React.createElement('button', { style: s.backLink, onClick: () => onNavigate('writing') }, '\u2190 Back to Writing'),
);
}
const photo = authorPhoto(article.author);
return React.createElement('div', { style: { background: 'var(--bg-primary)' } },
React.createElement(Section, { style: s.hero },
React.createElement('button', { style: s.backLink, onClick: () => onNavigate('writing') }, '\u2190 Writing'),
React.createElement('h1', { style: s.articleH1 }, article.title),
React.createElement('div', { style: s.byline },
photo && React.createElement('img', { src: photo, alt: article.author, style: s.bylinePhoto, loading: 'lazy' }),
React.createElement('div', null,
React.createElement('div', { style: s.bylineName }, article.author),
React.createElement('div', { style: s.bylineDate }, formatDate(article.date)),
),
),
),
React.createElement(Section, { style: { paddingTop: 'var(--space-7)', paddingBottom: 'var(--space-10)' } },
...article.body.map((para, i) => {
if (para.startsWith('## ')) return React.createElement('h2', { key: i, style: s.sectionH2 }, para.slice(3));
if (para === '---') return React.createElement('hr', { key: i, style: s.articleDivider });
const bio = para.startsWith('*') && para.endsWith('*') && !para.startsWith('**');
return React.createElement('p', {
key: i,
style: bio ? s.bioLine : s.bodyPara,
dangerouslySetInnerHTML: { __html: bio ? para.slice(1, -1) : para },
});
}),
/* External links for conversation-style posts */
article.externalLinks && React.createElement('div', {
style: { marginTop: 'var(--space-5)', paddingTop: 'var(--space-5)', borderTop: '1px solid var(--border-light)' }
},
React.createElement(Overline, { style: { marginBottom: 'var(--space-3)' } }, 'Read the conversations'),
...article.externalLinks.map((link, i) =>
React.createElement('a', { key: i, style: s.extLink, href: link.url, target: '_blank', rel: 'noopener' }, link.label, ' \u2192')
),
),
React.createElement('div', {
style: { marginTop: 'var(--space-8)', paddingTop: 'var(--space-5)', borderTop: '1px solid var(--border-light)' }
},
React.createElement('button', { style: s.backLink, onClick: () => onNavigate('writing') }, '\u2190 More writing'),
),
),
);
}
/* ─── Index view ─── */
return React.createElement('div', { style: { background: 'var(--bg-primary)' } },
React.createElement(Section, { style: s.hero },
React.createElement('h1', { style: s.h1 }, 'Writing'),
React.createElement('p', { style: s.subtitle },
'On decision-making, the method, and what organisations get wrong when they try to manage "risk" instead of deciding.'),
),
React.createElement(Divider),
React.createElement(Section, { style: s.end },
...VISIBLE_ARTICLES.map((article) =>
React.createElement('a', {
key: article.slug,
style: s.entryLink,
onClick: (e) => { e.preventDefault(); onNavigate('writing/' + article.slug); },
href: '#',
},
React.createElement('div', { style: s.entryMeta },
formatDate(article.date), ' \u00B7 ', article.author),
React.createElement('h2', { style: s.entryTitle }, article.title),
React.createElement('p', { style: s.entrySummary }, article.summary),
)
),
),
);
};
window.WritingPage = WritingPage;
window.ARTICLES = ARTICLES;