The Iron Law at Volkswagen

So Michael Horn, VW’s US CEO has made a “sincere apology” for what went on at VW.

And like so many “sincere apologies” he blamed somebody else. “My understanding is that it was a couple of software engineers who put these in.”

As an old automotive hand I have always been very proud of the industry. I have held it up as a model of efficiency, aesthetic aspiration, ambition, enlightenment and probity. My wife will tell you how many times I have responded to tales of workplace chaos with “It couldn’t happen in a car plant”. Fortunately we don’t own a VW but I still feel betrayed by this. Here’s why.

A known risk

Everybody knew from the infancy of emissions testing, which came along at about the same time as the adoption of engine management systems, the risks of a “cheat device”. It was obvious to all that engineers might be tempted to manoeuvre a recalcitrant engine through a challenging emissions test by writing software so as to detect test conditions and thereon modify performance.

In the better sort of motor company, engineers were left in no doubt that this was forbidden and the issue was heavily policed with code reviews and process surveillance.

This was not something that nobody saw coming, not a blind spot of risk identification.

The Iron Law

I wrote before about the Iron Law of Oligarchy. Decision taking executives in an organisation try not to pass information upwards. That will only result in interference and enquiry. Supervisory boards are well aware of this phenomenon because, during their own rise to the board, they themselves were the senior managers who constituted the oligarchy and who kept all the information to themselves. As I guessed last time I wrote, decisions like this don’t get taken at board level. They are taken out of the line of sight of the board.


So here we have a known risk. A threat that would likely not be detected in the usual run of line management. And it was of such a magnitude as would inflict hideous ruin on Volkswagen’s value, accrued over decades of hard built customer reputation. Volkswagen, an eminent manufacturer with huge resources, material, human and intellectual. What was the governance function to do?

Borrowing strength again

It would have been simple, actually simple, to secret shop the occasional vehicle and run it through an on-road emissions test. Any surprising discrepancy between the results and the regulatory tests would then have been a signal that the company was at risk and triggered further investigation. An important check on any data integrity is to compare it with cognate data collected by an independent route, data that shares borrowing strength.

Volkswagen’s governance function simply didn’t do the simple thing. Never have so many ISO 31000 manuals been printed in vain. Theirs were the pot odds of a jaywalker.


In the English breach of trust case of Baden, Delvaux and Lecuit v Société Générale [1983] BCLC 325, Mr Justice Peter Gibson identified five levels of knowledge that might implicate somebody in wrongdoing.

  • Actual knowledge.
  • Wilfully shutting one’s eyes to the obvious (Nelsonian knowledge).
  • Wilfully and recklessly failing to make such enquiries as an honest and reasonable man would make.
  • Knowledge of circumstances that would indicate the facts to an honest and reasonable man.
  • Knowledge of circumstances that would put an honest and reasonable man on enquiry.

I wonder where VW would place themselves in that.

How do you sound when you feel sorry?

… is the somewhat barbed rejoinder to an ungracious apology. Let me explain how to be sorry. There are three “R”s.

  • Remorse: Different from the “regret” that you got caught. A genuine internal emotional reaction. The public are good at spotting when emotions are genuine but it is best evidenced by the following two “R”s.
  • Reparation: Trying to undo the damage. VW will not have much choice about this as far as the motorists are concerned but the shareholders may be a different matter. I don’t think Horn’s director’s insurance will go very far.
  • Reform: This is the barycentre of repentance. Can VW now change the way it operates to adopt genuine governance and systematic risk management?

Mr Horn tells us that he has little control over what happens in his company. That is probably true. I trust that he will remember that at his next remuneration review. If there is one.

When they said, “Repent!”, I wonder what they meant.

Leonard Cohen
The Future


Data and anecdote revisited – the case of the lime jellybean

JellyBellyBeans.jpgI have already blogged about the question of whether data is the plural of anecdote. Then I recently came across the following problem in the late Richard Jeffrey’s marvellous little book Subjective Probability: The Real Thing (2004, Cambridge) and it struck me as a useful template for thinking about data and anecdotes.

The problem looks like a staple of elementary statistics practice exercises.

You are drawing a jellybean from a bag in which you know half the beans are green, all the lime flavoured ones are green and the green ones are equally divided between lime and mint flavours.

You draw a green bean. Before you taste it, what is the probability that it is lime flavoured?

A mathematically neat answer would be 50%. But what if, asked Jeffrey, when you drew the green bean you caught a whiff of mint? Or the bean was a particular shade of green that you had come to associate with “mint”. Would your probability still be 50%?

The given proportions of beans in the bag are our data. The whiff of mint or subtle colouration is the anecdote.

What use is the anecdote?

It would certainly be open to a participant in the bean problem to maintain the 50% probability derived from the data and ignore the inferential power of the anecdote. However, the anecdote is evidence that we have and, if we choose to ignore it simply because it is difficult to deal with, then we base our assessment of risk on a more restricted picture than that actually available to us.

The difficulty with the anecdote is that it does not lead to any compelling inference in the same way as do the mathematical proportions. It is easy to see how the bean proportions would give rise to a quite extensive consensus about the probability of “lime”. There would be more variety in individual responses to the anecdote, in what weight to give the evidence and in what it tended to imply.

That illustrates the tension between data and anecdote. Data tends to consensus. If there is disagreement as to its weight and relevance then the community is likely to divide into camps rather than exhibit a spectrum of views. Anecdote does not lead to such a consensus. Individuals interpret anecdotes in diverse ways and invest them with varying degrees of credence.

Yet, the person who is best at weighing and interpreting the anecdotal evidence has the advantage over the broad community who are in agreement about what the proportion data tells them. It will often be the discipline specialist who is in the best position to interpret an anecdote.

From anecdote to data

One of the things that the “mint” anecdote might do is encourage us to start collecting future data on what we smelled when a bean was drawn. A sequence of such observations, along with the actual “lime/ mint” outcome, potentially provides a potent decision support mechanism for future draws. At this point the anecdote has been developed into data.

This may be a difficult process. The whiff of mint or subtle colouration could be difficult to articulate but recognising its significance (sic) is the beginning of operationalising and sharing.

Statistician John Tukey advocated the practice of exploratory data analysis (EDA) to identify such anecdotal evidence before settling on a premature model. As he observed:

The greatest value of a picture is when it forces us to notice what we never expected to see.

Of course, the person who was able to use the single anecdote on its own has the advantage over those who had to wait until they had compelling data. Data that they share with everybody else who has the same idea.

Data or anecdote

When I previously blogged about this I had trouble in coming to any definition that distinguished data and anecdote. Having reflected, I have a modest proposal. Data is the output of some reasonably well-defined process. Anecdote isn’t. It’s not clear how it was generated.

We are not told by what process the proportion of beans was established but I am willing to wager that it was some form of counting.

If we know the process generating evidence then we can examine its biases, non-responses, precision, stability, repeatability and reproducibility. Anecdote we cannot. It is because we can characterise the measurement process, through measurement systems analysis, that we can assess its reliability and make appropriate allowances and adjustments for its limitations. An assessment that most people will agree with most of the time. Because the most potent tools for assessing the reliability of evidence are absent in the case of anecdote, there are inherent difficulties in its interpretation and there will be a spectrum of attitudes from the community.

However, having had our interest pricked by the anecdote, we can set up a process to generate data.

Borrowing strength again

Using an anecdote as the basis for further data generation is one approach to turning anecdote into reliable knowledge. There is another way.

Today in the UK, a jury of 12 found nurse Victorino Chua, beyond reasonable doubt, guilty of poisoning 21 of his patients with insulin. Two died. There was no single compelling piece of evidence put before the jury. It was all largely circumstantial. The prosecution had sought to persuade the jury that those various items of circumstantial evidence reinforced each other and led to a compelling inference.

This is a common situation in litigation where there is no single conclusive piece of data but various pieces of circumstantial evidence that have to be put together. Where these reinforce, they inherit borrowing strength from each other.

Anecdotal evidence is not really the sort of evidence we want to have. But those who know how to use it are way ahead of those embarrassed by it.

Data is the plural of anecdote, either through repetition or through borrowing.

Proposition 65

WarningPoster1I had break from posting following my recent family vacation to California. While I was out there I noticed this rather alarming notice at a beach hotel and restaurant in Santa Monica. After a bit of research it turned out that the notice was motivated by California Proposition 65 (1986). Everywhere we went in California we saw similar notices.

I stand in this issue not solely as somebody professionally involved in risk but also as an individual concerned for his own health and that of his family. If there is an audience for warnings of harm then it is me.

I am aware of having embarked on a huge topic here but, as I say, it is as a concerned consumer of risk advice. The notice, and I hesitate to call it a warning, was unambiguous. Apparently, this hotel, teeming with diners and residents enjoying the pacific coast, did contain chemicals emphatically “known” to cause cancer, birth defects or reproductive harm. Yet for such dreadful risks to be present the notice gave alarmingly vague information. I saw that a brochure was available within the hotel but my wife was unwilling to indulge my professional interest. I suspect that most visitors showed even less curiosity.

As far as discharging any legal duty goes, vague notices offer no protection to anybody. In the English case of Vacwell Engineering Co. Ltd v B.D.H. Chemicals Ltd [1969] 3 All ER 1681, Vacwell purchased ampules of boron tribromide from B.D.H.. The ampules bore the label “Harmful Vapour”. While the ampules were being washed, one was dropped into a sink where it fractured allowing the contents to come into contact with water. Mixing water with boron tribromide caused an explosion that killed one employee and extensively damaged a laboratory building. The label had given B.D.H. no information as to the character or possible severity of the hazard, nor any specific details that would assist in avoiding the consequences.

Likewise the Proposition 65 notice gives me no information on the severity of the hazard. There is a big difference between “causing” cancer and posing a risk of cancer. The notice doesn’t tell me whether cancer is an inevitable consequence of exposure or whether I should just shorten my odds against mortality. There is no quantification of risk on which I can base my own decisions.

Nor does the notice give me any guidance on what to do to avoid or mitigate the risk. Will stepping foot inside the premises imperil my health? Or are there only certain areas that are hazardous? Are these delineated with further and more specific warnings? Or even ultimately segregated in secure areas? Am I even safe immediately outside the premises? Ten yards away? A mile? I have to step inside to acquire the brochure so I think I should be told.

The notice ultimately fulfils no socially useful purpose whatever. I looked at the State of California’s own website on the matter but found it too opaque to extract any useful information within the time I was willing to spend on it, which I suspect is more time than most of the visitors who find their way there.

It is most difficult for members of the public, even those engaged and interested, to satisfy themselves as to the science on these matters. The risks fall within what John Adams at University College London characterises as risks that are known to science but on which normal day to day intuition is of little use. The difficulty we all have is that our reflection on the risks is conditioned on the anecdotal hearsay that we pick up along the way. I have looked before at the question of whether anecdote is data.

In 1962, Rachel Carson published the book Silent Spring. The book aggregated anecdotes and suggestive studies leading Carson to infer that industrial pesticides were harming agriculture, wildlife and human health. Again, proper evaluation of the case she advanced demands more attention to scientific detail than any lay person is willing to spare. However, the fear she articulated lingers and conditions our evaluation of other claims. It seems so plausible that synthetic chemicals developed for lethal effect, rather than evolved in symbiosis with the natural world, would pose a threat to human life and be an explanation for increasing societal morbidity.

However, where data is sparse and uncertain, it is important to look for other sources of information that we can “borrow” to add “strength” to our preliminary assessment (Persi Diaconis’ classic paper Theories of Data Analysis: From Magical Thinking through Classical Statistics has some lucid insights on this). I found the Cancer Research UK website provided me with some helpful borrowing strength. Cancer is becoming more prevalent largely because we are living longer. Cancer Research helpfully referred me to this academic research published in the British Journal of Cancer.

Despite the difficulty in disentangling and interpreting data on specific risks of alleged pathogens we have the strength of borrowing from life expectancy data. Life expectancy has manifestly improved in the half century since Carson’s book, belying her fear of a toxic catastrophe flowing from our industrialised society. I think that is why there was so much indifference to the Santa Monica notice.

I should add that, inside the hotel, I spotted five significant trip hazards. I suspect these posed a much more substantial threat to visitors’ wellbeing than the virtual risks of contamination with hotel carcinogens.