Probing the Slow Variable - A Preliminary Position Paper on Observability and the Allocation of Supervisory Duty in Organisations 【（Preliminary）Draft】

Abstract

A supervisory obligation addressed to the stability of a social system presupposes that the condition of that system is available to some party. This paper asks whether it is available, at what cost, and to whom. The standard measurement applies a controlled disturbance and reads the recovery. Three results bear against it. In a bistable system under slow forcing the signal available from a probe grows with the recovery time while the amplitude that leaves the basin intact falls with the margin, and the product remains bounded, so the signal obtainable from a harmless probe fails to increase as the system deteriorates. A probe reaches the linearisation of the flow at the attractor and reaches no further, so the passage from what it recovers to the margin rests on an assumption about the class of the system, and disturbances arriving in the directions a setting happens to produce leave the estimate deficient in the directions along which nothing has yet occurred. And the burden of an applied disturbance falls most heavily on the member nearest the boundary, who is the member the measurement most concerns. Three ethical grounds are stated separately, since a reader who rejects the first result should still find applied probing unavailable. From these the paper derives the standing of passive measurement, which reads disturbances that occur without intervention and carries no marginal burden, and identifies the one form of applied probing that remains, namely the probing of the organisation’s own response pathway rather than of its members. A further limit is then developed. A recovery interval is judged and not read off, and the account of the person concerned is exposed to discounting of credibility and to the absence of any term for a return that is incomplete. Both operations shorten the recorded interval, both act most strongly on those whose accounts are least credited, and those are the members nearest the boundary, so the instrument is biased in the direction that conceals the danger. The paper argues that observability is a positional property and that its distribution supplies a ground for allocating supervisory duty distinct from control and from advantage in information, relocates the assessment of foreseeability accordingly, and states the costs and the principal failure mode.

Keywords: supervisory obligation; observability; critical slowing down; early warning indicators; safety science; foreseeability; organisational duty; generative relational systems.

A note on the standing of this paper. This paper is the sister of a companion position paper on trajectory and attribution, which argues that a class of cumulative injury resists adjudicative treatment and that the route remaining lies in supervisory obligation. The present paper examines the epistemic condition on which that route depends and reaches a qualified conclusion. Its concession to prior work is extensive and is made in §2 before any claim is entered, since the proposition that the condition of a system may be monitored in advance of failure is established in the safety and dynamical literatures and is assumed here. What the paper claims is confined to two questions those literatures do not reach. The formal material in §3 is elementary and is presented so that its propositions can be shown false. Objection, correction, and counter-evidence are welcome at huangwanhong@serendip.ngo.

1. Introduction

This section states the question the paper addresses, explains why it arises from the position taken in the companion paper, identifies the site chosen for the analysis, and sets out the order of the argument. The method combines a dynamical characterisation of the quantity to be estimated with a doctrinal account of the obligations that would rest upon its estimation.

A supervisory obligation addressed to the stability of a social system holds an organisation answerable for the maintenance of conditions and requires the prediction of no particular outcome. Obligations of this form are established. An employer owes attention to the safety of those engaged in work under its direction. Schools in many systems bear a standing obligation to maintain arrangements for the detection and handling of bullying and to investigate upon the occurrence of a serious case. Financial institutions are supervised through instruments addressed to their capacity to absorb loss (BCBS, 2018). Each operates upon the condition of a system.

The obligation therefore rests on an epistemic condition. A duty to keep a system away from a boundary of stability presupposes that the distance from that boundary is available to some party. The companion paper reaches the supervisory route by exclusion, having shown that adjudicative treatment of cumulative sub-threshold conduct fails at both ends of the process. This paper asks whether the route so reached is passable.

The site is the workplace, and the choice is made on the ground of instrumentation. Working hours, absence, turnover, the handling times of grievances, and the criteria applied in the recognition of work-related disorder already generate longitudinal records, so the question of what could be measured may be examined against series that exist. The school case is structurally identical and is treated by way of comparison where the instruments differ.

The order of what follows is: the prior work, which is substantial and which narrows the contribution considerably (§2); the dynamical presentation of measurement and the invariance on which the argument turns (§3); the permissibility gradient governing applied disturbance (§4); passive measurement and the instruments available (§5); the distribution of observability across positions (§7); the allocation of duty that follows (§8); the costs and the principal failure mode (§9); the predictions (§10); and the conditions of refutation (§11).

2. Relation to Prior Work on Advance Monitoring

This section identifies the literatures that occupy the ground of this paper, states what each has established, and narrows the contribution to the residue. The concession is extensive, and the value of what follows depends on its accuracy.

The organisational literature on disaster established that severe outcomes are preceded by an incubation period during which discrepant events accumulate unnoticed against prevailing beliefs about the hazard (Turner, 1978; Turner & Pidgeon, 1997). The dynamic account of organisational safety describes systems migrating under economic and workload pressure towards a boundary at which performance fails, and locates the object of management in the distance from that boundary (Rasmussen, 1997). The study of institutional decision making has documented the process by which departures from an expected standard become accepted within an organisation (Vaughan, 1996). Resilience engineering has developed the maintenance of adaptive capacity as an object of management in its own right (Hollnagel et al., 2006; Woods, 2015; Hollnagel, 2014), and systems approaches to safety have reconstructed accident causation as the degradation of control structures (Leveson, 2011).

Two further bodies of work bear directly on the instruments. The dynamical literature has characterised the statistical signatures preceding critical transitions, of which the lengthening of recovery after disturbance is the most general, and has developed methods for their detection in time series (Wissel, 1984; Scheffer et al., 2009; Scheffer, 2009; Dakos et al., 2012; Kuehn, 2011). The safety literature has developed the distinction between indicators recording outcomes already realised and indicators recording the condition of the system in advance of them, together with a sustained critique of the misuse of the former (Hopkins, 2009).

Claim 2.1. (The residue after concession). The proposition that the condition of a system may be monitored in advance of failure, and that recovery after minor disturbance carries information about that condition, is established in the literatures cited and is assumed here. What remains are two questions those literatures do not reach: whether the applied disturbance on which the standard measurement depends is available in a social system, and how the resulting distribution of observability bears upon the allocation of legal obligation.

The general critique of management by indicator is likewise established and is assumed (Strathern, 1997). Section 9 states its application to the instruments proposed and restates none of it.

3. The Coincidence of Information and Trigger Risk

This section gives the dynamical presentation of measurement, derives the invariance on which §4 turns, and fixes the limits of what the presentation delivers. The method is analytic for the invariance and numerical for the illustrations; the figures report simulations of the system stated below and carry no empirical claim.

Take the presentation of the companion paper. The condition of the system is summarised by a variable $x$ with a control parameter $\mu$ varying slowly by comparison with the relaxation of $x$, in the elementary bistable form with additive noise of intensity $\sigma$,

$$\mathrm{d}x = \bigl(-x^{3} + x + \mu(t)\bigr),\mathrm{d}t + \sigma,\mathrm{d}W,
\qquad \dot\mu>0,
\qquad V(x) = \tfrac{1}{4}x^{4} - \tfrac{1}{2}x^{2} - \mu x .$$

For $|\mu| < \mu_{c} = 2/(3\sqrt{3})$ the three roots of $x^{3}-x=\mu$ give a lower attractor $x_{l}$, a saddle $x_{s}$, and an upper attractor $x_{u}$. Write $\Delta(\mu) = x_{s}-x_{l}$ for the margin and $\tau(\mu) = 1/(3x_{l}^{2}-1)$ for the characteristic recovery time. Two quantities govern the measurement. A disturbance of amplitude $a$ delivered at $x_{l}$ produces an excursion whose integral over time is $a\tau$ in the linear regime, and that integral is the signal from which $\tau$ is estimated against the noise. The same disturbance leaves the basin intact when $a < \Delta$.

Proposition 3.1. (Invariance of the maximal safe signal). The signal obtainable from a probe that leaves the basin intact satisfies

$$S ;=; a,\tau ;<; \tau(\mu),\Delta(\mu) ,$$

and $\tau\Delta$ is bounded and slowly varying along the whole approach to the merger, tending to $1/\sqrt{3}$ as $\mu \to \mu_{c}$ and equal to unity in the saddle-node normal form to which the system reduces there. The amplification that makes a probe informative and the margin that makes it safe therefore move reciprocally, and the information available from safe probing fails to increase as the system deteriorates.

The invariance is asymptotic and its constant depends on the normalisation of the state variable. In (1) the product rises from $0.500$ at $\mu=0$ to $0.572$ at $\mu = 0.3845$, against the limit $1/\sqrt{3} = 0.577$. What the proposition asserts is the boundedness of $\tau\Delta$ where each factor separately diverges or vanishes, and the doctrinal argument requires no more.

Corollary 3.2. (Absence of an informative and safe regime). There exists no value of the control parameter at which applied probing is both informative and safe. Far from the boundary a safe disturbance may be large and the recovery is brief, and near the boundary the recovery is long and a safe disturbance is small, and the product of the two is bounded throughout. The measurement is least available in the condition in which it is most required.

Figure 1 displays the two quantities and their product across the approach to the boundary.

Figure. The reciprocity of Proposition 3.1 in the system of (1). As the margin $\Delta$ narrows the amplification $\tau$ rises without bound and the amplitude that may safely be applied falls to zero, while the maximal safe signal $\tau\Delta$ remains bounded and approaches $1/\sqrt{3}$. The horizontal axis runs from a wide margin on the left to a narrow one on the right.

The scalings $\tau \sim (\mu_{c}-\mu)^{-1/2}$ and $\Delta \sim (\mu_{c}-\mu)^{1/2}$ are generic at the merger of an attractor with a saddle, so the boundedness of their product holds for the class (Kuehn, 2011; Wissel, 1984). What the presentation delivers is a relation between two quantities; it identifies neither in any social system, it estimates no parameter, and it licenses no inference from an observed outcome to a critical transition. Corollary 3.2 requires only the boundedness, which may be asserted of a candidate case and denied of it on evidence.

3.1 The reach of a probe into the tangent space

A disturbance small enough to leave the basin intact evolves, for as long as it remains small, under the linearisation of the flow at the attractor. Writing $J$ for the derivative of the vector field at $x_{l}$, the deviation $\xi$ obeys $\dot\xi = J\xi$ to first order, so the response is settled by the spectrum of $J$ and the recovery time is the reciprocal of the modulus of its eigenvalue of slowest decay. What a probe reaches is therefore the tangent space at the attractor and the action of $J$ upon it.

Proposition 3.3. (Probing reaches the linearisation). A probe recovers properties of the linearisation of the flow at the attractor. The margin $\Delta$ is a property of the basin as a whole and is a function of the flow away from the attractor, so it is no function of $J$. The relation of Proposition 3.1 is what carries the local quantity to the global one, and it holds in virtue of the class to which the system is assumed to belong. The inference from tangent-space data to the margin is therefore model dependent, and that dependence is the principal limitation of the method.

Proposition 3.4. (Untested directions). In a state space of dimension $n$ a disturbance along one direction recovers one projection of the action of $J$, and recovery of $J$ requires disturbances spanning the tangent space. Naturally occurring disturbances arrive in the directions the setting happens to produce, and their directions are not chosen. The estimate is accordingly deficient in the directions along which nothing has yet occurred, and a system may stand close to the boundary in one of them. A record showing stable recovery therefore establishes stability in the directions sampled and establishes nothing beyond them.

A second result stands independently of the first and concerns the distribution of the burden rather than its magnitude.

Definition 3.5. (Members and margins). Let the members of the system be represented by sub-systems indexed by $i$, each with its own margin $\Delta_{i}$ and recovery time $\tau_{i}$ governed by (1), and let a disturbance of common amplitude $a$ be delivered to all of them.

Proposition 3.6. (Co-location of burden and information). Under Definition 3.5 the integrated excursion borne by member $i$ is $a\tau_{i}$, which is greatest for the member with the smallest margin, and the transition occurs for those members satisfying $\Delta_{i} < a$. The burden of an applied disturbance therefore falls most heavily upon the member nearest the boundary of stability, who is the member about whom the measurement is most informative. The burden of the probe and its information are co-located in the same person.

4. The Permissibility Gradient of Applied Disturbance

This section examines whether the condition of a social system may be measured by the standard method, sets out the range of practice in which applied disturbance is permitted, extracts the features that make those cases permissible, and applies the results of §3. The method is comparative across established testing practices.

Applied disturbance is a normal and accepted instrument in many settings, and a general prohibition is refuted by the range of that practice. Financial stress testing subjects a portfolio to a specified adverse scenario (BCBS, 2018). Evacuation exercises perturb an organisation’s operations under announcement. Authorised intrusion testing subjects a security system to attack under contract. Cardiac stress testing applies graded load under monitoring and a stopping rule.

The features that distinguish these are legible, and each is a device that separates the burden from the information. Financial stress testing applies the shock to a model of the institution while the institution continues to operate, so the burden falls on no one. Evacuation exercises are announced, bounded in duration, and reversible. Intrusion testing proceeds under the authorisation of the party whose system is tested. Cardiac testing proceeds under consent and under monitoring, subject to termination upon the appearance of the signal it is designed to elicit, so the burden borne by the person about whom the measurement is informative is bounded.

The contrasting case is equally legible. Where an experiment applied a disturbance to the affective state of participants in a live social system without their knowledge, the reception of that work concentrated on precisely this feature (Kramer et al., 2014). The disturbance was applied to persons, in the live system, without consent, and its effects were unbounded.

Claim 4.1. (The permissibility gradient). Applied disturbance is permitted where the burden is separated from the information: where the disturbance is borne by a model, where it is announced, bounded, and reversible, where it proceeds under the authorisation of those who bear it, or where monitoring and a stopping rule bound what the bearer suffers. A general prohibition on applied probing is unavailable, and the question concerns the position of the criticality case on this gradient.

Corollary 4.2. (Position of the criticality case). In the criticality case none of the separating devices is available. A model of the relational condition of a particular unit sufficient for stress testing does not exist. Announcement and consent are unavailable from the member nearest the boundary, whose condition is the object of the measurement and whose capacity to appraise the burden is the quantity in question. Monitoring with a stopping rule presupposes the observability that §7 shows to be absent at the level of the single observation. The disturbance therefore falls on the person it is designed to learn about, in proportion to that person’s proximity to the outcome the exercise exists to prevent, by Proposition 3.6, and Corollary 3.2 establishes that no amplitude escapes the difficulty.

The obstacle so stated is structural. It follows from Propositions 3.1 and 3.7 and survives the removal of every ethical objection, which matters for the argument because an obstacle resting on ethics alone would be discharged by consent, and consent is precisely what the condition of the bearer places in question.

The ethical ground is separate and is stated on its own, since a reader who rejects the structural result should still find applied probing unavailable here.

Claim 4.3. (Three ethical grounds). Applied probing of the members of a system approaching a boundary of stability is objectionable on three grounds that hold independently of Corollary 3.2. The burden falls most heavily on the member least able to bear it, by Proposition 3.6. Consent is unavailable, since the capacity to appraise the burden is the very quantity under investigation, so an agreement obtained from the member nearest the boundary is worth least where it is needed most. And the benefit of the exercise accrues to the institution while the risk is borne by the member, so benefit and burden are distributed inversely.

5. Passive Measurement and the Available Instruments

This section establishes the standing of measurement that reads disturbances occurring without intervention, states the form of obligation that follows, specifies the instruments available in the workplace, and identifies the single form of applied probing that survives §4. The method derives the standing of the passive route from the results of §3 and specifies the instruments against recording practices that organisations already maintain.

Social systems are disturbed continuously without intervention by any observer. Grievances are raised, absences occur, projects fail, teams are reorganised, and disputes arise and are settled. Each is a disturbance whose occurrence is independent of any measurement, and the response of the system to each is available for reading.

Claim 5.1. (Zero marginal burden). Reading a naturally occurring disturbance adds nothing to the burden borne by the members of the system, since the disturbance occurs whether or not it is read. Passive measurement has a standing distinct from that of a less harmful alternative, and it holds the whole of the ground that §4 denies to applied probing.

Proposition 5.2. (The culpable form). The obligation following from Claim 5.1 concerns the reading of disturbances that have already occurred. An organisation holding records of incident and response holds the information required for an estimate of its own condition, and the failure at issue is the failure to read information already in hand. An obligation in this form requires no intrusion into the lives of members and is correspondingly easier to justify than an obligation to monitor them.

The instruments follow from the quantity to be estimated. By (1) and Proposition 3.1 the most general signature of approach to a boundary of stability is the lengthening of recovery after disturbance, accompanied by rising dispersion and rising correlation between successive observations (Wissel, 1984; Scheffer et al., 2009; Dakos et al., 2012). Figure 2 shows the signature under a sequence of disturbances of identical magnitude.

Figure. The passive signature. Upper panel: deviation from the attractor under five disturbances of identical magnitude, with the recovery interval marked for each. Lower panel: the recovery intervals as a series. The level of the deviation at any single disturbance carries little information and the trend across the series carries the estimate.

Claim 5.3. (Recording of recovery). Existing organisational records register the occurrence of events and omit the recovery from them. Grievance systems record receipt and disposal, incident systems record incidents, and absence systems record days lost. The estimate of condition requires the interval between disturbance and the resumption of the prior state, so the amendment required of recording practice concerns the recording of recovery.

The workplace instruments follow. The interval between a member’s return from absence and the resumption of that member’s prior pattern of participation supplies a recovery time. The interval between the raising of a grievance and its closure, measured against the distribution of such intervals over preceding periods, supplies a second. The trajectory of a team’s ordinary indicators following a departure supplies a third. The interval between a disruptive incident and the resumption of the unit’s prior operating pattern supplies a fourth. In each case the quantity of interest is the trend in the interval across the series, and the level in any single instance carries little information.

One form of applied probing survives §4, and it does so by supplying the separating device that Corollary 4.2 finds absent.

Proposition 5.4. (Probing of the response pathway). An organisation may disturb its own response machinery without disturbing its members. A test matter entered into the reporting channel and followed through routing, assessment, and closure measures the condition of the pathway on which detection depends. The burden falls on the institution, the information concerns the institution, and the member nearest the boundary of stability is untouched. The evacuation exercise has this structure, and the instrument extends it from physical egress to the handling of reports.

The instrument is available in the school case in the same form, since an obligation to maintain arrangements for detection and handling is an obligation concerning the pathway that such a test measures.

6. The Mediation of the Instrument by Judgement

This section states the limits of the instrument proposed in §5. Two of them follow from what a probe reaches and are recorded in §3. A third arises in the passage from an observed response to a property of the dynamics, and it is the more serious, since it biases the instrument in a direction that the analysis of this paper would otherwise conceal. The method is to identify the operations interposed between the disturbance and the recorded recovery interval, and then to state the direction in which each moves the estimate.

Proposition 6.1. (The judgement interposed before the record). A recovery interval is not observed directly. Someone must settle when the unit or the person returned to the prior state, and that settlement rests on observation by others and on the account given by the person concerned. The quantity entering the record is therefore the output of a judgement, and the properties of that judgement are properties of the instrument.

Proposition 6.2. (Two operations upon the account). The account given by the person concerned is exposed to two operations. It may be discounted for reasons bearing on the credibility attributed to the speaker rather than on the accuracy of the account. And where the shared interpretive resources hold no term for a return that is incomplete, an account of an incomplete return has no form in which to be entered and is recorded as a return (Fricker, 2007).

Corollary 6.3. (The direction of the bias). Both operations of Proposition 6.2 shorten the recorded recovery interval, since each converts an account of continuing difficulty into an earlier return. Both operate most strongly upon those whose accounts are least credited. By Proposition 3.6 those are the members whose responses are most amplified, which is to say the members nearest the boundary of stability. The instrument is therefore biased in the direction that conceals the approach to the boundary, and the bias is strongest in the cases the instrument exists to detect.

Claim 6.4. (Construction that limits the exposure). An instrument constructed on quantities generated by the institution’s own acts is exposed to the operations of Proposition 6.2 to a smaller degree than one constructed on accounts of the condition of members. The interval between the receipt of a grievance and its closure, the interval between an incident and the resumption of the unit’s prior operating pattern, and the routing and closure times of the test matter of Proposition 5.4 are quantities of that kind. This is a further and independent reason for the instruments of §5 and for the probing of the response pathway.

Claim 6.5. (The reach of the instrument). Taken with Propositions 3.3 and 3.4, the instrument yields an estimate of the linearisation at the attractor in the directions that disturbances happened to take, mediated by a judgement biased towards early return. A record of stable and unlengthening recovery therefore fails to establish that the system stands far from a boundary, and the obligation of Corollary 8.3 is discharged by the examination of the record and is not discharged by a favourable reading of it.

7. The Positional Character of Observability

This section states the sense in which the condition of the system is available to some parties and withheld from others, gives the reason for the asymmetry, and establishes that the asymmetry follows from position rather than from diligence. The method derives the asymmetry from the statistical character of the signature identified in §5.

The signatures of approach to a boundary of stability are properties of a series. Lengthening recovery is a trend across repeated disturbances, rising dispersion is a property of a distribution, and rising correlation between successive observations is defined over a sequence. Each is undefined on a single observation. Figure 3 displays the consequence.

Figure. The two registers. Upper panel: the individual observations available to a participant, which are dispersed and carry no legible trend. Lower panel: the rolling dispersion and rolling autocorrelation computed over the same observations, which rise across the interval. The same record supports an estimate in the aggregate register and supports none in the local one.

Claim 8.1. (Aggregate visibility). The condition of a system approaching a boundary of stability is legible in a longitudinal aggregate and is illegible in any single observation. A participant who observes one interaction at one time possesses no quantity from which the condition may be inferred.

Claim 8.2. (Degradation of local observation). Dispersion rises as the system approaches the boundary, so the scatter of single observations about the underlying condition increases, and a local observation becomes a poorer guide to the condition of the system precisely as that condition deteriorates.

Proposition 8.3. (The positional character of observability). The failure of a situated participant to perceive the approach of a critical transition follows from the position occupied and holds independently of that participant’s attention or competence. The condition is available to the party holding the series, so the distribution of observability across an organisation follows the distribution of the record.

Proposition 8.3 disposes of a familiar account of the supervisor who observed daily that nothing serious had occurred. The observation was accurate on each occasion, and the inference it failed to support was unavailable from the observations made.

8. The Allocation of Duty by Observability

This section derives the allocation of supervisory obligation from the results of §7, distinguishes the resulting ground from those ordinarily offered, and restates the assessment of foreseeability in the terms the analysis supplies. The method compares the proposed ground with the existing justifications for organisational obligation and states what each supports.

Organisational obligation is ordinarily grounded on control of a sphere of danger, on the direction of the activity from which the risk arises, or on advantage in information. Each supports an obligation, and each is consistent with an obligation to prevent particular outcomes, which is the obligation that the companion paper shows to be unattainable in this class.

Proposition 9.1. (Duty follows observability). Where the condition of a system is available to one party in virtue of the record that party holds, and is unavailable to the participants in virtue of the positions they occupy, the obligation to estimate that condition rests upon the holder of the record. The ground is the distribution of observability and is distinct from control and from advantage in information, since it establishes that one party alone is able to know at all.

The proposition bears on the assessment of foreseeability. Where the harm is a critical transition, foreseeability of the harm is unavailable for the reasons the companion paper gives, since the moment of transition is undefined in advance and the sufficient disturbance is of ordinary magnitude. The assessment may be relocated and thereby retained.

Proposition 9.2. (Relocation of the foreseeability assessment). The assessment of foreseeability in a criticality case attaches to the observable deterioration of the system’s capacity to recover and detaches from the terminal outcome. The object of foresight becomes a trend legible in the record held by the organisation, which is a quantity existing in advance of the outcome and admitting of evidence.

Corollary 9.3. (Content of the organisational obligation). The obligation following has three elements: to record recovery as well as occurrence, to examine the resulting series for the signatures identified in §5, and to act upon a deteriorating trend by measures addressed to the relational structure of the unit. The obligation attaches to the maintenance of a capacity and requires the prediction of no particular outcome.

9. The Costs of the Instruments and the Principal Failure Mode

This section states the costs of the obligation set out in §8, identifies the failure mode that would defeat its purpose while preserving its form, and records the limits of the formal apparatus. The method states each cost against the instrument that incurs it.

The first cost is the displacement of the objective by its indicator. Once recovery intervals determine the assessment of an organisation’s condition, the management of recovery intervals becomes an object of organisational effort in its own right, and the correspondence between the indicator and the underlying condition degrades (Strathern, 1997). The cost is unavoidable in the present state of the art, since a capacity obligation is enforceable only through a structural proxy. It is recorded as a limit on the instruments and is offered as no objection to them.

The second cost concerns the boundary of the supervised system. The instruments of §5 operate over an organisation, and the process producing the trajectory crosses that boundary, drawing on domestic circumstances, on communication outside the organisation, and on platforms subject to no common supervision. The estimate obtained is an estimate over a section of the system.

The third cost concerns the coupling between supervisor and system. An organisation assessed on the basis of its records reorganises its recording practices, so the act of supervision alters the system whose condition it estimates.

Claim 10.1. (The resilience trap). An obligation framed in terms of resilience fails at the point at which the term migrates from the relational structure of the system to the endurance of the person. Training addressed to the capacity of members to withstand load, offered in place of measures addressed to the load, satisfies the form of the obligation and defeats its purpose. The migration reproduces within the remedy the pathology of the endogenous predisposition that the companion paper identifies, since it requires the person nearest the boundary to raise the threshold at which the harm occurs.

Claim 10.2. (Attachment of the obligation). The obligation of Corollary 9.3 attaches to the relational structure of the unit. Measures addressed to the endurance of individual members satisfy it where the relational measures have been taken and the residual load has been established, and satisfy it in no other case.

A limit on the apparatus is recorded. The treatment of amplification in this paper and in its companion draws on a formal vocabulary whose full development requires a model in which the rules governing the system may themselves change over time. Pending that development, statements concerning amplification are to be read as characterisations of a phenomenon and not as results derived within a model of that kind.

10. Predictions Assessable Against Existing Records

This section states the observable consequences of the position in a form permitting it to be tested against records that organisations and regulators already hold. The method derives each prediction from an identified claim and names the material against which it may be assessed.

From Proposition 3.6 it follows that organisations subjecting their members to applied testing will show adverse events clustered around the testing, with the clustering concentrated among members already showing extended recovery intervals.

From Claim 5.3 it follows that organisations recording only the occurrence of events will show no advance signal preceding serious cases, while those recording handling and closure intervals will show a lengthening of those intervals in the periods preceding such cases. The investigation records generated under statutory obligations governing serious cases, together with the grievance and incident records held by employers, supply a body of material against which this may be assessed.

From Proposition 8.3 it follows that accounts given by situated participants after a serious case will report the absence of any perceptible signal, and that the same periods will show measurable trends in the aggregate records. Divergence between participant accounts and record series is therefore expected, and its absence counts against the position.

From Proposition 9.1 it follows that supervisory obligations assigned to parties holding no longitudinal record over the relevant system will produce documentation with no effect on outcomes, and the prediction is assessable against enforcement and audit records in settings where such obligations have been imposed.

11. Conditions of Refutation and Open Questions

This section states, for each principal claim, what would defeat it, and records the questions left open. The method follows the requirement that a position be stated so as to permit its own refutation.

Proposition 3.1 asserts the boundedness of $\tau\Delta$ along the approach to the merger. It fails for a candidate system shown to belong to a class in which the scalings of $\tau$ and $\Delta$ are independent, so that their product diverges. Corollary 3.2 fails upon the demonstration of a measurement recovering the margin with information that does not scale with amplification, and indirect estimation from structural parameters is the natural candidate, requiring a model of the system rather than a measurement upon it.

Proposition 3.6 fails where the burden of an applied disturbance is shown to fall independently of proximity to the boundary, and the permitted cases of Claim 4.1 are to be examined for instances of that kind.

Claim 5.1 fails if the reading of naturally occurring disturbances is shown to alter the behaviour of the system through the awareness of members that recovery is recorded, in which case the marginal burden is positive and falls to be assessed against the benefit.

Proposition 8.3 fails upon the exhibition of a local observation supporting an inference to the condition of the system. Claim 8.2 is testable directly, and its failure restores the standing of participant perception.

Proposition 9.1 fails if allocation by observability is shown to coincide in every case with allocation by control, in which case the proposition supplies a rationale and no result.

Propositions 3.3 and 3.4 fail upon the exhibition of a measurement recovering the margin from data confined to the tangent space without an assumption about the class of the system, and upon the exhibition of a setting in which the directions of naturally occurring disturbances span the tangent space. Propositions 6.1 and 6.2 fail where recovery is settled by a quantity requiring no account and no judgement, and Corollary 6.3 is testable directly by comparing recorded recovery intervals with instrumented ones across groups differing in the credibility ordinarily accorded to them.

Three questions are left open. The first concerns the aggregation of records across organisational boundaries, which the second cost of §9 identifies and which raises questions of privacy that this paper does not address. The second concerns the specification of the trend that triggers the obligation to act, which requires a decision on the tolerable rate of false positives and belongs to the supervisory instrument rather than to the analysis. The third concerns the relation between the obligation set out here and the individual liability the companion paper preserves, since an organisation that has discharged the obligation of Corollary 9.3 has thereby answered for none of the conduct of its members.

References

Basel Committee on Banking Supervision, Stress Testing Principles (Bank for International Settlements, 2018).

Vasilis Dakos et al., ``Methods for Detecting Early Warnings of Critical Transitions in Time Series Illustrated Using Simulated Ecological Data’’, PLoS ONE 7(7) (2012) e41010.

Miranda Fricker, Epistemic Injustice: Power and the Ethics of Knowing (Oxford University Press, 2007).

Erik Hollnagel, David D. Woods and Nancy Leveson (eds), Resilience Engineering: Concepts and Precepts (Ashgate, 2006).

Erik Hollnagel, Safety-I and Safety-II: The Past and Future of Safety Management (Ashgate, 2014).

Andrew Hopkins, ``Thinking About Process Safety Indicators’’, Safety Science 47(4) (2009) 460–465.

Adam D. I. Kramer, Jamie E. Guillory and Jeffrey T. Hancock, ``Experimental Evidence of Massive-Scale Emotional Contagion Through Social Networks’’, Proceedings of the National Academy of Sciences 111(24) (2014) 8788–8790.

Christian Kuehn, ``A Mathematical Framework for Critical Transitions: Bifurcations, Fast–Slow Systems and Stochastic Dynamics’’, Physica D 240(12) (2011) 1020–1035.

Nancy G. Leveson, Engineering a Safer World: Systems Thinking Applied to Safety (MIT Press, 2011).

Jens Rasmussen, ``Risk Management in a Dynamic Society: A Modelling Problem’’, Safety Science 27(2–3) (1997) 183–213.

Marten Scheffer, Critical Transitions in Nature and Society (Princeton University Press, 2009).

Marten Scheffer et al., ``Early-Warning Signals for Critical Transitions’’, Nature 461 (2009) 53–59.

Marilyn Strathern, ``Improving Ratings: Audit in the British University System’’, European Review 5(3) (1997) 305–321.

Barry A. Turner, Man-Made Disasters (Wykeham Publications, 1978).

Barry A. Turner and Nick F. Pidgeon, Man-Made Disasters, 2nd edn (Butterworth-Heinemann, 1997).

Diane Vaughan, The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA (University of Chicago Press, 1996).

Christian Wissel, ``A Universal Law of the Characteristic Return Time Near Thresholds’’, Oecologia 65 (1984) 101–107.

David D. Woods, ``Four Concepts for Resilience and the Implications for the Future of Resilience Engineering’’, Reliability Engineering and System Safety 141 (2015) 5–9.