And these challenges are prompting organisations to reassess their approach, and consider whether their control frameworks are fit for purpose.

If we have:

• Policies and procedures to inform staff of the right way to do things.
• Training and Competency to ensure staff fully understand the requirements.
• Line management to oversee that the controls are being applied correctly.

Why are there breaches, QA fails and risks outside of tolerance? Why are the controls not working?

In far more challenging competitive and regulatory environment businesses are putting themselves at risk if they are not fundamentally reassessing their approach to control and oversight.

The homeostatic approach challenges the status quo of ‘fix follows failure’. It proposes a mindset and organisational shift to a position where threats (and opportunities) are identified more quickly, and addressing them becomes part of the BAU.

And by taking inspiration from this approach, businesses could become more self-aware, and self-correcting, and:

• Identify and correct problems, quicker.
• Implement change more effectively
• Free up Board and Exco time.
• Reduce regulatory risk.
• Gain greater clarity in the roles and responsibilities of the Three Lines of Defence.
• Achieve competitive advantage.

This system requires an interrelated network of sensors, controls, and effectors, which work in harmony to maintain balance.

What an organism feeds upon is negative entropy…An organism’s astonishing gift of concentrating a ‘stream of order’ on itself and thus escaping the decay into atomic chaos – of ‘drinking orderliness’ from a suitable environment

Erwin Schrödinger – What is life?24 hours a day, the autonomic system of the body monitors heart rate, oxygen concentration, glucose levels and many other vital functions. Messages are being received from nerves and sensors to indicate issues like – glucose concentrations being too high or oxygen levels too low. And systems within the body are taking prompt action to correct the imbalance and return the organism to a steady state – homeostasis.

It can be seen how this Stimulus/Sensor/Control/Effector model is analogous to the control framework and Three Lines of Defence model within a business – with management responding to incoming MI results, and taking action to correct issues.
However, the distinguishing factor of the homeostatic system, within the body, is that this control and self-correction activity is happening without active oversight. The pancreas automatically ‘knows’ to release glucagon when blood glucose levels are too low; the brain is not making a conscious decision to do so. Because if the brain were required to constantly adjust control of breathing, heart rate, and other functions, it would completely overwhelm the mind.

By ‘delegating’ these operational functions to the homeostatic system, the human body frees up brain capacity to: paint a landscape, compose a melody, achieve a desired objective.

To follow the analogy – if a business is over-expending resources on control and oversight; constantly fire-fighting, micro-managing and tying up Board/Exco focus on day-to-day operational issues, it simply does not have the bandwidth and capacity to effectively achieve its strategic objectives.

It is in the ability to rely more on the internal ‘sensor/control/effector’ systems, within operational areas, to effectively detect and correct issues – before senior management and Compliance need to get involved.

The homeostatic organisation doesn’t abandon controls and oversight, but it does expect more from its control and oversight systems.

To achieve this, businesses should seek deeper insights and ask harder questions of themselves. And whilst many of these hard questions will be directed at the operational areas of the business, they should also be asked at the Board/Exco level. Like:
Why do management teams who brook no compromise in their drive to achieve the annual sales targets, consistently accept mediocrity in the performance of their control frameworks?

As seen in the sections below, answering these questions and developing a homeostatic approach requires effort, but that effort delivers significant rewards.
And in an increasingly challenging regulatory environment businesses are putting themselves at greater risk if they are not fundamentally reassessing their approach to control and oversight.

The homeostatic organisation, in contrast, draws on a wide range of data and insights from internal and external sources, in order to understand the environment and its place within it.

Awareness – identify threats (and opportunities), in a timely manner

Action – bring issues of concern back within tolerance.

Adaption – change behaviour or approach, in response to the information received.

And it is the Adaption element which is most important. The homeostatic approach (despite its etymology) is not about remaining static and fixed in place. Businesses should be able to assess change, and respond to it – for example, regulatory change, or changes in the competitive landscape or market conditions. The homeostatic organisation uses effective horizon scanning to identify issues and enable it to take action in a proactive and timely manner.

Commercial organisations are much more complicated operations and require a monitoring framework that is commensurate with that complexity.

However, most organisations are still relying on readily available data and quantitative metrics. For example, businesses place an over-reliance on monitoring complaints MI, and using this as the primary assessment of customer outcomes. Complaints MI is a measurement of failure – the risk has already crystallised, and poor outcomes have already occurred. And those small number of customers who actually complain may be the tip of a much bigger iceberg.

In the MI, and in oversight activity, traditional businesses focus too much on simple binary measures and box-ticking compliance:

• We made the required information available to the customer – procedure.
• The agent said the words in the script – QA.
• We have a control in place – audit.

But, as with the Tom Peter’s quote above, a business should not expect to prosper if they are solely relying on a quantitative approach. In contrast, the homeostatic organisation uses qualitative control to gain deeper and richer insights into what is (and could be) happening, and what the actual outcomes of this may be.

And ever more challenging commercial and regulatory environments place a far greater expectation on businesses to undertake more subjective and nuanced assessments of their controls, and adopt qualitative assessments, alongside the traditional quantitative metrics.

Homeostatic organisations have a different mindset, and they use RCA to find and fix issues, across the whole operation.

The ‘how’ of applying RCA across the business requires effort (and there are a range of tools, techniques and frameworks to utilise). But the ‘why’ of doing it should be self-evident – it will enable the targeting of resources and focus on those underlying causes of the issues being identified.

In a homeostatic organisation, it is the staff who ‘effect’ change. And the ability of them to do so depends on their: capacity, capability and most importantly culture:

Capacity – Are there enough people to achieve the required objectives?

Capability – They are sufficiently trained & experienced?

Culture – Do they know ‘what good looks like’, understand the ‘why’ of the requirements, and are they sufficiently self-aware and self-correcting?

Effective organisations recognise that the people factors (and People Risk, in general) should be a primary focus, and that investing and developing staff will have benefits beyond any control framework.

But the Awareness/Action/Adaption model can be just as effective for capitalising on commercial opportunities – horizon scanning should be used to identify opportunities, not just threats. The 3Cs approach should utilise strengths not just mitigate weaknesses. And a more qualitative assessment of strategic initiatives is likely to deliver better outcomes.

And, most importantly, a business that is not tied up in fire-fighting, paying out customer redress, and explaining itself to the regulators is going to have far more capacity to drive revenue-generating activities.

And in developing a homeostatic system, it is in the 1st Line of Defence where most of the focus and effort will be devoted, and where most of the gains will be realised – to enable operational areas to become more self-aware of issues and concerns, and more self-correcting in their response to those issues. However, achieving this homeostatic system is also dependent on changes and improvements across the entire 3LoD.