Bad apple: Difference between revisions

{{a|systems|{{image|bad apple|jpg|}}}}{{dpn|/bæd ˈæpl/|n|}}{{C|newsletter draft}}One of those mischievous human imps occupying unobserved crevices in the great steampunk machine who, by their human frailty, ruin the best-laid plans of the machines.

On the conventional wisdom, [[bad apple]]s are the sole remaining fly in the ointment separating us from the sunlit uplands of [[financial services utopia]] that our patient labours by now have surely earned. Once the last bad apple has been rooted out all will be well in perpetuity.

It’s not clear what we’ll all then ''do'', but this is but a quibble.

The JC ponders human nature a lot, as you know. He wonders whether we should be quite so credulous. Is not the barrel of bad apples bottomless? Aren’t ''bad apples just gonna be bad''?  

Would we not be better worrying less about ''curing'' humans of their nature, and more about ''neutralising'' its unwanted effects?  

For there will ''always'' be bad apples, and they will always seek out, find and exploit [[Zero-day vulnerability|zero-day flaws]] in the system. We should expect this, because it is in their — ''our'' —nature. what ''which is [[Air crashes v financial crashes|This is what bad apples do]]''.  

Bad apples will find [[Zero-day vulnerability|zero-day vulnerabilities]] exactly where the system least expects them, and is therefore paying least attention: ostensibly harmless, sleepy backwaters. [[LIBOR]] submissions. [[Enron|The accounting department]]. The [[Kweku Abodoli|Delta-one index swaps desk]]. In a [[Archegos|family office]].

The question is not where are all the bad apples as much as where are all the zero-day vulnerabilities they will surely exploit?  

And the more byzantine, multi-dimensional, formalised, technology-overlaid and ''complex'' our system becomes, the more vulnerabilities it will have, and the harder it will be to find them, should they start playing up.

Leaving it to “the system” to detect and destroy bad apples — by policy attestation, outsourced compliance personnel in Manila reading from [[playbook]], “[[Chatbot|A.I.-powered]]” software applications — is the Bond villain’s way of despatching an enemy: you tie it up and leave it unattended while a nasty-looking, but plainly fallible, clockwork machine counts down from a thousand.

In the meantime these elaborate risk control systems tend to snare peaceable, but ignorant, citizens as they go about their quotidian day, while the bad apples, wise to the ways of the world, have already worked out the flaws and work-arounds.

The regrettable thing about bad apples is this: they have a habit of looking like boring functionaries, or even the good guys, right up to the moment that they don’t.

Before you know it’s a bad apple, a ''good'' bad apple doesn’t ''look'' like a bad apple. ''Bad'' bad apples ''look like'' bad apples, so they quickly get rooted out by good apples. Even a bad good apple can spot a bad bad apple.  

Hence, our controversial proposal: A bad apple that doesn’t ''look'' like a bad apple ''isn’t a bad apple''.

So it seems to us it won’t really do to say we must be better at spotting bad apples — thereby spreading by association the stigma of bad appledom on those mediocre apples who failed to spot them. ''Why'' did they not notice perfidy going on around them? Are they on commonly stupid, or or have their bad apple detectors somehow been disarmed?

Asking searching questions is not how modernist organisations like to work.

In any case the Opco will methodically plough through each risk function’s slides, which will all tell the same story: in the main, plain sailing, but with the odd fixable glitch in process — the inevitable snags of modern financial services — and a remediation plan for how they will be resolved. All kinds of metrics will be presented, analysed, and set out in voluminous graphs, charts and data tables. There may be a dashboard of “high risk” situations, derived from these metrics, but its [[RAG]] array will read uniform green — perhaps studded with the odd amber, for the sake of plausibility — hazards in the form of easily-addressed talking points included “for good order” and with confident denials of elevated risk of loss.  

It will be like this because we are enculturated to be always in control, for all systems to be go, all processes in good standing, all engines ticking over without significant strain. We tell ourselves that as long as this is so, we are safe. We have been acclimatised to believe that the greatest sin is ''to'' ''disrespect'' ''[[process]]''.

But what good is a risk report designed to tell you everything is under control? What real-world function does this fulfil?

You ask, “did [[Malachite]] appear on any risk reports in the two years leading up to its collapse? Did [[Archegos]]? Did [[Amaranth]]?” We ''hope'' the answer here is “no,” because ''that means there’s a bad apple''.  if it were “yes,” and no-one intervened, then ''the system has broken down''.  

But these are rhetorical questions, and you don’t ask them lest ''you'' become the bad apple.

=== The Opco reimagined ===

Imagine if the Opco’s standing agenda were instead to ask open questions, not designed for assurance that all is well, but to put up for discussion the things that might be not.

Have all risk control and business groups discuss these observations ''together''. Do it in person. No [[Microsoft PowerPoint|deck]]<nowiki/>s, no BlackBerries, no-one phoning in. No interruptions. Put on lunch. No bullying. Open minds. Require everyone to engage. Everyone should contribute. Every one should know each others fundamental parameters. Everyone should be interested.