Chris Clearfield and András Tilcsik’s Meltdown: Why Our Systems Fail and What We Can Do About It takes the theory of accidents that the sociologist Charles Perrow built after Three Mile Island and applies it to the systems that organisations now depend on: trading systems and stock exchanges, deep-water drilling rigs, dams, hospitals, newsrooms, social media and the ordinary machinery of a large company. Its argument has two halves. The first is a diagnosis. Systems fail in surprising ways when they are complex, so that their parts interact in ways nobody can see or predict, and tightly coupled, so that there is too little slack to stop a small failure from spreading; more and more of modern life sits in that combination, which the authors call the danger zone, and complexity also makes wrongdoing easier to hide. The second half is a set of remedies, most of them organisational rather than technical: designs that make problems visible, structured decision tools such as the premortem, attention to near misses and warning signs, cultures that welcome dissent, diverse teams, outsiders, and better preparation for surprise. For an internal auditor the book is useful twice over. Its cases are a catalogue of control failures in the places audit functions test, from Nasdaq’s handling of the Facebook listing to the signalling on the Washington Metro; and its remedies describe, in other words, much of what an independent assurance function is for. This guide summarises the book without reproducing it, checks its main cases against official records and contemporary reporting, maps its ideas to audit practice and ends with a worked example of a bank’s audit function applying them to its capital markets business.
In this guide
- The book in one page
- Who the authors are, and how the book came about
- The structure: a prologue, two parts and an epilogue
- The diagnosis: complexity, coupling and the danger zone
- The cases, checked against the record
- The remedies: seven ways out of the danger zone
- The nine ideas worth keeping
- The vocabulary: fourteen terms defined for practitioners
- What it means for internal audit: a control-by-control map
- The criticisms, and what the book leaves out
- Editions, subtitles and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Thornwick Bank maps its danger zone
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is it about? | Why modern systems fail in ways nobody predicted, and what organisations can do about it. Penguin Press published it in March 2018; it has a prologue, two parts (Failure All Around Us; Conquering Complexity), ten chapters and an epilogue. |
| Who wrote it? | Chris Clearfield, a former derivatives trader and licensed commercial pilot who founded the risk consultancy System Logic, and András Tilcsik, a management scholar at the University of Toronto’s Rotman School of Management who studies how organisations make decisions. |
| Where did it come from? | A proposal that won the 2015 Bracken Bower Prize, which the Financial Times and McKinsey award for the best business book proposal by an author under 35. |
| What is the diagnosis? | Perrow’s: systems are most dangerous when they are both complex and tightly coupled. The authors argue that more of the systems organisations depend on now sit in that danger zone, that safety features such as alarms and redundancy can add to the complexity, and that complexity makes fraud easier to hide. |
| What are the remedies? | Simplify and add slack where possible; design so that problems are visible; use structured tools such as premortems and predetermined criteria; learn from near misses; make dissent possible and soften the cues of power; diversify teams; bring in outsiders; and prepare for surprise. |
| Why read it as an auditor? | Because its cases are control failures in trading, technology, operations and governance, because its remedies are the disciplines an assurance function brings, and because it gives audit leaders a vocabulary for explaining to a board why a process with no history of losses can still be the riskiest thing the organisation runs. |
| Length | 294 pages in the US hardcover, with the notes and sources running from page 251 to page 286. |
Who the authors are, and how the book came about
Clearfield studied physics and biology at Harvard, traded derivatives for Jane Street in New York, Tokyo and Hong Kong, and is a licensed commercial pilot. He founded System Logic, a research and consulting firm on risk, and has written about complexity and failure for the Guardian, Forbes and the Harvard Business Review’s blog; he now coaches founder chief executives and has written a second book, The High-Altitude Entrepreneur. Tilcsik, who was born in Hungary, studies organisations and strategy at Rotman, where at the time of publication he was an associate professor of strategic management teaching a course on catastrophic failures in organisations; he has held the Canada Research Chair in Strategy, Organizations, and Society, and his academic work appears in sociology and management journals. One of his own papers bears directly on the book’s argument about expertise. In a 2016 study in the Academy of Management Journal, Tilcsik and Juan Almandoz followed 1,307 American community banks from 1996 to 2012 and found that a larger share of banking experts on a bank’s board made failure more likely when uncertainty was high, as when the bank was growing fast or operating in a less predictable market.
The book began as a proposal. In 2015 the pair won the Bracken Bower Prize with a proposal on understanding systemic risk and preventing catastrophic failure. According to McKinsey’s account, a publisher who had read an excerpt on the FT’s website contacted them the day after the prize dinner; rather than accept the first offer, they reworked the proposal for a wider readership with their agent, and in March 2016 they signed with Penguin for the United States and Canada, with deals for British, Chinese, Korean and other editions following. Penguin Press published the book on 20 March 2018 and Atlantic Books published the British edition on 5 April 2018. Its publisher describes it as one of the Financial Times’s best books of 2018; it won Canada’s National Business Book Award and, in 2019, the Thinkers50 Strategy Award for its authors.
The structure: a prologue, two parts and an epilogue
| Part | Chapters | What the part or chapter does | What it contributes |
|---|---|---|---|
| Prologue | A Day Like Any Other | Opens the book | The setting for the argument |
| Part One: Failure All Around Us | 1. The Danger Zone; 2. Deep Waters, New Horizons; 3. Hacking, Fraud, and All the News That’s Unfit to Print | Extends Perrow’s framework from nuclear plants and space missions to modern systems; as the chapter titles suggest, it moves from deep-water drilling to hacking, fraud and journalism | The diagnosis: complexity and coupling, and how complexity hides wrongdoing |
| Part Two: Conquering Complexity | 4. Out of the Danger Zone | Designing systems that are more transparent and more loosely coupled | Design remedies |
| 5. Complex Systems, Simple Tools | Structured decision tools, among them the premortem and predetermined criteria | Decision remedies | |
| 6. Reading the Writing on the Wall | Learning from near misses and warning signs | Learning remedies | |
| 7. The Anatomy of Dissent | Encouraging dissent and making it safe to speak up | Cultural remedies | |
| 8. The Speed Bump Effect | Diversity as a check that makes groups more sceptical | Composition remedies | |
| 9. Strangers in a Strange Land | Using outsiders to surface problems insiders cannot see | Independent challenge | |
| 10. Surprise! | Preparing for and responding to crises | Response remedies | |
| Epilogue | The Golden Age of Meltdowns | The authors’ view of the present era and why the remedies are hard to adopt | The conclusion |
The chapter titles are those of the US hardcover as recorded in its library catalogue entry; the British Library’s record of the Atlantic edition shows the same arrangement of a prologue, three chapters in Part One, seven in Part Two and an epilogue. The descriptions of Part Two’s chapters combine the chapter titles with the subjects reviewers report the book covering: design, decision tools, warning signs, dissent, diversity, outsiders and crisis response. Part One is described here as a whole, because the sources do not settle which case sits in which of its three chapters.
The diagnosis: complexity, coupling and the danger zone
The book’s starting point is Charles Perrow’s Normal Accidents of 1984, written after his work on the Three Mile Island accident, which argued that some accidents are a built-in feature of certain systems rather than freak events. Perrow sorted systems along two dimensions. Complexity describes how the parts interact: a complex system is nonlinear, and its parts are connected in ways that are hard to see. Coupling describes how much slack there is: in a tightly coupled system there is little slack between the parts, so that a failure in one spreads before anyone can intervene. A system that is both complex and tightly coupled will, sooner or later, produce a failure nobody anticipated, because the combination guarantees both surprise and speed. The Normal Accidents summary sets out Perrow’s theory in full.
Clearfield and Tilcsik’s contribution is to show how far the danger zone has spread since Perrow wrote. His examples were nuclear plants, chemical plants and space missions; theirs include Wall Street firms, universities, dams, oil rigs, social media and the growing population of connected devices, from cars that can be taken over remotely to medical implants. Two further points in their diagnosis matter for auditors. The first is that safety features can backfire: redundancies and alarms add complexity, and a system that warns about everything warns about nothing, a point the book illustrates with research in which intensive-care alarms sounded constantly and about nine in ten were false. Publishers Weekly’s reviewer singled out the related idea of the normalisation of deviance, in which people come to treat recurring warnings and small departures as normal. The second is that complexity does not only produce accidents. It makes misconduct easier to hide, which is why the book sets Enron’s accounting and Volkswagen’s emissions software beside its accidents: in both, the opacity of the system was the cover.
| Dimension | What it means | Signs in an organisation | The audit question |
|---|---|---|---|
| Complexity | Parts interact in hidden, nonlinear ways that are hard to see | Many interfaces, layered systems, manual workarounds, reports that summarise what nobody can inspect | Can anyone describe how this process behaves when one input is wrong? |
| Tight coupling | Little slack between parts; failures spread before people can act | Straight-through processing, overnight batch chains, real-time trading, just-in-time supply | How long between a failure and its consequence, and who can stop it? |
| The danger zone | High on both dimensions | Fast, automated, interconnected processes whose failures are rare and novel | Is the audit plan driven by loss history, which this zone does not have? |
| Safety features that backfire | Redundancy and alarms that add complexity | Alert queues mostly closed as false positives; duplicated controls nobody reconciles | What share of alerts lead to action, and are the important ones distinguishable? |
| Complexity as cover | Opacity makes wrongdoing easier to hide | Results nobody outside a small team can explain; accounting or code few people can read | Who outside the team can independently reproduce the result? |
The cases, checked against the record
The book’s cases range widely: reviewers list among them the fatal Washington Metro collision of 2009, Three Mile Island, Enron, Volkswagen, the Flint water crisis, Fukushima Daiichi, Deepwater Horizon, the 2017 Academy Awards, a Starbucks social media campaign taken over by critics, the fabrications of the journalist Jayson Blair, a fatal in-flight fire caused by mishandled oxygen generators, Target’s expansion into Canada, NASA’s Aviation Safety Reporting System and, less dramatically, a ruined Thanksgiving dinner and a family’s morning routine. The table checks the cases most relevant to auditors against official records and contemporary reporting. The facts in the table come from those sources, not from the book.
| Case | What the official record says | Why it matters to an auditor |
|---|---|---|
| Washington Metro, Red Line, 22 June 2009 | Train 112 struck the rear of train 214, which was stopped near Fort Totten; nine people on train 112 died, including the operator. The National Transportation Safety Board found that track circuit modules had failed, so the train control system lost sight of train 214, and that the transit authority had not adopted across its system an enhanced track circuit test developed after near-collisions at Rosslyn in 2005. Contributing factors included what the NTSB called the authority’s lack of a safety culture, and ineffective safety oversight by its board | A near miss that produced a test, and a test that was not adopted across the system: the learning existed and did not travel. The board’s oversight was itself a contributing factor |
| Nasdaq and the Facebook listing, 18 May 2012 | The SEC found that a validation check in Nasdaq’s IPO Cross system fell into a loop because cancellations kept arriving; Nasdaq switched to an untested failover configuration with the check removed and did not discuss cancelling or postponing the offering. More than 38,000 orders entered between 11:11 and 11:30 a.m. were left out of the cross, more than 30,000 of them stayed stuck until confirmations were sent at 1:49 p.m., and Nasdaq ended with a short position of more than 3 million shares, about $129 million, an error position the SEC found its rules did not permit. Nasdaq paid a $10 million penalty in May 2013 without admitting or denying the findings | A control removed under time pressure, in a configuration nobody had tested, in a tightly coupled market: the workaround, which those involved knew would leave an error position, turned a delay into stuck orders and an unwanted position |
| ValuJet Flight 592, 11 May 1996 | The DC-9 crashed into the Everglades about ten minutes after leaving Miami, killing all 110 people on board. The NTSB found that a cargo fire was started by chemical oxygen generators improperly carried as cargo, and cited the maintenance contractor’s failure to prepare and identify them, the airline’s failure to oversee its contract maintenance and the regulator’s failure to require detection and suppression in that class of cargo hold | A third-party failure that was also an oversight failure: the airline outsourced the work but not the responsibility |
| Deepwater Horizon, 20 April 2010 | The blowout and explosion at the Macondo well in the Gulf of Mexico killed eleven workers; the US Chemical Safety Board issued its final report on 20 April 2016 | Operating at the edge of technical experience magnifies both complexity and coupling |
| The 89th Academy Awards, 26 February 2017 | La La Land was announced as best picture; the winner was Moonlight. The presenters had been handed the duplicate envelope for best actress by a partner of the accounting firm that ran the ballot process, and the firm took full responsibility, saying that protocols for correcting the error had not been followed quickly enough | A simple process run by accountants still failed, through a duplicate envelope and a correction that came too slowly |
One case in the British publisher’s description of the book has grown much larger since the book appeared: Post Office software that, in 2018, had led to a multimillion-pound lawsuit. In December 2019 the High Court’s Horizon Issues judgment in the group litigation brought by more than 500 sub-postmasters found that bugs, errors and defects in the Horizon system created a significant and material risk of inaccuracy in branch accounts, and the litigation was settled for £57.75 million. On 23 April 2021 the Court of Appeal, in Hamilton and others v Post Office Ltd, quashed the convictions of 39 former sub-postmasters and dismissed three appeals. The Post Office (Horizon System) Offences Act 2024, which received Royal Assent on 24 May 2024, quashed convictions for the relevant offences in England and Wales and Northern Ireland. The statutory inquiry chaired by Sir Wyn Williams published the first volume of its final report, on the human impact of the scandal and on redress, on 8 July 2025, and its chair gave a progress update on the remaining volumes in July 2026. For an auditor the lesson is the one the book draws about complexity in general, sharpened: when an organisation treats a complex system’s output as more reliable than the people reporting that it is wrong, the system’s opacity becomes the organisation’s defence, and the people pay for it.
One of the book’s own cases belongs in every capital markets auditor’s memory, and the SEC’s files supply the details. On 1 August 2012 Knight Capital’s order router sent more than 4 million orders into the market in the first 45 minutes of trading while trying to fill 212 customer orders, traded more than 397 million shares and lost more than $460 million. The SEC’s order of October 2013 found that new code had been deployed to seven of the router’s eight servers; the eighth still carried a discontinued function, unused since 2003, that the new code reactivated; Knight had no written procedure requiring a second technician to review deployments; 97 automated emails flagging the error before the market opened were not acted on; and staff responding to the incident removed the new code from the servers that were working, which made matters worse. Knight paid $12 million in the first enforcement action under the SEC’s market access rule. Every element of the danger zone is there: a complex system nobody fully understood, coupled so tightly to the market that 45 minutes was enough to lose more than $460 million, and warnings that existed but did not reach anyone who could act.
The remedies: seven ways out of the danger zone
Part Two is the reason to read the book rather than a summary of Perrow. Its remedies are ordinary, and the authors argue that some of them work precisely because they are uncomfortable: they slow decisions down, invite disagreement or bring in people who do not share the group’s assumptions. The table sets out the seven, with the examples the sources attribute to the book and the use an auditor can make of each; the examples are placed against the remedy they illustrate, since the sources do not always say in which chapter they appear.
| Chapter | The remedy | Examples the sources attribute to the book | How an auditor uses it |
|---|---|---|---|
| 4. Out of the Danger Zone | Reduce complexity and add slack where possible; where not, design for transparency | Boeing’s prioritisation of cockpit alerts, with the most urgent reserved for a stall; the publisher’s promise that less polished designs can be safer | Test whether a system shows its state to its operators and whether its alerts are ranked |
| 5. Complex Systems, Simple Tools | Structured decision tools | The premortem, associated with Gary Klein, which uses prospective hindsight: imagine the project has failed and explain why; predetermined criteria in place of intuition for complex choices | Run a premortem before a major change; check that go and no-go criteria were set before the options were seen |
| 6. Reading the Writing on the Wall | Learn from near misses and small failures | NASA’s Aviation Safety Reporting System; the normalisation of deviance | Read the near-miss log for patterns, and test whether lessons from one site reach the others |
| 7. The Anatomy of Dissent | Make disagreement possible and useful | Leaders softening the cues of power so that people will raise concerns | Read committee minutes for recorded challenge; test escalation routes |
| 8. The Speed Bump Effect | Diversity of background and perspective | Homogeneous groups agree easily and are less sceptical; diversity slows the rush to consensus | Look at the composition of the teams and committees that approve high-risk decisions |
| 9. Strangers in a Strange Land | Use outsiders | People from outside a group surface problems insiders have stopped seeing | Independent challenge, rotation, and the audit function itself |
| 10. Surprise! | Prepare for and manage crises | Contingency plans that are realistic; responding effectively once a failure has started | Test crisis plans against a scenario the organisation has not rehearsed |
Two of the remedies have an audit lineage worth making explicit. NASA’s Aviation Safety Reporting System, which the book uses among its examples, rests on design choices an audit function can test for in any reporting scheme. The Federal Aviation Administration began the voluntary programme in April 1975 and NASA has run the reporting system since an agreement signed that August; NASA protects the identities of reporters and others involved, and under the FAA’s advisory circular a person who files a report within ten days of an inadvertent violation that involved no crime or accident and meets the circular’s other conditions will not face a civil penalty or certificate suspension. On the guide’s reading, confidentiality, limited immunity and a short deadline are what make people report the event that nearly happened, and their absence goes a long way to explaining why many company near-miss logs are thin. The premortem rests on research into prospective hindsight and has a direct audit use: run with a project team before go-live, it turns the auditor’s question about what could go wrong into a structured exercise the team owns. The incident response audit guide and the KRI programme guide cover the monitoring side, and the escalation ladder guide covers the dissent side.
The nine ideas worth keeping
- Complexity and coupling, not bad luck, produce the surprising failure. A process that is both opaque and fast will eventually fail in a way nobody predicted.
- The danger zone has little loss history. Its failures are rare and novel, so a risk assessment driven by past losses will rank it low until it fails.
- Safety features can add danger. Every alarm, override and redundant control adds interactions; an alert queue that is mostly false positives hides the true one.
- Complexity hides wrongdoing as well as error. Where few people can read the accounting or the code, fraud and accident share a hiding place.
- Transparency is a design choice. Systems that show their state, and rank their warnings, give people a chance to intervene.
- Decide criteria before seeing the options. Predetermined criteria and the premortem are cheap, and they work against the pressure of the moment.
- Near misses are free lessons. The Washington Metro had a test from an earlier near-collision; it was not used everywhere. Learning that does not travel is not learning.
- Dissent and diversity are controls. Groups that agree easily accept bad answers; a dissenting voice and a mixed background are speed bumps on the road to consensus.
- Outsiders see what insiders cannot. The independence of a challenger is worth more than familiarity with the subject, which is the case for internal audit in one sentence.
The vocabulary: fourteen terms defined for practitioners
| Term | What it means in the book | What it looks like in an audit |
|---|---|---|
| Complexity | Hidden, nonlinear interactions between parts of a system | A process whose behaviour under a bad input nobody can describe |
| Tight coupling | Little slack between parts; failures spread quickly | Straight-through processing with no point at which a human can stop it |
| Danger zone | The combination of high complexity and tight coupling | The processes to rank highest regardless of loss history |
| Normal accident | Perrow’s term for a failure that is a built-in feature of a complex, tightly coupled system | The incident whose root cause is the design of the system itself |
| Slack | Time, buffers and spare capacity that let people intervene | Cut-off times, reconciliation windows, manual holds |
| Transparency | Design that lets operators see the system’s state | Dashboards and screens that show what the system is doing, not what it was told to do |
| False alarms | Warnings that are mostly wrong, so that real ones are missed | Alert queues closed as false positives at high speed |
| Normalisation of deviance | Coming to treat recurring warnings and departures as normal | The exception that is “always like that” |
| Premortem | Imagining a project has failed and explaining why, before it starts | A planning exercise before a migration or launch |
| Predetermined criteria | Decision criteria fixed before options are assessed | Go and no-go criteria documented before testing results arrive |
| Dissent | Disagreement that is invited and heard | Minutes that record challenge and its outcome |
| Power cues | Signals of status that discourage people from speaking up | The junior analyst who saw the problem and said nothing |
| Speed bump | The book’s image for how diversity slows a group’s rush to agreement | A committee member from a different discipline who asks the basic question |
| Outsider | A person from outside the group who sees what insiders do not | Guest auditors, rotation, and the independent function itself |
What it means for internal audit: a control-by-control map
The book is not written for auditors, but its framework answers a question audit leaders face every planning season: how to rank a process that has never failed. A loss-driven risk assessment ranks the danger zone low because its failures are rare; the book’s framework ranks it high because its failures, when they come, are fast and novel. The table maps the ideas to the audit work they change. The trading floor controls guide, the IT change management audit guide and the operational risk guide carry the detailed procedures. In May 2018, two months after the book appeared, the chief risk officer of the Federal Reserve Bank of New York made a related case to a risk conference, setting Perrow’s normal accident model beside other accident models and recommending that complex, tightly coupled processes be simplified and their controls designed rather than accumulated.
| Audit activity | What the book implies | Procedure it changes |
|---|---|---|
| Risk assessment and planning | The danger zone has little loss history and should be ranked on complexity and coupling | Score each auditable process on both dimensions alongside inherent risk; see the risk assessment guide |
| Trading and market access controls | Tightly coupled automated systems can do great damage in minutes | Test pre-trade limits, automated blocks and the ability to stop trading; see the trading floor controls guide |
| IT change and release | Changes made under pressure, in untested configurations, can do more damage than the fault they were meant to fix | Test deployment review, configuration consistency across servers and rollback rehearsal; see the SDLC and DevOps audit guide |
| Incident and near-miss management | Near misses are cheap lessons that must travel | Trace one near miss to the change it produced and test whether the change was applied everywhere |
| Alert and monitoring design | False alarms hide real ones | Measure the share of alerts actioned and the time taken to close; check that alerts are ranked; see the continuous auditing and monitoring guide |
| Board and committee effectiveness | Homogeneous groups agree too easily; in Tilcsik’s bank research, expert-heavy boards were more likely to fail under uncertainty | Review the mix of backgrounds on committees that approve high-risk decisions; see the audit committee effectiveness guide |
| Escalation and challenge | Dissent is a control; power cues suppress it | Read committee minutes for recorded challenge; interview junior staff on escalation; see the escalation ladder guide |
| Third parties and outsourcing | Outsourcing work does not outsource responsibility | Test oversight of critical contractors, not only their contracts; see the third-party risk guide |
One caution belongs beside the map. The book’s remedies are mostly management’s to adopt; an audit function that runs the premortem, writes the predetermined criteria and designs the alert ranking has taken on the work it should be assuring. The audit role is to test whether these disciplines exist and work, to use them in its own planning, and, where management asks, to facilitate them as advisory work; the guide to assurance and advisory work sets out the difference between the two roles.
The criticisms, and what the book leaves out
Reviewers raised three criticisms when the book appeared. Kirkus Reviews observed that its core argument is not new, since it builds heavily on Perrow, and that some of its examples are less well remembered than others; it also flagged the authors’ claims about diversity training as controversial. Publishers Weekly found the analysis insightful but the advice on reducing complexity and adding slack too vague to put into practice, and the remedies fairly modest. Theodore Kinni in strategy+business, who otherwise praised the book, thought that in places the chapters carried rather more stories and research than they needed, so that the point was partly buried.
Three further limitations, on the guide’s reading, matter more to an auditor. The first is measurement: placing a process on the two dimensions is a matter of judgement, and an audit function that wants to rank its universe this way has to build and document its own scoring. The second is that it reads its cases with the outcome known. Every warning sign is clear in retrospect, and the harder question, which of today’s hundred warnings is the one that matters, gets less attention than it deserves; an auditor who has read Sidney Dekker on hindsight will notice. The third is that it puts accidents and fraud in one frame. Complexity does help both to hide, but the controls differ: an accident is prevented by visibility and slack, a fraud by independent verification of the thing the fraudster controls, and the fraud risk guide covers the second. None of this reduces the book’s value as a planning tool. It marks where the auditor has to add method to the book’s insight.
Editions, subtitles and how to read it
| What | Details | Best for |
|---|---|---|
| US hardcover | Penguin Press, New York, 20 March 2018; 294 pages; subtitle Why Our Systems Fail and What We Can Do About It | The first edition |
| British edition | Atlantic Books, London, 5 April 2018, in paperback; same subtitle | UK readers |
| US paperback | Penguin, 19 March 2019; new subtitle What Plane Crashes, Oil Spills, and Dumb Business Decisions Can Teach Us About How to Succeed at Work and at Home | The same book under a different subtitle; cite the edition you used |
| Reading plan | Part One quickly for the diagnosis; chapters 5, 6 and 7 slowly; chapter 8 before the next board effectiveness review | An audit manager with two evenings |
| Companion reading | The Normal Accidents summary for the theory; the When Genius Failed summary for a tightly coupled fund; the Phoenix Project summary for the delivery side of IT change; the Black Swan summary for rare events | Placing the argument |
A one-hour discussion guide for an audit team
- Ten minutes: the map. List the organisation’s twenty most important processes and place each on a two-by-two of complexity and coupling. Circle the ones in the danger zone.
- Fifteen minutes: the plan. Compare the circled processes with the current audit plan and the last three years of coverage. Note any danger-zone process that has not been audited because it has never lost money.
- Ten minutes: the alarms. Choose one monitoring or surveillance process and find out what share of its alerts lead to action. If the answer is not known, that is the first finding.
- Fifteen minutes: a premortem. Take the largest change the organisation will make next year and spend ten minutes writing, individually, the story of how it failed. Compare the stories with the project’s risk log.
- Ten minutes: the challengers. Name the committees that approve the organisation’s riskiest decisions and the backgrounds of their members. Decide whether the composition question belongs in the next governance review; the corporate governance audit guide gives the frame.
Worked example: Thornwick Bank maps its danger zone
Thornwick Bank is a fictional US regional bank with $62 billion of assets, a capital markets business that serves corporate clients in fixed income, foreign exchange and interest rate derivatives, a broker-dealer subsidiary with market access, and an internal audit function of twenty-four. Its audit universe had always ranked capital markets processes by loss history, regulatory findings and size, and on those measures most of them scored as moderate risk, because few had ever produced a loss. For the 2027 plan the chief audit executive asked the capital markets audit team to rescore the fourteen processes in that part of the universe on complexity and coupling as well, and to run four tests suggested by the framework before finalising the plan.
| Test | What the function found | Result |
|---|---|---|
| Where is the danger zone? | Four of the fourteen processes scored high on both dimensions: the broker-dealer’s electronic order routing, end-of-day collateral and margin calls, trade surveillance alerting, and a migration of the fixed income trading platform planned for the third quarter of 2027. Two of the four had not been audited in three years | The four moved to the top of the capital markets plan; two audits brought forward into 2027 |
| What does the project think could go wrong? | A premortem with the migration project team produced 23 failure stories; three were not in the project risk log: stale reference data at cut-over, routing logic left active on a legacy server, and no agreed criteria for rolling back | Finding: go, no-go and rollback criteria to be set and approved before testing results arrive; rollback to be rehearsed |
| Do the alarms work? | Trade surveillance generated about 4,100 alerts a month, of which 96 percent were closed as false positives, many in under two minutes; alerts were not ranked by severity | Finding: alert ranking and tuning, and a quality review of a sample of closed alerts each month |
| Do near misses travel? | The operations error log recorded 31 trade-booking errors in 2026 that caused no loss; none had been reviewed for patterns, and five shared one cause, a manual override of a pricing feed | Finding: monthly review of no-loss errors, and a change to the override control |
| Is there challenge? | Twelve months of minutes of the capital markets risk committee recorded one instance of challenge to a business proposal; in interviews, junior risk staff said they raised concerns informally rather than in the meeting | Observation: the committee chair to invite dissent before the business presents, and minutes to record challenge and its outcome |
The review of the plan produced three findings and an observation before a single audit had started, and the audit committee asked for the complexity and coupling scores to become a standing part of the annual risk assessment. The chief audit executive also raised the composition question with the board’s governance committee, noting that every member of the board risk committee had spent a career in banking and that the bank’s two most complex technology changes would fall in the coming year. The committee added a director with an operations and technology background at the next appointment cycle, which was its decision rather than audit’s, and the audit report recorded only the observation that prompted it.
The function changed its own methods as well. Its engagement planning template for capital markets and technology audits now includes a short premortem with the audit team, and its follow-up procedures test whether a remediation applied in one business has been applied in the others, which was the gap the near-miss test exposed. The capital markets audit director’s summary to the committee was that the plan had been ranking processes by how often they had failed, and the new plan ranked them by how badly they could. The example is fictional; the shift it describes, from history to structure, is the practical value of the framework for any audit function with automated, interconnected operations.
Frequently asked questions
Is Meltdown just Normal Accidents brought up to date?
It builds on Perrow, as reviewers noted, but adds two things. It extends the framework to systems Perrow did not consider, from trading and social media to connected devices, and it spends most of its length on remedies. The Normal Accidents summary covers the original theory.
What is the danger zone?
The combination of high complexity, where parts interact in ways that are hard to see, and tight coupling, where there is too little slack to stop a failure spreading. Systems in the zone fail rarely, unexpectedly and fast, which is why loss history is a poor guide to their risk.
What is a premortem, and can auditors use one?
An exercise in which a team imagines that a project has failed and writes down why, before it starts; it is associated with Gary Klein. Auditors can use it in planning complex engagements and can test whether management used one before a major change, but should not own management’s premortem.
Why does the book say diversity reduces failure?
Because groups whose members share a background agree too easily and are less sceptical of each other’s answers; diversity slows the rush to consensus, which the book calls the speed bump effect. Tilcsik’s separate research on community bank boards found that expert-heavy boards were more likely to fail under high uncertainty.
Which subtitle is correct?
Both. The US hardcover and the British edition of 2018 are subtitled Why Our Systems Fail and What We Can Do About It; the US paperback of 2019 carries a different subtitle beginning What Plane Crashes, Oil Spills, and Dumb Business Decisions Can Teach Us. Cite the edition you read.
What should an auditor read alongside it?
The Normal Accidents summary for the theory and the When Genius Failed summary for a tightly coupled failure in finance; the internal audit reading list sets out the wider library by theme.
Related guides
- Normal Accidents by Charles Perrow: Summary and Lessons for Auditors — the theory the book extends
- Auditing Trading Floor Controls: Limits, Confirmations, and the Rogue Trader Playbook — controls for a tightly coupled business
- How to Audit IT Change Management: From Ticket to Production — where changes under pressure go wrong
- Operational Risk Guide for Internal Auditors (2026) — incidents, near misses and loss events
- Designing a KRI Program: From Metric Wishlist to Early Warning System — warning signs that reach someone who can act
- The Escalation Ladder: When and How to Go Over Someone’s Head — dissent as a working control
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
- The Field Guide to Understanding ‘Human Error’ by Sidney Dekker: Summary for Auditors — incident investigation beyond blame
Leave a Reply