To Insure Promptitude

To overtip is to appear an ass: to undertip is to appear an even greater ass

Today we are exploring the world of tipping and seeing whether a link can be drawn between the underlying rationale for tipping and the improvement of an organisation’s control environment.

Given that tipping is most prevalent in the United States – join Honestly Lay Bare as we walk the halls of the American dining experience.

***

Each year American diners hand over some $42 billion in tips at the nation’s full-service restaurants, which employ 2.6 million waiters, most of whom rely on tips for the bulk of their incomes.

While anxieties surrounding tipping abound — Is 15 percent enough? 20? — studies show that Americans overwhelmingly prefer this discretionary system to a set service charge, which is common in Europe and many other parts of the world.

Tipping, its defenders say, improves service by rewarding good waiters and punishing bad ones. But that’s not what is necessarily seen when you look out on a dining floor. It is argued that working for tips encourages selfishness rather than teamwork. Moreover, good service is not always rewarded with a big tip, nor bad service with a poor one.

***

Tipping was imported from Europe, and when it arrived in America, it met with impassioned and organized opposition.

While the precise origin of tipping is uncertain, it is commonly traced to Tudor England, according to “Tipping,” Kerry Segrave’s history of the custom.

By the 17th century, it was expected that overnight guests to private homes would provide sums of money, known as vails, to the host’s servants. Soon after, customers began tipping in London coffeehouses and other commercial establishments.

One frequented by Samuel Johnson had a bowl printed with the words “To Insure Promptitude,” and some speculate that “tip” is an acronym for this phrase.

Tipping began as an aristocratic practice, a sprinkle of change for social inferiors, and it quickly spread among the upper classes of Europe.

After the Civil War, wealthy Americans began traveling to Europe in significant numbers, and they brought the tip home with them to demonstrate their worldliness.

But the United States, unlike Europe, had no aristocratic tradition, and as tipping spread — like “evil insects and weeds,” The New York Times claimed in 1897 — many thought it was antithetical to American democratic ideals.

Opposition to tipping was not limited to the media.

In 1904, the Anti-Tipping Society of America sprang up in Georgia, and its 100,000 members signed pledges not to tip anyone for a year.

Leagues of traveling salesmen opposed the tip, as did most labor unions. In 1909, Washington became the first of six states to pass an anti-tipping law. But tipping persisted. The new laws rarely were enforced, and when they were, they did not hold up in court. By 1926, every anti-tipping law had been repealed.

Meanwhile, Europe was rethinking its devotion to the custom.

The 1943 Catering Wages Act in Britain established a minimum wage for service employees that helped decrease their reliance on tips. And in 1955, France passed a law requiring its restaurants to add a service charge (“service compris”) to each bill, a practice that has become the norm for most of the continent. By then, the anti-tipping movement had all but vanished in the United States.

Economists have struggled to explain tipping.

Why tip at all, since the bill is presented at the end of a meal and can’t retroactively improve service?

And certainly there’s no reason to tip at a restaurant you will never revisit.

The single most important factor in determining the amount of a tip is the size of the bill.

Diners generally tip the same percentage no matter the quality of the service and no matter the setting. They do so, Lynn says, largely because it’s expected and diners fear social disapproval.

“It is embarrassing to have another person wait on you,” the psychologist Ernest Dichter told a magazine reporter in 1960. “The need to pay, psychologically, for the guilt involved in the unequal relationship is so strong that very few are able to ignore it.”

Ego needs also play a part, especially when it comes to overtipping, according to the Israeli social psychologist Boas Shamir.

These psychological factors also go a long way in explaining the steady rise of the average tip in the United States from 10 percent in the early 20th century to 18.9 percent today, with little regional variation.

***

If it were possible to invent a tipping like mechanism within an organisation for deeds that minimized risk and / or improved the internal control environment would it work?

If it was to be the same as a tip it could only be paid retrospectively and would be commensurate to the event over which you have authority.

Guess what – the tipping mechanism already exists. It is called a bonus.

Has the existence of a bonus improved the overall risk profile of an organisation?

With the events of the last couple of weeks there is ample evidence to suggest that – just as the Anti-Tipping Society of America envisaged – the concept of tipping rewards (paying bonuses) rewards poor effort more than it encourages good effort.

(Post based in part on Why Tip? By Paul Watcher. New York Times Magazine October 12, 2008)

In the Clouds

Ask any five IT specialists what cloud computing is, and you’re likely to get five different answers.

Cloud computing is the latest, broadest development in a trend that's been growing for years.

Cloud computing is the most recent successor to grid computing, utility computing, virtualization and clustering.

Cloud computing overlaps those concepts but has its own meaning: the ability to connect to software and data on the Internet (the cloud) instead of on your hard drive or local network.

To do anything with a PC 10 years ago, you needed to buy and install software.

Now, cloud computing allows users to access programs and resources across the Internet as if they were on their own machines

***

Cloud computing describes a system where users can connect to a vast network of computing resources, data and servers that reside somewhere "out there," usually on the Internet, rather than on a local machine or a LAN or in a data center.

Cloud computing can give on- demand access to supercomputer-level power, even from a thin client or mobile device such as a smart phone or laptop.

First, there were mainframe computers, then minicomputers, PCs and servers.

As computers became physically smaller and resources more distributed, problems sometimes arose when users needed more computing power.

IT specialists tried clustering computers, allowing them to talk with one another and balance computing loads.

Users didn't care which processing unit ran their program, and cluster software managed everything.

But clustering proved to be difficult and expensive.

In the early 1990s, the grid concept emerged: Users could connect to a network, much as they plugged into the electrical power grid, and use service on a metered-utility basis.

Thus, people began speaking of utility computing.

One problem was where data was stored.

Grid nodes could be located anywhere in the world, but there could be significant processing delays while data stored at other locations was transmitted.

Also, grid or cloud computing means users and businesses must migrate their applications and data to a third party or different platform.

For enterprises with huge investments in existing software and operational procedures, this has been a real barrier to adoption of these shared technologies.

Other significant concerns include data security and confidentiality.

Critical to the success of cloud computing has been the growth of virtualization, allowing one computer to act as if it were another -- or many others.

Server virtualization lets clouds support more applications than traditional computing grids, hosting various kinds of middleware on virtual machines throughout the cloud.

***

There are several generally accepted benefits of cloud computing:

• Capital expenditure is minimized and thus there are low barrier to entry as infrastructure is owned by the provider and does not need to be purchased for one-time or infrequent intensive computing tasks.
  
  
• Device and location independence which enables users to access systems regardless of location or what device they are using (eg PC, mobile).
  
  
• Multitenancy enabling sharing of resources (and costs) among a large pool of users, allowing for centralization of infrastructure in areas with lower costs (eg real estate, electricity) / peak-load capacity increases (users need not engineer for highest possible load levels) and utilization and efficiency improvements for systems that are often underutilised.
  
  
• Reliability by way of multiple redundant sites, which makes it suitable for business continuity and disaster recovery,however IT and business managers are able to do little when an outage hits them. Historical data on cloud outages is tracked in the Cloud Computing Incidents Database.
  
  
• Scalability which meets changing user demands quickly, without having to engineer for peak loads. Massive scalability and large user bases are common but not an absolute requirement.
  
  
• Security which typically improves due to centralization of data, increased security-focused resources, etc. but which raises concerns about loss of control over certain sensitive data. Accesses are typically logged but accessing the audit logs themselves can be difficult or impossible.

***

Google is at the same time one of the strongest proponents of cloud computing and been seen to unfairly exploiting for its commercial advantage the boundaries of where cloud computing may lead.

Cloud neutrality raises the idea of to what extent should we say that whatever protections and privacy I have with regard to data on my computer, I should have the same protection with regard to data in the cloud.

Portability is the idea that your information, your documents, your images belong to you and you can pick them up and take them somewhere else.

That may not be possible if you're floating in a cloud controlled by Google. Every time you use one of Google's products, you have to sign a contract. And when you agree, you're giving away some important rights.

When Google released its new Chrome Web browser, just a few weeks ago, not everyone who consented to Google's contract would have understood the fine print.

Part of Clause 11 read that Google gets - Perpetual, irrevocable, worldwide, royalty-free and non-exclusive licence to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any content.

The clause went on to state that it could distribute the content to 'other companies, organisations and individuals' and even 'change or modify the content for technical purposes.'

Savvy internet users realised what this clause meant.

Google would legally have the right to do anything with what you did on the internet through their browser.

Your passwords, anything you wrote in emails, music, songs, poetry, videos, Google could pass them on without telling you, to any number of third parties, or do what they like with it.

Google's explanation was that this was all just 'lawyer-speak'.

They simply needed permission from users to display their content to the wider world.

There was uproar.

Goggle backed down after one day, and withdrew all four paragraphs of Clause 11 and replaced it with one sentence.

That sentence basically says, the Chrome user, not Google, has rights to all content.

Welcome to the first, biggest and most important battle ground of cloud computing – privacy.

(Post is based in part on QuickStudy: Cloud Computing by Russell Kay Computerworld 8th May 2008 and Cloud Computing Background Briefing ABC Radio National 14 September 2008)

Distress and Her Callings

I wish I understood

It used to be so nice, it used to be so good

So when you're near me, darling can't you hear me

SOS

The turmoil in world financial markets over recent weeks has had Honestly Lay Bare thinking about stress and distress.

Or more precisely distress signals.

We as risk / internal controls / governance professionals have many things at our disposal but one thing we don’t have is a common, universally understood and respected signal to call out the distress (or otherwise) of the frameworks that we are called upon to develop, review or dismantle.

It is time for the Governance Distress Call.

***

The first use of wireless in communicating the need for assistance came in March of 1899.

The East Goodwin Lightship, marking the southeastern English coast, was rammed in a fog in the early morning hours by the SS R. F. Matthews.

A distress call was transmitted to a shore station at South Foreland and help was dispatched.

By 1904 there were many Trans-Atlantic British ships equipped with wireless.

The wireless operators came from the ranks of railroad and postal telegraphers.

In England a general call on the landline wire was a "CQ." "CQ" preceded time signals and special notices.

"CQ" was generally adopted by telegraph and cable stations all over the world.

At the first international congress of wireless telegraphy in 1903, the Italians recommended the use of "SSSDDD" to signal an emergency.

"D" had previously been used internationally as the signal for an urgent message.

The origin of "S" is not known, but it may have come from the first letter of the word ship, indicating a ship in distress.

The sending of "SSSDDD" would signal all other stations to stop sending and leave the channel open for emergency traffic.

Though discussed, it was not adopted.

Deciding on a distress signal was put on the agenda for the next meeting in 1906.

"DDD" would later be adopted for the silent signal, indicating all stations must cease sending.

In 1904, the Marconi company filled the gap by suggesting the use of "CQD" for a distress signal.

It was generally accepted to mean, "Come Quick Danger," that is not the case.

It is a general call, "CQ," followed by "D," meaning distress.

A strict interpretation would be "All stations, Distress."

At the second Berlin Radiotelegraphic Conference of 1906, the subject of a distress signal was again addressed.

The distress signal chosen was "SOS." (The American distress signal "NC" for "Call for help without delay" was not adopted, although it remains as the international flag symbol for distress to this day.)

Unfortunately, the 1906 Conference proceedings do not give an account of the discussions nor the origin of SOS.

The proceedings merely specify what the signal will be.

In the Service Regulations Affixed to the International Wireless Telegraph Convention, paragraph 6a, "Signals of Transmission" simply states: "Ships in distress shall use the following signal: ...---... repeated at brief intervals."

There is no mention or reference to SOS meaning “save our souls”.

***

A Mayday situation is one in which a vessel, aircraft, vehicle, or person is in grave and imminent danger and requires immediate assistance.

Mayday calls can be made on any voice frequency, and when a mayday call is made no other radio traffic is permitted except to assist in the emergency.

A mayday call may only be made when life or craft is in imminent danger of death or destruction.

The "Mayday" distress signal was devised by Frederick Stanley Mockford, born in 1897 in the East Sussex village of Selmeston.

While he was senior radio officer at Croydon airport in 1923, he was asked to think up a word that would indicate distress and would easily be understood by all pilots and ground staff in an emergency.

As much of the traffic at the time was between Croydon and Le Bourget (Paris) he proposed the word "Mayday" from the French "m'aidez" (to help me).

It was this acknowledgement of a French word that also sounded like an English word that proved acceptable to both the French and English authorities.

***
So what would the Governance Distress Call look (sound?) like?

Firstly is such a Distress Call necessary?

There are two schools of thought here – yes in the sense it allows interested spectators to objectively measure the risk / control environments within differing organisations against a universal measure of distress or success.

No from the perspective that such a measurement process already exists by virtue of (with public companies) the pricing of the underlying stock.

Assuming that the Distress Call is necessary what exactly is it?

Whilst nearly not (OK – not at all close) as romantic as the stories behind SOS and Mayday, Honestly Lay Bare proposes the following as the highest level of Governance Distress Call:

Serious corporate governance, risk management or internal control issue highlighting a realised risk that has resulted in or a potential risk that may lead to substantial losses by the business unit / process being reviewed. Immediate management attention and remedial action is required.

***

To borrow from Victor Hugo … all the forces in the world are not so powerful as an idea whose time has come.

This idea’s time has come.

To SOS and Mayday now add GDC – the Governance Distress Call.

The Crimes of Michael Cantrell

We just paid for meaningless work … and there was so little oversight that no one noticed.

Honestly Lay Bare loves a good fraud / conflict of interest story.

They don’t come much better than the story of how a little-known, midlevel United States Defense Department insider who spent his whole career in Alabama collected $1.6 million dollars in kickbacks turning America’s missile defense program into a personal cash machine.

This is the story of Michael Cantrell.

***

Michael Cantrell, an engineer at the Army Space and Missile Defense Command headquarters in Huntsville, Alabama., along with his deputy, Doug Ennis, had lined up millions of dollars from Congress for defense companies.

Now, Mr. Cantrell decided, it was time to take a cut.

“The contractors are making a killing,” Mr. Cantrell recalled thinking at the meeting, in 2000.

“The lobbyists are getting their fees, and the contractors and lobbyists are writing out campaign checks to the politicians. Everybody is making money here — except us.”

Within months, Mr. Cantrell began getting personal checks from contractors and later returned to the airport with Mr. Ennis to pick up a briefcase stuffed with $75,000.

The two men eventually collected more than $1.6 million in kickbacks, through 2007, prompting them to plead guilty this year to corruption charges.

Mr. Cantrell worked in a division that was a small part of the national missile defense program.

Determined to save his job, he often bypassed his bosses and broke department rules to make his case on with legislators. He enlisted contractors to pitch projects that would keep the dollars flowing and paid lobbyists to ease them through. He cultivated lawmakers, who were eager to send money back home or to favored contractors and did not ask many questions.

And when he ran into trouble, he could count on his powerful friends for protection from Pentagon officials who provided little oversight and were afraid of alienating lawmakers.

The national missile defense program has cost the United States more than $110 billion since President Ronald Reagan unveiled his Star Wars plan 25 years ago.

Today, the missile defense effort is the Pentagon’s single biggest procurement program.

***

Towering over the highway near the entrance to Huntsville is a replica of the Saturn V rocket, the powerful missile that lifted the first man to the moon. Created in Huntsville, it is a fitting icon for this once-sleepy cotton mill town, now so dominated by the aerospace industry that it is nicknamed Rocket City.

An estimated 18,000 uniformed and civilian federal employees work in the aerospace industry in the Huntsville area today, augmented by about 40,000 others, who work for federal contractors.

Michael Cantrell grew up on a dairy farm nearby, listening to the rumble of rocket test flights. As a young engineer, he became a civilian employee of the Army and quickly impressed his bosses.

By 1990, Mr. Cantrell, then 35, took over an experimental program to develop faster, cheaper and lighter missiles that could intercept and knock out enemy missiles flying within the atmosphere.

Under the Reagan administration, money was plentiful for such research, but with the fall of the Soviet Union and the arrival of the Clinton administration, Pentagon bosses were forced to make budget cuts.

Like other Army employees, Mr. Cantrell was prohibited from lobbying or even visiting Capitol Hill unless he had permission from his agency’s Congressional liaison, a prohibition intended to block employees from promoting initiatives that Pentagon leaders did not see as a priority.

Soon enough, Army missile program managers started opening what amounted to their own lobbying shops in Washington, according to Mr. Cantrell and his former supervisors.

Mr. Cantrell became a regular on Capitol Hill, both in the halls of Congress and in the bars and restaurants where Hill staffers gather after hours. He set up a makeshift office in the US Airways lounge at Reagan National Airport, where he followed up on pitches for money to lawmakers and hid out from his Defense Department bosses.

He identified lobbyists who could prove useful and contractors — many of them campaign donors — with projects that needed nurturing.

Inspired by his successes, Mr. Cantrell soon embarked on a more ambitious project that would all but guarantee sustained financing.

It was easy to find willing partners.

The program’s main contractors, including the defense giant Lockheed Martin, prepared presentations for Congress making the case for an extra $25 million to $50 million a year for the project.

Officials in Alaska, who had been seeking money for a spaceport on Kodiak Island to launch commercial satellites, eagerly chimed in.

But the military already had rocket launching sites around the globe, and Gen. Lester L. Lyles of the Air Force, who then ran the missile defense program, had no intention of spending money on another one.

General Lyles and his deputy, Rear Adm. Richard D. West of the Navy, were particularly incensed when they learned of the plans to lease the helicopter carrier, the Tripoli, and spend several million dollars renovating it.

Summoned to Washington in 1997 to explain the project, Mr. Cantrell offered little information.

That only further infuriated his bosses. “Who in the hell is in charge of this program?” Admiral West finally demanded in an exchange both men recall.

Mr. Cantrell was ordered to remove his experimental equipment from the planned launching.

But the money kept coming.

Mr. Cantrell said he knew that building a new launching facility was wasteful.

“It doesn’t make sense,” he said. “The economics of it, they just don’t work.” But he did not care.

“I went up there to get the money,” Mr. Cantrell said of his dealings on Capitol Hill. “And we got what we needed.”

Mr. Cantrell and his deputy, Mr. Ennis, visited Kodiak Island on the afternoon of the inaugural test launching in November 1998.

The Air Force had substituted other equipment for Mr. Cantrell’s payload. The two men, armed with a cooler filled with Miller Lite beer, watched the launching from a trailer, emerging just in time to see the missile burn an orange streak into the sky.

They had hidden out to avoid any local newspaper reporters who might discover that Mr. Cantrell’s missile parts — the justification for millions of dollars in spending — were not even being tested.

“There is no way we can explain this,” Mr. Cantrell remembered telling Mr. Ennis.

***

From the US Airways club, Mr. Cantrell could see the symphony of the arriving and departing planes, the Potomac River and off in the distance, the Capitol dome.

One day in 2000, Mr. Cantrell met in the airport lounge with Mr. Ennis, his deputy, and a Maine contractor to figure out how to pocket some of the government’s money.

There were easy ways to cheat.

The prototype missile nose cone and heat shields that the Army had paid the Maine company to design for the Alaska tests.

Why not hire the business to pretend to design them again? Mr. Cantrell asked.

The ballute — an odd cross between a balloon and a parachute — had been rejected by experts as a tool to strike an enemy missile.

But why not pay the Maine company to develop them anyway? Mr. Cantrell suggested.

He could pull off such shenanigans because, by then, he had an extraordinary degree of independence.

Mr. Cantrell’s experimental missile program, which had cost nearly $250 million, was about to be canceled.

No working missile system had been built — and almost none of the components had ended up being tested in real launchings as planned.

The effort had produced some benefits for the players involved: Congress sent an annual allotment of extra money to the Alaska launching site now totaling more than $40 million, and one of the contractors that had worked with Mr. Cantrell initially to pitch the space port, Aero Thermo Technology, had secured a no-bid federal contract to provide launching services.

Now Mr. Cantrell was on to another assignment overseeing missile defense research in Huntsville, and through his friends on the Hill, he was once again getting money for projects that the Pentagon did not want.

Mr. Cantrell, who by now was helping to oversee 160 or so contractors and managing a $120 million a year contracting budget, said he knew that if he only requested a few million dollars at a time for his scheme, there would be little scrutiny of his requests or demands that he prove that the work was actually done.

For example, the missile nose cones and other parts now made round trips from Huntsville to Maine with little or no change.

Mr. Cantrell or his deputy simply marked off the work as complete, and that was the end of it.

For nearly six years, from 2001 to 2007, the men collected kickbacks from contractors.

During one visit to the US Airways Club, Mr. Ennis picked up a briefcase stuffed with $75,000 in cash, according to federal court records. Mr. Cantrell also got checks, ranging from $5,000 to $60,000, once or twice a month, court records show.

With his new wealth, Mr. Cantrell, now 52, built himself a $1.25 million home in an exclusive Huntsville neighborhood called the Ledges.

Mr. Cantrell, who received the bulk of the kickbacks, acknowledges his crime but he ticks off the failings of the system that he exploited: lawmakers who are eager to please contractors and campaign donors; unwillingness by the Army to push back against members of Congress whose agendas were at odds with those of the military; and little scrutiny.

“We just paid for meaningless work,” he said. “And there was so little oversight that no one noticed.”

Admiral West, the former deputy director of the Pentagon missile defense program, faults Mr. Cantrell for wrongdoing, but says there were multiple missed opportunities to investigate his activities.

“The blame needs to go around widely here,” he said. “Congress should know better; the contractors, too.”

Mr. Cantrell, who is awaiting sentencing on conspiracy and bribery charges, now spends his days sitting in the kitchen of his father-in-law’s house; his dream home was seized by the federal government.

On top of the kitchen table, next to a King James Version of the Bible and bottle of Extra Strength Excedrin, is a stack of books on how to master poker.

Mr. Cantrell has reduced them to mathematical formulas pinned onto a bulletin board in front of a computer terminal, where he plays Internet poker for hours at a time.

Even now, he is trying to beat the system.

(Post based on extracts from Insider’s Project Drained Missile-Defence Millions by Eric Lipton New York Times October 12, 2008)

The Hadron Collider's Internal Controls Equivalent

It is the unbelievable in pursuit of the unimaginable.

To pinpoint the smallest fragments of the universe you have to build the biggest machine in the world.

To recreate the first millionths of a second of creation you have to focus energy on an awesome scale.

An aim of Honestly Lay Bare has always been to seek in other fields of endeavor relevance to the world of internal controls, risk management, corporate governance and internal audit.

In doing so we are taken to many places – from running the 4 minute mile to watching the 1960 Presidential debates.

Today we are entering the world of particle physics and its great experiment called the Large Hadron Collider (LHC).

***

The LHC is a circular tunnel 27 km around, bisected by the Franco-Swiss border.

The total cost of the project is expected to be €3.2–6.4 billion. When in operation, about seven thousand scientists from eighty countries will have access to the LHC.

Over 100-billion protons will traverse its pathways at 99.999999% of the speed of light, guided by some 9,300 superconducting magnets, each weighing several tons and chilled to temperatures colder than deep space.

At four points in the tunnels, the counter-revolving protons are to smash into one another at a rate of nearly one billion per second.

At the moment of collision, the most complex scientific instrument will seek to recreate the conditions right after the Big Bang.

By revisiting the beginning of time, scientists hope to unravel some of the deepest secrets of our Universe.

***

The payoff for this investment, physicists say, could be a new understanding of one of the most fundamental of aspects of reality, namely the nature of mass.

This is where the shadowy particle known as the Higgs boson, also known as the God particle, comes in.

In the Standard Model, a suite of equations describing all the forces but gravity, which has held sway as the law of the universe for the last 35 years, elementary particles are born in the Big Bang without mass, sort of like Adam and Eve being born without sin.

Some of them (the particles, that is) acquire their heft, so the story goes, by wading through a sort of molasses that pervades all of space.

The Higgs process, named after Peter Higgs, a Scottish physicist who first showed how this could work in 1964, has been compared to a cocktail party where particles gather their masses by interaction.

The more they interact, the more mass they gain.

Moreover, Higgs-like fields have been proposed as the source of an enormous burst of expansion, known as inflation, early in the universe, and, possibly, as the secret of the dark energy that now seems to be speeding up the expansion of the universe.

So it is important to know whether the theory works and, if not, to find out what does endow the universe with mass.

But nobody has ever seen a Higgs boson, the particle that personifies this molasses.

If the Higgs or something like it doesn’t exist then some very basic things like quantum mechanics are wrong.

A result, either we find the Higgs boson, or some stranger phenomenon must happen. Hence the LHC.

***

“All Companies Must Declare All Internal Control Weaknesses to Market” screams the fictional Wall Street Journal page A1 headline.

“Due to the current meltdown in world financial markets, the Securities and Exchange Commission has taken a drastic action unprecedented in world financial history that all companies declare in a real time basis all internal control weakness and all risk management deficiencies that the company is aware of.”

The article continues “all the internal control weaknesses will be collated and analysed to identify the underlying root causes which will then be parlayed back to all organisations in the hope that Management will learn what it is that is the difference between a well controlled company, industry, market, economy or country”.

In this world perhaps not too far in the future what you then have is an internal controls Hadron Collider – the ultimate mechanism for assurance providers to detect, understand and plan for the corporate ills that befell companies.

What would such an internal controls Hadron Collider be called.

For mine – this is easy.

It would be called The Athena – in honour of the Greek God of wisdom and reason.

The Panic of 1873

They had crafted complex financial instruments that promised a fixed return, though few understood the underlying object that was guaranteed to investors in case of default.

Answer: nothing.

A key theme of Honestly Lay Bare is that we seek out historical case studies to illuminate the appropriateness of responses to modern day scenarios.

The current credit crisis has led many to draw comparisons to the Great Depression of 1929.

Such comparisons are 56 years from the real great depression and the classic case study of a market meltdown when there was a misunderstanding of risk.

Welcome to the Panic of September 1873.

***

The problems had emerged around 1870, starting in Europe.

In the Austro-Hungarian Empire, formed in 1867, in the states unified by Prussia into the German empire, and in France, the emperors supported a flowering of new lending institutions that issued mortgages for municipal and residential construction, especially in the capitals of Vienna, Berlin, and Paris.

Mortgages were easier to obtain than before, and a building boom commenced.

Land values seemed to climb and climb; borrowers assumed more and more credit, using unbuilt or half-built houses as collateral.

But the economic fundamentals were shaky.

Wheat exporters from Russia and Central Europe faced a new international competitor who drastically undersold them.

The 19th-century version of containers manufactured in China and bound for Wal-Mart consisted of produce from farmers in the American Midwest. They used grain elevators, conveyer belts, and massive steam ships to export trainloads of wheat to abroad.

Britain, the biggest importer of wheat, shifted to the cheap wheat quite suddenly around 1871.

By 1872 kerosene and manufactured food were rocketing out of America's heartland, undermining rapeseed, flour, and beef prices.

The crash came in Central Europe in May 1873, as it became clear that the region's assumptions about continual economic growth were too optimistic.

Europeans faced what they came to call the American Commercial Invasion. A new industrial superpower had arrived, one whose low costs threatened European trade and a European way of life.

As continental banks tumbled, British banks held back their capital, unsure of which institutions were most involved in the mortgage crisis.

The cost to borrow money from another bank — the interbank lending rate — reached impossibly high rates.

This banking crisis hit the United States in the fall of 1873.

Railroad companies tumbled first.

They had crafted complex financial instruments that promised a fixed return, though few understood the underlying object that was guaranteed to investors in case of default. Answer: nothing.

The bonds had sold well at first, but they had tumbled after 1871 as investors began to doubt their value, prices weakened, and many railroads took on short-term bank loans to continue laying track.

Then, as short-term lending rates skyrocketed across the Atlantic in 1873, the railroads were in trouble.

When the railroad financier Jay Cooke proved unable to pay off his debts, the stock market crashed in September, closing hundreds of banks over the next three years.

The panic continued for more than four years in the United States and for nearly six years in Europe.

The long-term effects of the Panic of 1873 were perverse.

For the largest manufacturing companies in the United States — those with guaranteed contracts and the ability to make rebate deals with the railroads — the Panic years were golden. Andrew Carnegie, Cyrus McCormick, and John D. Rockefeller had enough capital reserves to finance their own continuing growth.

For smaller industrial firms that relied on seasonal demand and outside capital, the situation was dire. As capital reserves dried up, so did their industries. Carnegie and Rockefeller bought out their competitors at fire-sale prices.

As the panic deepened, ordinary Americans suffered terribly.

Between 1873 and 1877, as many smaller factories and workshops shuttered their doors, tens of thousands of workers — many former Civil War soldiers — became transients. The terms "tramp" and "bum," both indirect references to former soldiers, became commonplace American terms. Relief rolls exploded in major cities, with 25-percent unemployment (100,000 workers) in New York City alone.

Unemployed workers demonstrated in Boston, Chicago, and New York in the winter of 1873-74 demanding public work. In New York's Tompkins Square in 1874, police entered the crowd with clubs and beat up thousands of men and women. The most violent strikes in American history followed the panic.

A nationwide railroad strike followed in 1877, in which mobs destroyed railway hubs in Pittsburgh, Chicago, and Cumberland, Md.

In Central and Eastern Europe, times were even harder. Many political analysts blamed the crisis on a combination of foreign banks and Jews. Nationalistic political leaders (or agents of the Russian czar) embraced a new, sophisticated brand of anti-Semitism that proved appealing to thousands who had lost their livelihoods in the panic. Anti-Jewish pogroms followed in the 1880s, particularly in Russia and Ukraine.

***

Compare this period of uncertainty with today and you start seeing the ghosts of the residential mortgage market.

Loans after about 2001 were issued to first-time homebuyers who signed up for adjustable rate mortgages they could likely never pay off, even in the best of times.

Real-estate speculators, hoping to flip properties, overextended themselves, assuming that home prices would keep climbing.

Those debts were wrapped in complex securities that mortgage companies and other entrepreneurial banks then sold to other banks; concerned about the stability of those securities, banks then bought a kind of insurance policy called a credit-derivative swap, which risk managers imagined would protect their investments. More than two million foreclosure filings — default notices, auction-sale notices, and bank repossessions — were reported in 2007.

By then trillions of dollars were already invested in this credit-derivative market.

Were those new financial instruments resilient enough to cover all the risk? (Answer: no.)

The protracted reconstruction of banks in the United States and Europe created widespread unemployment.

Unions (previously illegal in much of the world) flourished but were then destroyed by corporate institutions that learned to operate on the edge of the law. In Europe, politicians found their scapegoats in Jews, on the fringes of the economy.

Americans, on the other hand, mostly blamed themselves; many began to embrace what would later be called fundamentalist religion.

***

135 years later it appears that we have failed to learn the lessons of the Panic of 1873.

Why is that?

Is it that each generation needs to learn a new.

Does society’s understanding of risk blind itself to thinking that lessons can be learnt from examples of human endeavor.

Does society think that human nature changes over time such that we cannot see in ourselves the actions of a forebears.

If there is one lesson from the Panic of 1873 it is that all the investment in current risk management frameworks and models may be no more beneficial than having on your payroll a knowledgeable and articulate business historian.

Could the Chief Historian be about to replace the Chief Risk Officer?

(Post based in part on The Real Great Depression By Scott Reynolds Nelson The Chronicle of Higher Education October 17, 2008 Issue)

The Advocatus Diaboli

The role of the Advocatus Diaboli is to prevent any rash decisions

The role of the Advocatus Diaboli (the Devil’s Advocate) was established in the Catholic Church in 1587 by Pope Sixtus V.

His function was in the processes of beatification and canonization to gather all evidence against the person's honoring.

No important act in the process of beatification or canonization was valid unless performed in the formal presence of the Advocatus Diaboli.

It was the special role of the Advocatus Diaboli to prevent any rash decisions concerning miracles or virtues.

All documents of beatification and canonization processes needed to be submitted to his examination, and the difficulties and doubts he raises over the virtues and miracles were then laid before the congregation to be satisfactorily answered before any further steps could be taken in the processes.

It was his duty to suggest natural explanations for alleged miracles, and even to bring forward human and selfish motives for deeds that have been accounted heroic virtues.

***

Imagine if there was such a thing as a corporate Advocatus Diaboli … what would the role look like?

Formal strategic decisions made in the absence of the Advocatus Diaboli would not be seen as valid.

The Advocatus Diaboli would enforce a critical distance on decisions – where the outcome cannot be satisfactorily explained additional justification would need to be provided.

The Advocatus Diaboli would be the role responsible for ensuring that all decisions are collected and their impacts taken into account.

Additionally the role would ensure that complete and accurate documentation exists at any point in the project / business decision life cycle.

Such a role isn’t like any that currently exists within an organisation.

The Corporate Advocatus Diaboli (with the unfortunate acronym CAD) would be integral to the business in a way that no other could be yet would need to maintain a distance that negates such a role being compared to that of a senior executive or an independent assurance provider.

Where would internal audit and risk management sit in such a brave new (old?) world?

Good question.

***

As an aside, the office of the Advocatus Diaboli was abolished by Pope John Paul II in 1983.

What Matthew Broderick Taught Me About Cyber Security

See that sign up here - up here. "Defcon."

That indicates our current defense condition. It should read "Defcon 5," which means peace.

It's still on 4 because of that little stunt you pulled.

Actually, if we hadn't caught it in time, it might have gone to Defcon 1.

You know what that means, David?

No. What does that mean?

World War Three.

One of my favorite films is the 1983 action movie WarGames.

It's a deceptively simple story.

The opening scene depicts two United States Air Force officers who, unbeknownst to them, experience a nuclear missile launch simulation.

One of the men is unable to turn the key simultaneously with his partner to launch the missiles.

The man's refusal to perform his duty is enough to convince computer programmers at the North American Aerospace Defence Command (NORAD) that the human element needs to be removed from the "loop" and that command of the missile silos needs to be maintained from NORAD itself.

Control is given to a supercomputer, WOPR (War Operation Plan Response), which is programmed to predict possible outcomes of a nuclear war.

High schooler David Lightman (played by Matthew Broderick) is a digitally proficient geek who wants to play an unreleased computer game — and impress a pretty girl (Ally Sheedy).

So he does something most Americans didn't have a word for back then: He starts hacking.

Little does he know, the "computer company" he's infiltrated is actually a military installation running WOPR and the game — Global Thermonuclear War — is real.

Naturally, only Lightman can stop it from setting off World War III.

Disaster is narrowly averted when Lightman manages to teach WOPR about the futility of war by getting it to play endless drawn games of tic-tac-toe against itself.

The WOPR then cycles through all the nuclear war scenarios that it has devised, which all end with no winner.

WOPR learns that “the only winning move is not to play” and simply ceases playing.

In the end WOPR decides it would prefer "a nice game of chess."

At the time I remember thinking – as a 15 year old boy – that it was a great piece of fantasy.

Come forward 25 years (yes I am approaching 40!), and the concept of cyber attacks is very real not only in the US Government but with all organisations.

WarGames is no longer fantasy.

***

The United States Government Accountability Office – the audit and investigative arm of the United States Congress – recently released a very good overview of the challenges in establishing a comprehensive framework for the prevention, detection and mitigation of cyber attacks.

The issue of cyber attacks doesn’t have the same profile these days as it once did and it is this very complacency that a cyber attacker – whether driven by malice or adventure – will seek to exploit.

The report provides a number of interesting cyber attack examples.

In June 2003, the U.S. government issued a warning concerning a virus that specifically targeted financial institutions. Experts said the BugBear.b virus was programmed to determine whether a victim had used an e-mail address for any of the roughly 1,300 financial institutions listed in the virus’s code. If a match was found, the software attempted to collect and document user input by logging keystrokes and then provide this information to a hacker, who could use it in attempts to break into the banks’ networks.

In August 2006, two Los Angeles city employees hacked into computers controlling the city’s traffic lights and disrupted signal lights at four intersections, causing substantial backups and delays. The attacks were launched prior to an anticipated labor protest by the employees.

In October 2006, a foreign hacker penetrated security at a water filtering plant in Harrisburg, Pennsylvania. The intruder planted malicious software that was capable of affecting the plant’s water treatment operations.

In May 2007, Estonia was the reported target of a denial-of-service cyber attack with national consequences. The coordinated attack created mass outages of its government and commercial Web sites.

In March 2008, the Department of Defense reported that in 2007 computer networks operated by Defense, other federal agencies, and defense-related think tanks and contractors were targets of cyber warfare intrusion techniques. Although those responsible were not definitively substantiated, the attacks appeared to have originated in China.

***

It is never too late to consider whether your organisation is at risk.

A good place to start is to ensure that you have in place mechanisms for the following types of cyber attacks as listed in the GAO report:

Denial of service - A method of attack from a single source that denies system access to legitimate users by overwhelming the target computer with messages and blocking legitimate traffic. It can prevent a system from being able to exchange data with other systems or use the Internet.

Distributed denial of service - A variant of the denial-of-service attack that uses a coordinated attack from a distributed system of computers rather than from a single source. It often makes use of worms to spread to multiple computers that can then attack the target.

Exploit tools - Publicly available and sophisticated tools that intruders of various skill levels can use to determine vulnerabilities and gain entry into targeted systems.

Logic bombs - A form of sabotage in which a programmer inserts code that causes the program to perform a destructive action when some triggering event occurs, such as terminating the programmer’s employment.

Phishing - The creation and use of e-mails and Web sites—designed to look like those of well-known legitimate businesses, financial institutions, and government agencies—in order to deceive Internet users into disclosing their personal data, such as bank and financial account information and passwords. The phishers then use that information for criminal purposes, such as identity theft and fraud.

Sniffer - Synonymous with packet sniffer. A program that intercepts routed data and examines each packet in search of specified information, such as passwords transmitted in clear text.

Trojan horse - A computer program that conceals harmful code. A Trojan horse usually masquerades as a useful program that a user would wish to execute.

Virus - A program that infects computer files, usually executable programs, by inserting a copy of itself into the file. These copies are usually executed when the infected file is loaded into memory, allowing the virus to infect other files. Unlike a computer worm, a virus requires human involvement (usually unwitting) to propagate.

Vishing - A method of phishing based on voice-over-Internet Protocol technology and open-source call center software that have made it inexpensive for scammers to set up phony call centers and criminals to send e-mail or text messages to potential victims, saying there has been a security problem and they need to call their bank to reactivate a credit or debit card, or send text messages to cell phones, instructing potential victims to contact fake online banks to renew their accounts.

War driving - A method of gaining entry into wireless computer networks using a laptop, antennas, and a wireless network adaptor that involves patrolling locations to gain unauthorized access.

Worm - An independent computer program that reproduces by copying itself from one system to another across a network. Unlike computer viruses, worms do not require human involvement to propagate.

Zero-day exploit - A cyber threat taking advantage of a security vulnerability on the same day that the vulnerability becomes known to the general public and for which there are no available fixes.

***

Over the years, WarGames has written itself into the cult lore of Silicon Valley.

Google hosted a 25th-anniversary screening in May, where geeks and nerds cheered Broderick's denial of service acrobatics.

"Many of us grew up with this movie," Google cofounder Sergey Brin told the packed house.

"It was a key movie of a generation, especially for those of us who got into computing".

(Post is based in part on the United States Government Accountability Office Report to the Sub Committee on Emerging Threats, Cybersecurity and Science and Technology, Committee on Homeland Security, House of Representatives Cyber Analysis and Warning July 2008 GAO-08-588)

Twittering

Each little update is insignificant on its own, even supremely mundane. But taken together, over time, the little snippets coalesce into a surprisingly sophisticated portrait.

Social scientists have a name for the need for always on online contact – they call it “ambient awareness”.

It is, they say, very much like being physically near someone and picking up on his mood through the little things he does — body language, sighs, stray comments — out of the corner of your eye.

In the last year, there has been a boom in tools for “microblogging”: posting frequent tiny updates on what you’re doing.

The phenomenon is quite different from what we normally think of as blogging, because a blog post (like this one) is usually a written piece, sometimes quite long: a statement of opinion, a story, an analysis.

But these new updates are something different.

They’re far shorter, far more frequent and less carefully considered.

The use of microblogging has far reaching implications that I suspect no one in the internal audit / risk management community has given much thought to in terms of how it may be used to speed the flow of information within a company (the surest sign of a maturing internal controls environment).

***

One of the most popular new tools is Twitter, a Web site and messaging service that allows its two-million-plus users to broadcast to their friends haiku-length updates — limited to 140 characters, as brief as a mobile-phone text message — on what they’re doing.

There are other services for reporting where you’re traveling (Dopplr) or for quickly tossing online a stream of the pictures, videos or Web sites you’re looking at (Tumblr).

And there are even tools that give your location.

When the new iPhone, with built-in tracking, was introduced in July, one million people began using Loopt, a piece of software that automatically tells all your friends exactly where you are.

Each little update — each individual bit of social information — is insignificant on its own, even supremely mundane.

But taken together, over time, the little snippets coalesce into a surprisingly sophisticated portrait of your friends’ and family members’ lives, like thousands of dots making a pointillist painting.

This was never before possible, because in the real world, no friend would bother to call you up and detail the minutae of their lives.

***

There have been a number of interesting uses of microblogging by governments and corporations.

Large businesses such as Cisco Systems and Whole Foods Market use twitter to provide product or service information.

The Los Angeles Fire Department put the technology to use during the October 2007 California wildfires.

NASA used Twitter to break the news of discovery of what appeared to be water ice on Mars by the Phoenix Mars Lander. Other NASA projects, such as Space Shuttle missions and the International Space Station, also provide updates via Twitter.

News outlets such as the BBC have also started using Twitter to disseminate breaking news or provide information feeds for sporting events.

Several 2008 U.S. presidential campaigns use Twitter as a publicity mechanism, including that of Democratic Party nominee Barack Obama.

Perhaps my favourite is the Westwinds Church in Jackson, Michigan.

The Church uses Twitter as a part of its weekend worship services and introduced the concept of Twitter Church. Westwinds runs training classes for Twitter and encourages members to bring laptops and mobile devices to church.

On occasion, the Twitter feed will be live on the screens in the auditorium and everyone is encouraged to give their input, make observations, and ask questions in an interactive worship format.

***

All this has got me thinking – how can Internal Audit use and exploit the development of microblogging.

Firstly, by talking about it.

Whether you think that the idea of describing your activities in such detail is absurd is, with due respect, beside the point.

The concept of microblogging is unlikely to be uninvented any time soon.

We – as a profession – haven’t had the greatest record in discussing and debating emerging issues before other constituencies get involved.

Secondly, we need to consider how such a tool would be used – and abused – within organisations.

Sharing information to improve the efficiency of the team is a concept that will always be supported … but what happens when someone uses microblogging to mischievously release information.

This latter issue is all the more important to consider given that microblogging may or may not – depending upon your security infrastructure – be something that you can trace as easily as internal mail.

Imagine the day when your CEO twittered or you as an auditor twittered to your auditees.

The dream of complete process transparency may not be too far from reality – are we ready for it?

(Post based in part on Brave New World of Digital Intimacy by Clive Thompson New York Times September 5th, 2008)