CheckYourDISC Take the Test
← All learning

Analogy

Traffic Lights and Roundabouts: Controls Should Match Flow and Consequence

A traffic light and a roundabout both coordinate movement. Neither is always best. The right control depends on volume, speed, visibility, conflict points, users, emergency needs, and the consequence of error.

  • Drive notices delay and the need for legitimate movement.
  • Connect notices whether people understand and accept the shared rule.
  • Sustain notices predictable flow, routine use, and how change affects everyone entering the system.
  • Verify notices collision risk, evidence, rule definition, exceptions, and failure states.

The Control lesson

Businesses often argue “control versus trust” or “speed versus process.” A better question is: what is the lightest control that keeps legitimate work moving within acceptable risk?

Controls can be:

  • Preventive or detective
  • Manual or automated
  • Always-on or risk-triggered
  • Upfront approval or after-the-fact review
  • Individual permission or role-based authority
  • Fixed rule or governed exception

Overcontrol creates congestion, shadow work, and hidden bypasses. Undercontrol creates collisions, ambiguity, fraud, error, and unrecoverable decisions.

Business example

Every software purchase requires owner approval, even a $10 tool with no sensitive data. Staff bypass the process. Replace one traffic light with risk-based flow:

  • Low cost/no data/no integration: delegated purchase, recorded, sampled
  • Customer or employee data: security/privacy review
  • Material contract/integration: technical, financial, continuity review
  • Emergency: named exception, time limit, removal/review owner

Try this

Choose one congested approval. Ask:

  1. What exact failure does it prevent?
  2. How often does the failure occur and what is its consequence?
  3. Which requests are genuinely different risk classes?
  4. Could an automated limit or after-the-fact sample replace upfront approval?
  5. What authorized exception path prevents hidden workarounds?
  6. How will you measure both risk and friction?

BOS links: Control, Security, Operations, Intelligence.
Misuse warning: Disliking a control does not prove it is unnecessary; liking rules does not prove they reduce meaningful risk.