Dr Alwin Tan, GAICD, MBBS, FRACS, EMBA (Melbourne Business School)
Senior Surgeon | Governance Leader | HealthTech Co-founder | Founder of Institute for Systems Integrity (ISI) | Harvard Medical School — AI in Healthcare | University of Oxford — Sustainable Enterprise | Bastas Academy for Healthcare Leadership — Triple Scholar

Institute for Systems Integrity (ISI)

THE MOST DANGEROUS INVESTIGATION MAY NOT BE ONE THAT REACHES THE WRONG CONCLUSION.

IT MAY BE ONE THAT BECOMES INSTITUTIONALLY INCAPABLE OF REVERSING IT.

Imagine this.

A serious concern is raised.

An investigation begins.

A preliminary view forms.

A conclusion follows.

Then the organisation acts.

Human Resources acts.

Credentialing acts.

Executives are briefed.

Lawyers become involved.

A regulator may be notified.

People defend decisions.

Careers change.

Reputations change.

Money is spent.

Months pass.

Then something inconvenient happens.

New evidence emerges.

Evidence strong enough that, had it existed at the beginning, the organisation might have reached a different conclusion.

In theory, this should be simple.

Review the evidence.

Correct the conclusion.

Repair whatever followed.

But it may no longer be simple.

Because the organisation is no longer being asked merely to reconsider an investigation.

It may now have to reconsider everything it did because of that investigation.

And suddenly the question is no longer:

“WHAT DOES THE EVIDENCE SHOW?”

It becomes:

“WHAT WILL IT COST US TO CHANGE OUR MIND?”

That is a very different question.

And it may be one of the least discussed risks in organisational governance.

🚨 THE INSTITUTIONAL COST OF REVERSAL

Consider what happens after an organisation reaches a conclusion.

Decisions accumulate around it.

People endorse it.

Committees rely upon it.

Resources are committed to it.

Other processes inherit it.

The organisation may communicate it internally or externally.

Individuals stake professional credibility on its correctness.

Eventually, reversing the original conclusion no longer reverses one decision.

It threatens an entire chain of downstream decisions.

We propose calling this:

THE INSTITUTIONAL COST OF REVERSAL

Not as an established academic construct, but as a systems-integrity lens for examining what happens when the organisational consequences of admitting error begin influencing the organisation's capacity to recognise error.

The danger is obvious.

THE MORE AN ORGANISATION INVESTS IN A CONCLUSION, THE MORE EXPENSIVE IT BECOMES TO DISCOVER THAT THE CONCLUSION WAS WRONG.

And that creates a governance problem.

🚨 THIS DOES NOT REQUIRE CORRUPTION

Nobody needs to fabricate evidence.

Nobody needs to conspire.

Nobody needs to enter a room and say:

“We know we are wrong. Let's cover it up.”

The mechanisms can be far more ordinary.

Research on motivated reasoning suggests that motivation can influence how people access, construct and evaluate information. People may preferentially use reasoning strategies capable of supporting conclusions they are motivated to reach while still believing their reasoning is legitimate (Kunda, 1990).

Research on escalation of commitment similarly demonstrates how decision-makers may continue investing in a chosen course despite negative feedback, particularly where responsibility for earlier decisions is involved (Staw, 1976).

This creates a much more uncomfortable possibility.

GOOD PEOPLE CAN DEFEND A BAD CONCLUSION WITHOUT BELIEVING THEY ARE DOING ANYTHING WRONG.

Contradictory evidence becomes incomplete.

The person presenting it appears defensive.

An inconsistency becomes suspicious.

A challenge becomes evidence of poor insight.

Another investigation is commissioned.

Another committee reviews the matter.

Another process begins.

Everything remains professional.

Everything remains documented.

Everything remains procedural.

And yet the organisation may be becoming progressively less capable of asking the only question that matters:

WHAT IF WE WERE WRONG?

🚨 WHEN PROCESS MULTIPLICATION LOOKS LIKE EVIDENCE MULTIPLICATION

Suppose one allegation produces:

a management review,

a performance process,

a credentialing review,

an HR investigation,

and a regulatory notification.

Months later, somebody reviewing the history sees five separate processes.

That can look powerful.

But five processes are not necessarily five independent pieces of evidence.

They may all descend from one original allegation or assumption.

The processes multiply.

The evidence does not.

Yet eventually, the existence of each process can begin legitimising the others.

“There must have been something serious. Look how many processes were involved.”

This creates what might be called procedural echo.

The original proposition generates multiple institutional responses.

Those responses later appear to corroborate the original proposition.

The system begins citing itself.

PROCESS MULTIPLICATION IS NOT EVIDENCE MULTIPLICATION.

Ten processes cannot manufacture ten independent facts from one untested claim.

A high-integrity organisation must therefore understand the provenance of evidence.

Where did each allegation originate?

Which evidence is genuinely independent?

Which conclusions relied upon earlier conclusions?

Which processes merely inherited assumptions from another process?

Without that mapping, institutional activity itself can begin masquerading as corroboration.

🚨 THE ASYMMETRY OF PROOF

There is an even harder possibility.

The threshold required to establish the original conclusion may be relatively modest.

But once the organisation has acted upon that conclusion, the threshold required to reverse it may quietly become much higher.

Evidence A helps establish the original narrative.

It is accepted.

Evidence B contradicts it.

Suddenly Evidence B must be overwhelming.

Definitive.

Unambiguous.

Beyond challenge.

Why?

Because accepting Evidence B now has consequences.

It may mean acknowledging that:

an investigation was flawed,

a person was treated unfairly,

a complaint was misunderstood,

a disciplinary action was unjustified,

a regulatory notification requires reconsideration,

leaders endorsed an incorrect conclusion,

or institutional safeguards failed.

The evidence has not necessarily become weaker.

The consequences of accepting it have become stronger.

WHEN THE COST OF REVERSAL RISES, THE STANDARD OF PROOF CAN QUIETLY RISE WITH IT.

That is not necessarily deliberate misconduct.

But it is a serious governance vulnerability.

🚨 THEN THE ORGANISATION MAY START PROTECTING THE NARRATIVE

At the beginning, an investigation asks:

“What happened?”

Later, if institutional commitment becomes sufficiently strong, the question can subtly become:

“How does this new information fit what we already concluded?”

That is where motivated reasoning becomes especially relevant (Kunda, 1990).

Information does not need to be ignored.

It can simply be interpreted through the existing narrative.

A document does not disprove the concern.

It becomes evidence of defensiveness.

A challenge does not expose inconsistency.

It demonstrates lack of insight.

A successful appeal does not destabilise the original hypothesis.

It becomes a technicality.

The organisation continues gathering evidence.

But it may have quietly lost its capacity to be changed by evidence.

AN INVESTIGATION CAN CONTINUE COLLECTING EVIDENCE LONG AFTER IT HAS STOPPED ALLOWING EVIDENCE TO CHANGE ITS MIND.

At that point, inquiry risks becoming confirmation.

🚨 AND EVERYONE ELSE IS WATCHING

This does not affect only the person being investigated.

Employees observe what happens.

They notice what happens when somebody challenges an established conclusion.

They notice who is believed.

Who is labelled difficult.

Who loses access.

Who becomes “the problem”.

Who remains influential.

And who quietly disappears.

Morrison and Milliken (2000) described organisational silence as a collective phenomenon in which employees withhold information about potential problems because organisational conditions create a shared perception that speaking is unwise.

That creates a dangerous feedback loop.

People become reluctant to challenge the dominant interpretation.

Less contradictory information reaches decision-makers.

The absence of dissent looks like agreement.

Agreement strengthens confidence in the conclusion.

Greater confidence makes dissent even harder.

Eventually:

SILENCE BECOMES EVIDENCE OF CONSENSUS.

But the organisation may simply have trained people to stop disagreeing.

🚨 HISTORY HAS SEEN THIS PATTERN BEFORE

The industries change.

The mechanisms do not.

These cases are profoundly different and should not be treated as equivalent.

But each exposes a different version of the same systems-integrity problem:

What happens when warning information collides with an organisation already committed to a course of action?

Challenger — when abnormal risk becomes normal

Diane Vaughan's analysis of the 1986 Space Shuttle Challenger disaster challenged explanations centred solely on individual wrongdoing.

Her work examined how organisational culture, decision-making and the interpretation of repeated anomalies contributed to catastrophe.

Over time, departures from expected performance that did not immediately produce disaster could become increasingly accepted — the phenomenon Vaughan described as the normalisation of deviance (Vaughan, 1996).

The warning signal had not necessarily disappeared.

The organisation's interpretation of the warning had changed.

Columbia — when yesterday's warning becomes today's normal

Seventeen years after Challenger, the Space Shuttle Columbia was lost during re-entry in 2003.

Foam had struck the shuttle during launch.

Foam strikes had occurred before.

During the mission, engineers raised concerns and sought additional imagery to better understand possible damage.

The Columbia Accident Investigation Board subsequently concluded that NASA's organisational culture and structure were as relevant to the accident as its technical causes (CAIB, 2003).

The lesson is uncomfortable.

A recurring warning can gradually stop feeling like a warning.

Yesterday's anomaly becomes today's experience.

Today's experience becomes tomorrow's assumption.

Until the exceptional becomes ordinary.

THE WARNING DID NOT HAVE TO DISAPPEAR.

THE SYSTEM ONLY HAD TO STOP EXPERIENCING IT AS A WARNING.

🚨 CHALLENGER → COLUMBIA: WHAT IF THE ORGANISATION LEARNED THE LESSON — BUT THE SYSTEM DIDN'T?

This may be the most important comparison.

Challenger was lost in 1986.

There was an investigation.

Recommendations followed.

Changes were made.

Lessons were supposedly learned.

Seventeen years later, Columbia was lost.

And once again, investigators identified profound organisational and cultural weaknesses.

That should trouble every board.

Because organisations are extraordinarily good at responding to failure with visible activity.

New policies.

New committees.

New reporting structures.

New training.

New assurance mechanisms.

New dashboards.

New words.

But activity is not necessarily adaptation.

A RECOMMENDATION BEING IMPLEMENTED IS NOT THE SAME AS THE SYSTEM BEING CHANGED.

The deeper question is whether authority changed.

Whether incentives changed.

Whether uncomfortable information travelled differently.

Whether dissent became safer.

Whether independent challenge became stronger.

Whether assumptions became easier to overturn.

Whether the organisation became more capable of discovering that it was wrong.

That leads to a question much bigger than NASA:

WHAT IF THE ORGANISATION LEARNED THE LESSON — BUT THE SYSTEM DIDN'T?

Mid Staffordshire — when warning information exists but fails to change the system

Healthcare has its own painful examples.

The Francis Inquiry into failures at Mid Staffordshire NHS Foundation Trust documented a system in which serious warning signs existed across multiple parts of the healthcare environment.

The subsequent inquiry examined not merely individual clinical failures but broader organisational and systemic failures, including how warning information was interpreted and acted upon (Francis, 2013).

That distinction matters.

The problem was not simply:

“Nobody knew.”

The harder systems question was:

Why did information already present within the system fail to produce adequate correction?

This is one of the most important distinctions in governance.

Having information is not the same as responding to it.

Having a reporting system is not the same as hearing what is reported.

Having evidence is not the same as allowing evidence to change institutional behaviour.

SOMETIMES ORGANISATIONS DO NOT FAIL BECAUSE NOBODY RAISED THE ALARM.THEY FAIL BECAUSE THE SYSTEM BECAME BETTER AT EXPLAINING THE ALARM THAN RESPONDING TO IT.

Boeing 737 MAX — when warning signals collide with organisational commitment

The Boeing 737 MAX provides another, very different, example.

Following two fatal crashes, investigations examined not only technical failures but the broader development, certification and organisational environment surrounding the aircraft.

The US House Committee investigation identified production pressures, faulty technical assumptions and failures in the communication of important information concerning the aircraft and MCAS.

Again, the point is not that Boeing, NASA and Mid Staffordshire were the same.

They were not.

The systems question is narrower:

What happens to contradictory information when changing direction has become expensive?

Programmes accumulate commitments.

Schedules matter.

Commercial consequences grow.

Careers become associated with decisions.

Previous assurances have already been given.

Reversal becomes progressively harder.

And that creates the governance question:

DOES THE EVIDENCE CHANGE THE DECISION — OR DOES THE SYSTEM FIND A WAY TO EXPLAIN THE EVIDENCE?

Theranos — the important contrast

Theranos belongs in this discussion for a different reason.

US regulators alleged deliberate false and misleading claims concerning the company's technology, business and financial performance.

That distinguishes it from the central problem examined in this paper.

Institutional resistance to correction exists on a spectrum.

At one end, people may sincerely reinterpret inconvenient evidence through motivated reasoning, institutional commitment and established assumptions.

At the other, information may be deliberately concealed or misrepresented.

Governance must be capable of detecting both.

But the first may be harder to recognise.

Because nobody needs to believe they are behaving improperly.

The system can become resistant to correction while everyone inside it still believes they are doing their job.

🚨 THE COMMON THREAD IS NOT BAD PEOPLE

Challenger.

Columbia.

Mid Staffordshire.

Boeing.

They are not interchangeable.

Their facts, causes, consequences and accountability structures differ profoundly.

The value of comparison lies elsewhere.

Across complex organisations, warning information competes with:

existing assumptions,

hierarchy,

production pressures,

reputation,

prior decisions,

professional identity,

commercial interests,

and institutional commitments.

That means the real governance question is not simply:

“Did somebody raise the concern?”

It is:

“DID THE SYSTEM REMAIN CAPABLE OF LETTING THAT CONCERN CHANGE WHAT IT BELIEVED?”

That is the connection to institutional reversal.

The deeper an organisation becomes invested in its existing interpretation, the harder contradictory information may have to work to overturn it.

🚨 BUT THERE IS AN IMPORTANT COUNTERARGUMENT

Investigations cannot remain open forever.

Organisations must make decisions.

Managers must manage.

Regulators must regulate.

Complaints must be resolved.

Patients, staff and complainants deserve timely outcomes.

And disagreement with an outcome does not prove that an investigation was unfair.

An accused person can engage in motivated reasoning too.

So can a complainant.

So can a manager.

So can an investigator.

Repeated requests for reconsideration can themselves become unreasonable, resource-intensive or harmful.

Therefore, the answer cannot be:

Every conclusion must remain permanently open.

That would make governance impossible.

The stronger principle is:

EVERY SERIOUS CONCLUSION SHOULD REMAIN FALSIFIABLE.

Closure and correctability are not opposites.

A high-integrity organisation needs both.

Closure allows decisions to be made.

Correctability allows serious mistakes to be repaired.

The question is not whether every dissatisfied person can repeatedly reopen an investigation.

It is whether credible, materially significant new evidence has a legitimate pathway back into the system.

🚨 THE FOUR-WAY INTEGRITY TEST

A high-integrity investigation must preserve four possibilities:

The complainant may be wrong.

The accused may be wrong.

The investigator may be wrong.

The organisation may be wrong.

If the system is structurally capable of discovering only the first two, its accountability architecture is incomplete.

Smith and Freyd's work on institutional betrayal provides a broader reminder that trusted institutions can compound harm when institutional responses themselves fail those dependent upon them (Smith and Freyd, 2014).

That does not mean every adverse institutional decision constitutes betrayal.

It means institutional behaviour itself belongs inside the field of examination.

🚨 SO WHO HAS THE AUTHORITY TO SAY: “WE GOT THIS WRONG”?

Organisations usually know who can initiate an investigation.

Who can discipline.

Who can suspend.

Who can notify.

Who can credential.

Who can terminate.

But ask something different:

WHO CAN REVERSE IT?

Who has authority to say:

The evidence no longer supports our conclusion.

The original investigation needs independent review.

These downstream decisions were based on an assumption that has changed.

This notification requires correction.

This person's reputation requires repair.

This organisation got it wrong.

That authority needs to exist before the organisation needs it.

Otherwise reversal depends upon the very people whose previous decisions are now being questioned.

That is an obvious structural vulnerability.

🚨 THE ISI GOVERNANCE OF REVERSAL TEST

Boards, regulators and healthcare organisations could ask five questions of every serious investigation.

1. WHAT WOULD CHANGE OUR MIND?

Before reaching the final conclusion, document what credible evidence would materially weaken or reverse it.

If the answer is “nothing”, the conclusion may already have become non-falsifiable.

2. WHERE DID THE EVIDENCE COME FROM?

Map evidence provenance.

Five reports derived from one original allegation are not five independent confirmations.

3. WHAT MAKES REVERSAL DIFFICULT?

Identify institutional investment.

Which previous decisions, reputations, resources or downstream actions now depend upon this conclusion remaining correct?

This is not an allegation of improper motive.

It is a governance assessment of potential bias.

4. WHO CAN REOPEN THE QUESTION?

Create an independent pathway for materially significant new evidence.

The original investigator should not automatically be the final judge of whether the original investigation needs reconsideration.

5. WHAT HAPPENS IF WE WERE WRONG?

Correction cannot stop at changing a document.

Trace the downstream consequences.

Who was affected?

Which decisions relied upon the conclusion?

Which organisations or regulators received it?

What requires correction?

What requires remediation?

And what must the organisation learn?

🚨 THIS IS NOT ABOUT BEING SOFT ON ACCOUNTABILITY

It is the opposite.

Real accountability must travel in both directions.

People should be accountable for misconduct.

Complaints should be investigated.

Whistleblowers should be protected.

Patient safety concerns must be taken seriously.

But investigators must also be accountable for investigative quality.

Managers for fair process.

Executives for the exercise of institutional power.

Boards for the integrity of the systems operating beneath them.

And organisations for correcting serious errors when they discover them.

ACCOUNTABILITY THAT FLOWS ONLY DOWNWARD IS NOT COMPLETE ACCOUNTABILITY.

It is authority.

🚨 THE HARDEST SENTENCE IN GOVERNANCE MAY BE FOUR WORDS

Policies are easy to approve.

Committees are easy to establish.

Investigations are easy to commission.

Frameworks are easy to publish.

But institutional integrity becomes visible when credible evidence threatens something the organisation has already defended.

Then comes the real test.

Can leaders tolerate the embarrassment?

Can investigators tolerate the challenge?

Can boards tolerate the liability?

Can institutions tolerate the reputational consequences?

Can the system correct itself even when correction hurts?

Because eventually someone may have to say four words:

“WE GOT THIS WRONG.”

That sentence does not necessarily demonstrate governance failure.

Sometimes it demonstrates exactly the opposite.

It shows that evidence can still defeat hierarchy.

That learning can still defeat reputation.

That truth can still defeat sunk institutional commitment.

And that the organisation remains capable of correcting itself.

THE ABILITY TO REACH A DECISION IS GOVERNANCE.THE ABILITY TO REVERSE ONE MAY BE THE HARDER TEST OF INTEGRITY.

So perhaps every board should ask one deceptively simple question:

🚨 WHAT EVIDENCE WOULD MAKE US CHANGE OUR MIND?

If the organisation cannot answer it,

perhaps the investigation is no longer testing the conclusion.

PERHAPS THE CONCLUSION IS TESTING THE EVIDENCE.

References

Columbia Accident Investigation Board (CAIB) (2003) Columbia Accident Investigation Board Report, Volume I. Washington, DC: National Aeronautics and Space Administration.

Francis, R. (2013) Report of the Mid Staffordshire NHS Foundation Trust Public Inquiry. London: The Stationery Office.

House Committee on Transportation and Infrastructure (2020) The Design, Development & Certification of the Boeing 737 MAX. Washington, DC: U.S. House of Representatives.

Kunda, Z. (1990) ‘The case for motivated reasoning’, Psychological Bulletin, 108(3), pp. 480–498. doi:10.1037/0033-2909.108.3.480.

Morrison, E.W. and Milliken, F.J. (2000) ‘Organizational silence: A barrier to change and development in a pluralistic world’, Academy of Management Review, 25(4), pp. 706–725. doi:10.5465/AMR.2000.3707697.

Securities and Exchange Commission (2018) ‘Theranos, CEO Holmes, and Former President Balwani Charged With Massive Fraud’, SEC Press Release 2018-41, 14 March.

Smith, C.P. and Freyd, J.J. (2014) ‘Institutional betrayal’, American Psychologist, 69(6), pp. 575–584. doi:10.1037/a0037564.

Staw, B.M. (1976) ‘Knee-deep in the big muddy: A study of escalating commitment to a chosen course of action’, Organizational Behavior and Human Performance, 16(1), pp. 27–44.

Vaughan, D. (1996) The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA. Chicago: University of Chicago Press.