The Test That Could Not Lose

The claim

In 2016 Markus Schwaninger and Christine Scheef set out to falsify the Viable System Model. A year later Michael Dominik Pfiffner defended a dissertation at Utrecht that rated 135 Swiss organizations against it. These two studies put numbers on the model’s central claim. They were not the first to try. Schwaninger and Scheef build on two earlier St. Gallen dissertations, by Benjamin Frost (2005) and Cristina-Ioana Crisan Tran (2006), which they credit with making the model accessible to quantitative analysis for the first time.^[1] We have not read either dissertation, and this chapter examines only the two later studies. Between them, those two did more than anything else we have read from the tradition’s fifty years. We owe their authors that debt before we state the charge.

The charge is the same for both, and it concerns design, not competence. Neither study was built so that a negative result could cost the model its central claim, and neither concealed the fact. In the first it shows in the sentence that explains away the one hypothesis that failed. In the second it shows in the construction of the dependent variable and in the specification of the statistical model, both set out plainly in the text, and neither of which the author appears to have seen as a problem.

An earlier draft of this chapter called the first study the only test ever run. That was wrong twice over, and instructively so. The second study is not in the journals this tradition reads; it turned up on a practitioner body’s resource page, not in a database. The two earlier dissertations we learned of only from the St. Gallen paper’s own review of earlier work. A field that cannot locate its own empirical work makes in its bibliography the error this book charges it with in its theory.

The St. Gallen test, 2016

Schwaninger and Scheef state the standard at the outset: the falsification criterion is widely considered stronger than the confirmation criterion, and they will test the theory of the Viable System Model according to the former.^[2] Their design is a survey, 261 usable questionnaires from respondents who were mostly senior managers, testing whether the presence and quality of the model’s components predict organizational viability.

Viability is not measured directly. Organizational culture stands in for it, and the same respondents rate both the components and the proxy.^[3] Of the eight hypotheses, the component hypotheses 1, 2, 4 and 5 are supported, and so are 6 and 7, which take the components together. Hypothesis 3, concerning System Three, is rejected; its coefficient is negative. Hypothesis 8 is not supported. The conclusion: they have not succeeded in a falsification of Beer’s allegation that the model specifies the necessary and sufficient preconditions for the viability of an organization.^[4]

Three features of that design come before the substantive point. None of them is unusual in management research, which is part of why they passed.

The proxy carries the whole test. If viability is operationalized as organizational culture, what was tested is the relation between the model’s components and a culture measure. The inference to viability is then only as strong as the argument that culture indexes viability, an argument the paper would have to make and a reader should look for. Whether the model’s constitutive claim survives depends entirely on that bridge.

The common source is a known hazard. When one respondent supplies both the independent and the dependent measures, correlation between them is expected on methodological grounds alone, whether or not the underlying relation exists. The literature on common-method variance was already large in 2016. The authors report no marker variable or post-hoc test for it. They list the single informant among their limitations and recommend different informants for the two sets of variables in future work.

With self-report on both sides, the test asks managers whether their organization has the five functions and whether it has a good culture. Managers who believe in the one are likely to report the other. The test examines a belief structure at least as much as an organization.

The move that matters

These three features are not why the chapter exists. Design limitations are ordinary and correctable, and most of the management literature reports them honestly. The reason is what happened to Hypothesis 3.

System Three failed its test. The paper responds that it would be naïve and premature to conclude that this component is less important than postulated by theory,^[5] and attributes the failure to changed organizational forms and to measurement.

Both explanations may well be correct. What matters is when they arrived: after the result, with no rule set beforehand saying what a rejected hypothesis would be allowed to cost. Without such a rule, “changed organizational forms” and “measurement” can absorb any negative finding whatever, about any component, in any future study. They are the general-purpose absorbers that Chapter 9 says our vocabulary supplies on demand, turning up in the one place in the literature where they should have been ruled out in advance.

A falsification test without a declared revision rule is a confirmation exercise in statistical dress. The authors’ integrity is not in question: they reported the rejection instead of burying it, which is the harder thing. The design is in question, because it had no way of losing. Had all five component hypotheses been supported, the model would have been corroborated. One was rejected, and the model was corroborated. The conclusion did not depend on the data, and the paper’s own framing sentence supplies the standard by which that can be said.

The same paper makes a second move that compounds the first. It sets aside the critiques by Ulrich and by Amey on the ground that neither is of the empirical type, being rather deductive and often normative rather than descriptive.^[6] The Ulrich they set aside is Critical Heuristics of Social Planning (1983); Chapter 16 shows what his earlier critique of Cybersyn establishes, and it is more than a matter of taste. A study that admits only empirical testing as criticism, and then explains away the one negative result of its own empirical test, has left no channel open in either direction.

Pfiffner’s test, 2017

The other study is a doctoral dissertation defended at Utrecht University on 20 November 2017: Michael Dominik Pfiffner, System viability of organizations and the aetiology of organizational crisis: A Quantitative Assessment of Stafford Beer’s Viable System Model, 313 pages.^[7] It is more ambitious than the 2016 study and better designed exactly where that study is weakest, and it fails in a more interesting way.

What it does, and what it gets right

Pfiffner turns the viability conditions into a questionnaire with a method he developed for the purpose, the situation vignette: an idealized control situation, stated in plain business language, against which a real organization can be compared. The sample is 135 organizations in German-speaking Switzerland, split in advance into two groups, 74 that had undergone an existential crisis and 61 that had not. Crisis is defined narrowly, and the definition holds throughout: a slowly developing existential threat to the whole organization, with disasters, sabotage and force majeure excluded.

Three of his design choices come first, because they are better than this tradition’s norm and better than the 2016 study.

The organizations are not rated by their own managers. Pfiffner rules that out explicitly: crisis is the worst thing that can happen to an organization, and denial is the natural response. The raters are 22 third parties with close professional knowledge of the organizations: 16 bankers, including recovery and special-financing officers, five consultants from the author’s own firm, and one fiduciary. Each had to clear a threshold on a control variable for case knowledge.^[8]

The raters did not know the theory. Only two of the 22 said they had known the Viable System Model before the survey. They answered questions about functional traits in business language, unaware that they were performing a cybernetic analysis. Whatever else the instrument measures, it does not measure the raters’ belief in Beer.

And Pfiffner defines the word predictive instead of trading on it. In his hypothesis, he states, it “refers to the anticipation of the dependent variable out of independent variable scores”: statistical prediction within one dataset, not measurement at one time and observation at a later one. An earlier draft of this chapter guessed that the word was carrying more weight than the design could bear. We guessed wrong. The definition is in the text, where any reader who checks will find it.

The reported result is a path coefficient of −0.701 between the system viability construct and the crisis construct, with R² of 0.5043, and a bivariate finding that the two groups differ on the viability scores at the 99 per cent level. He also reports a threshold: at or below a viability score of 92 out of 176, every organization in the sample had experienced a crisis.

Where the test stops being able to lose

The trouble is in the dependent variable. It is set out plainly in the methods and again in the results, which is the only reason it can be reported here.

Crisis was meant to be a dummy: crisis yes, crisis no. Pfiffner writes that this “ultimately became technically uncertain and materially undifferentiated,” and that a combination of crisis and inverted viability indicators was used instead. The final outcome construct is the inverse of three viability items together with three crisis items.^[9]

The three viability items ask the rater to place the organization on a scale from “perishing” to “thriving”; whether it can adapt to rapidly changing circumstances; and whether it is “fundamentally in a position to maintain its existence for an unlimited period of time.” These are judgments about viability. They sit on the outcome side of a regression whose predictor is viability, inverted. Whatever the −0.701 measures, part of it is the agreement of one rater with himself.

The items that left the model are the ones that could have made it fail. Pfiffner reports that “some indicators do not add value to the analysis, so ultimately a reduced set of indicators was used.” The dropped items asked whether the organization ceased to exist as an independent unit, whether it had been unable to fulfil its core mandate, and whether it had been unable to meet its financial obligations. Demise, mission failure, insolvency: these are the hard ones, matters of record and not of judgment. What remained on the outcome side were judgments, made by the person who supplied the predictor, in the same sitting.

One pairing is close to definitional. On the predictor side, the requisite-variety items ask whether the organization’s ability to react, scope of action and range of offerings “are always sufficient to … master expected” and then “even unexpected” issues or challenges. On the outcome side, the surviving crisis item K.6 asks whether “the demands faced by the organization massively exceed(ed) its capabilities, resulting in it spinning out of control.” Pfiffner’s own commentary glosses that item as “basically a lack of requisite variety.” A predictor and its near-negation stand on opposite sides of the equation, and their correlation is reported as a finding about Beer’s model.

Two further features limit what the number can carry. The raters were asked to pick from their own portfolios organizations “which did clearly undergo” or “which did clearly not undergo” an existential organizational crisis. That is extreme-group sampling, and it inflates any association it finds.^[10] Interrater reliability rests on a single case: one organization was rated by two people, and their scores correlated at 0.73. Pfiffner reports this openly, and it is one doublet, not a reliability study.

The specification that made necessity unfalsifiable

The deepest problem lies furthest from the surface, and it decides what the study could have found.

The structural model is reflective and specified downward. Pfiffner states that “system viability causes the availability and VSM conformity of operations, of a metasystem and of the relevant VSM principles,” and that these in turn cause the availability of Systems One to Five. That reverses the claim under test. The model asserts that the five functions are necessary for viability; the statistical model treats viability as a single latent factor of which the functions are interchangeable symptoms.

In a reflective model the indicators are expected to move together, because the specification assumes they will. The loadings duly come out between 0.791 and 0.982. Pfiffner reads them as follows: the path coefficients “stand for the necessary and sufficient invariants of organizational viability as defined by the VSM… they are of equal or largely similar importance. This corresponds to the theoretical claim of the VSM that if only one VSM characteristic is lacking, the system loses its viability.”

The inference does not hold. Uniformly high loadings in a reflective model show the design working as specified; they are no evidence that each function is necessary. A test of necessity would need a formative measurement model, with the functions constituting viability instead of expressing it, and would then ask whether any one block carries weight the others cannot supply. As specified, no possible pattern of results could have shown a subsystem to be dispensable.^[11] The claim this book calls constitutive was placed, in the one study that took it as its subject, where the statistics could not reach it.

A formative specification would still leave one reply open, and the reply comes from Beer. In his texts a function is not simply missing. System Two “is always present, or the organization would shake itself to pieces”; “System Four exists — it has to: but it is disseminated, and lacks integration”; and an enterprise whose metasystem has collapsed into System Three is a “decerebrate cat” that “lives on; its viability is ensured by a bogus environment.”^[12] Pfiffner’s sentence that “if only one VSM characteristic is lacking, the system loses its viability” is his gloss. Beer’s texts treat a deficient function as a pathology, not as the end of the organization. So a study that finds a surviving organization without a recognizable System Four can be answered from the founder’s page: the function is there, unofficially. A test of necessity has to close that reply before the data arrive. It needs each function coded as official, disseminated or absent by indicators registered in advance, and an outcome that indexes viability in Beer’s sense, the capacity to maintain a separate existence, and not bare survival. The coding in Chapter 28 sets this out.

The loop, inside the study that adopts Popper

Pfiffner states his epistemology at the outset. He follows Popper, he writes, in holding that all knowledge is hypothetical and “cannot be verified but only falsified,” and he names critical rationalism as his basis.

In the discussion chapter, among the merits of the model he is using, he lists this: the VSM “has a long track record of application and (peer) review and, to date, has not been falsified.” The claim appears earlier too, quoted from Schwaninger as part of the warrant for the project: the model “has not been falsified until today”.^[13]

So Chapter 9’s charge turns up where it should be least at home. A researcher who adopts falsificationism in his Chapter 1 cites, in his Chapter 6, the absence of a falsification as a point in the model’s favor. Yet the absence is what his own discipline’s failure to look had produced, and his own study was built so that the model’s central claim was not among the things that could fail. Nothing here is dishonest. The loop simply lies in the literature, ready for anyone who wants a reason to trust the model, and it closes without anyone noticing.

What Pfiffner establishes, and what he does not

He establishes something real, and we do not want to take it away. Judgments about an organization’s control functions, made in plain language by informed outsiders who do not know the theory, separate organizations that went through an existential crisis from organizations that did not. That is a finding, the first of its kind among the studies we have read in this tradition, and more than the field had before.

Beer hoped for a result of this kind. Of his own identity exercise, in which managers answer fifteen questions built on the model, he wrote that “maybe (one day) thresholds will be established, to exceed which will predict collapse.”^[14] Pfiffner’s score of 92 is a threshold of that kind, found within one dataset. Beer’s verb was predict, and Pfiffner, by his own definition of the word, did not claim it: a threshold that predicts collapse needs the measurement to come before the collapse.

What it does not establish is the model’s constitutive claim. It does not show that five functions are necessary, or that they are sufficient, or that any one of them carries weight another does not. It does not distinguish the Viable System Model from any other instrument that asks informed observers whether an organization seems well run, because no rival instrument was tested against it. And an outcome variable that contains the predictor inflates the size of the association.^[15]

What the field did with it

The reception tells as much as the study. The one response from the practitioner network we have read cites the study as corroboration (Chapter 17). Schwaninger restated the conclusion in 2019.^[16] Michael Jackson’s 2019 textbook reported that the results “largely supported the hypotheses” and added that the authors “are, nevertheless, keen to point out that all they can definitively claim is not to have falsified the VSM.”^[17] In 2025 a PRISMA-protocol systematic review of the VSM literature reported limited empirical validation and a lack of empirical studies, with most research remaining conceptual or simulation-based. It does not cite Schwaninger and Scheef at all.^[18]

That last point survives a reading of the review’s reference list, and it is the sharpest single fact in this part. A systematic review, run under a protocol whose purpose is exhaustive retrieval, surfaced neither the 2016 test nor Pfiffner’s dissertation. Either the search missed them, which says something about how the literature is indexed and named, or they were screened out, which says something about what counts as a study of the VSM. Both readings should trouble us, and neither can be settled without opening the review’s search log.

What this chapter does not establish

It does not establish that System Three is unimportant, or that the 2016 result tells against the model. A single rejected hypothesis in a survey with a proxy dependent variable establishes very little in either direction. We concede that freely; it is the authors’ own methodological point, turned around.

Nor does it establish that a better-designed study would falsify the model. Such a study might corroborate it more convincingly than this one did, and that outcome would be worth having.

It does not establish that Pfiffner’s result is wrong. The result may be right. It is an association within one dataset, not a prediction over time, but if it holds, this tradition has spent nine years not noticing what may be its best evidence, which is an indictment of its own kind.

What it does establish is that both attempts to test the founder’s stated claim, that the model gives the necessary and sufficient conditions of viability, went ahead without the component that makes a test bite, and that the missing component is a sentence written in advance.

Receipt — the pre-registered replication, and a rule stated first. Replicate the 2016 design with four changes: a viability measure independent of the respondents’ own reports, drawn from records rather than opinion and declared in advance as an index of viability in Beer’s sense rather than of bare survival (survival, solvency, or continuation of the organizational unit over a defined window are the record-based floor of such a measure, not the whole of it, since Beer himself holds that an organization which is there is not thereby “effectively there”^[19]); separate sources for the component ratings and the outcome; each function coded official, disseminated or absent by indicators registered before fieldwork, under the coding in Chapter 28; and, before any data are seen, a registered revision rule naming which components, at what effect size and with what confidence, would be demoted from necessary to contributory. Price: one registered report at a journal with a results-blind first stage — neither Systems Research and Behavioral Science nor Kybernetes offers the format at present, so the track would have to be proposed to one of them or placed with a journal that does^[20] — plus one doctoral project’s fieldwork, or a secondary analysis of the 2016 dataset if the authors will release it, which would cost a fraction and could be requested this year. If the replication supports the components under a rule that could have demoted them, the model gains its first corroboration that means something. If a component fails under the declared rule, the rule is honoured and the claim is narrowed in print. The test is worth running only because both outcomes are payable, and neither is payable today.

Handover

Chapters 17 and 18 took the two communities that own the model. The next three take the neighbours whose criteria we borrowed, beginning with the host discipline itself.