The Narrow Claim

The Viable System Model is the only available instrument that will take a named system at a named level and say, in a vocabulary that survives the journey between a person and a planet, what that system needs in order to remain viable — although we have not operationalized that necessity claim, measured it across deployments, or designed the comparative test that could falsify it.

That is the narrow claim, and everything in Part Four is measured against it. The sentence is built so that the claim and the concession cannot be separated: a reader who quotes the first half without the second has not quoted us. Part One ended by conceding that nothing in the model’s core, the necessity of the five functions and the recursion claim, has yet been stated in a form that could be disconfirmed. We have now reached the part of the book where we say what the model is good for, and the concession comes with us.

What the claim says

Three phrases carry the weight.

A named system at a named level. Both names matter, and each fails in its own way when dropped. A named system is a particular one — this hospital, this ministry, this cooperative, this fishery — and neither an organization in general nor a class of organizations. The model is applied to a case; it makes no claim to be a theory of firms. A named level is a particular recursion: the ward, or the hospital, or the trust, or the regional system, never all of them at once.^[1] Most of the diagnostic disagreements we have witnessed in practice are level confusions. Two analysts agree entirely about the facts and disagree about which system-in-focus the facts belong to. When either name is missing, the model still generates sentences, but nobody can check them, because they have no fixed referent. Demanding both names can look like pedantry. It is the minimum condition under which anything else in the claim can be assessed.

A vocabulary that survives the journey between a person and a planet. This is a claim about the invariance of terms. We are not asserting that a person and a planetary system are alike, or that what is true of one transfers to the other. We assert something weaker and more specific. The same small set of terms (the operational units, the coordinating function, the management of the here-and-now, the intelligence directed outward and forward, the identity-setting function, the channels between them) can be applied at radically different scales without a new vocabulary at each scale. That property is bought with abstraction, and abstraction is exactly what makes a term hard to operationalize. This is why our sentence carries its concessive clause. The feature that lets the vocabulary travel is the feature that makes it hard to hold to account, and we owe the reader that sentence every time we praise the travel.

What that system needs in order to remain viable. This is a necessity claim, and it excludes two things. It is not a prediction: it does not say when the system will fail, or with what probability, or under what load. It is not a recommendation: it does not say that the system ought to continue, or that the arrangement it needs is desirable, or that anyone should build it.

The word is Beer’s, and so is its definition. Viable means “able to maintain a separate existence,” and Beer refused to let existence stand in for it.^[2] Asked whether an organization that exists is “by definition a viable system,” he answered: “The fact that it is there does not prove that it is effectively there.” The institution whose System Four is empty he called a decerebrate cat, which “lives on” and is sustained “by artificial sustenance.”^[3] A necessity claim in his sense says only that if this named system is viable at this named level, certain functions are being performed somewhere, by someone or something, however informally and however badly. That last clause is Beer’s too. System Two “is always present, or the organization would shake itself to pieces,” and “System Four exists — it has to: but it is disseminated.”^[4] A missing or degraded function then becomes a diagnosable condition rather than a stylistic preference.

The same two moves make the claim hard to embarrass. A persisting organization is read as performing its functions informally, and one that performs them badly is read as sick, not as a system that survived without them. We have not, however, stated the necessity in a form that would let a counterexample count against it; the coding in Chapter 28 is our attempt. A necessity claim that no observation could embarrass is a definition wearing the clothes of a finding,^[5] and Part One’s closing charge applies to this sentence as much as to any other in the tradition.

Why the claim had to be made smaller

Six neighboring literatures, working independently and largely without reference to Beer, arrived at levels, at coordination, at limits on the information a controller can handle, at the autonomy of subordinate units, at monitoring, and at recurrent patterns of persistence. They got there with their own evidence and their own tests, in several cases with more of both than we have. That is Part Two, and it is why the claim is this small.^[6]

So we cannot claim that Beer alone discovered the components, and we should not want to. The cost is real, and we would rather state it than have it extracted from us. The discovery claim is gone. With it goes much of what the tradition has said about itself: the singular finding, the laws first seen from one vantage point, the founder’s priority that later work merely elaborates. That story has carried a good deal of our community’s self-understanding, and it does not survive contact with the neighboring literatures. Chapter 10, Six Components, does the accounting component by component. It is not a comfortable chapter.

The reflex to avoid is treating the concession as an attack to be repelled. On any ordinary reading of evidence, independent arrival by several traditions is good news about the components. It suggests they are features of the problem and not artifacts of one modeler’s habits. What the concession damages is a claim about origin, not a claim about validity. The two have been run together for so long that separating them feels like a loss, and the loss is of a story.

We are not the first to narrow a claim about the model so that it could be checked. Michael D. Pfiffner, testing the model on 135 organizations, confined crisis to a slowly developing threat to the existence of the whole organization and set aside disasters, sabotage and force majeure, so that he could measure it.^[7] His claim, that viability as a whole bears on whether such a crisis occurs, is not our necessity claim. Chapter 28 sets out the coding a necessity claim needs, and Chapter 29 explains why his items cannot supply it.

What replaces it: an assembly claim

What remains is an assembly claim. The VSM puts the components into a closed anatomy, applies that anatomy to a named system at a named level, and returns a diagnosis rather than a list of resemblances. One component it assembles only in part: the panarchy literature’s two cross-scale couplings, revolt and remember, have no counterpart in the assembly, as Chapters 10 and 11 record.

The whole assembly claim lives in that last distinction. A resemblance says: this organization is like that pattern. It maps features onto a template and reports the degree of fit. It is reversible and nearly costless. The mapping can be redescribed, the template swapped, and nothing follows that anyone must act on or could be wrong about. A diagnosis has a different structure: this named absence, at this level, is why this named thing is failing. It has a subject (a particular missing or overloaded function), a location (a particular recursion), and a consequence attached to a particular observed failure. Someone who knows the case can dispute each of the three, and that is exactly what a resemblance never offers. The diagnostic form depends on the anatomy being closed. Because the set of functions is fixed and finite, an absence means something. From an open list, nothing could be missing.

Two qualifications belong in the same breath. First, the diagnostic form is not diagnostic accuracy. We claim that the model produces statements that could be wrong in a specified way, and not that those statements have been shown to be right. Whether our diagnoses hold up when a case is followed forward is something the tradition has not systematically checked. Chapter 29’s second experiment, ten interventions with predictions reconstructed from documents written before the outcome and the failures kept, is the check we have not run. Second, this chapter does not settle whether the assembly is unique. That is the job of Chapter 24, Six Things Nothing Else Does, which sets each candidate instrument against the assembly one property at a time. Here we fix only what follows if the assembly is not unique: the word only comes out of our sentence, and what remains is a useful instrument among several, still worth teaching and still worth testing, but no longer the ground of a distinctive claim.

Four things that do not follow

The claim is narrow at four edges, and at each of them the tradition has been tempted to spread.

The model does not predict when a named system will fail. It identifies conditions whose absence is associated with loss of viability. It supplies no hazard rate, no time horizon and no established threshold. Beer hoped for one: of his identity exercise he wrote that “maybe (one day) thresholds will be established, to exceed which will predict collapse.”^[8] None has been. A predictive claim would need what predictive claims always need: a defined population of systems, states recorded before the outcome, outcomes recorded afterward, and performance compared against a baseline that does not use the model at all. We have not done this. Reliability engineering, epidemiology and the quantitative parts of organizational ecology do it routinely and do it better. People who need a prediction should be sent to them, and we should stop implying that a structural diagnosis has a temporal edge it does not have.

The model does not yet measure how much viability or freedom the system possesses. The tradition speaks in quantities (variety, attenuation and amplification, balance) and produces outputs that are almost entirely qualitative. Chapter 26, Freedom as a Quantity, takes this seriously enough to recover the quantity and show what it would take to compute, and concedes in the same place that no deployment on record has measured it. Until one has, “sufficient variety” is a judgment call by the analyst. We should call it that and stop borrowing the authority of the measure-shaped word.

The model cannot legitimate the boundary the analyst or the client chose. Beer made the choice explicit. The method’s first step is “to determine precisely what is the organization to be modelled, and to specify its boundaries,” and he gave a rule of thumb for noticing a missing level.^[9] The model then works inside the boundary chosen, so every diagnosis it produces is conditional on a choice made before the model was applied, usually by whoever commissioned the work. No property of the anatomy makes that choice correct, and no internal coherence in the resulting diagnosis can validate it afterward. Chapter 4, Channels Without Owners, sets out the boundary questions in detail. The Coda states what follows from our having no method of our own for answering them.

The model cannot say what survival is for, or whether this is a system whose survival anyone should want. Viability in Beer is relative to purpose as perceived, and the model takes that purpose as given; it supplies no criterion for choosing among purposes. Its normative clauses, “minimum damage to people and to cost” and the Establishment as a pathology, limit how a system survives, not whether it should.^[10] An organization that should be dissolved can be made more viable, and the model will help, competently. Nothing in the anatomy supplies a criterion for refusing the work. That is the Coda’s subject, and the gap cannot be closed from inside the model.

Each of the four is a limit on our claim. None is a job to be handed quietly back to the model later, and the difference matters because that handing-back is a recognizable failure mode. When a tradition has no way of being wrong, its scope expands to fill whatever a client wants (prediction, measurement, legitimation, ethical warrant), because no test at any boundary stops it. Chapter 9 traces that pattern in our own literature. Naming the four limits here is our attempt not to repeat it, and only an attempt: the discipline holds only as long as we keep restating the limits in the places where clients would prefer to hear otherwise.

The proposition, narrow enough to risk

That leaves a proposition narrow enough to risk: given a defensible boundary and level, the VSM claims a necessary assembly for viability and a vocabulary in which absences in that assembly can be diagnosed. If another instrument already does all of that, or if the assembly cannot be made answerable to evidence, that is, if no coding and outcome of the kind set out in Chapter 28 can be registered for it, our use of only fails.

We state our own failure conditions here, in the middle of the book, instead of mounting a defense, and the reason is structural. Part Five prices a set of experiments. An experiment is worth its price only if the claim it tests could lose; otherwise the money buys illustration. A claim that survives every result is merely on display, and the tradition already owns plenty of displays. So the two conditions above are commitments, made before anyone applied pressure: we say in advance what would take the claim from us. Chapter 28, What Would Count Against It?, turns them from a statement of intent into specified tests, naming the observations that would settle each one.

The first condition comes due soonest, because it can be assessed against literature that already exists rather than against studies nobody has run. It falls to Chapter 24.