Workaround Failure-Mode and Effects Review¶
Assessment — instantiates Workaround Governance
A structured review of how a workaround and each proposed disposition can fail locally and downstream, classifying the effects and specifying the compensating controls that catch them.
Most disposition arguments dwell on how each option performs when it works. A Workaround Failure-Mode and Effects Review deliberately does the opposite: it asks, systematically, how does each option break, and what happens when it does — not only the workaround as it runs today, but each proposed disposition, including removal. Its defining discipline is completeness in the failure direction: for the deviation and for every candidate path, it enumerates the ways they can fail, traces each failure's effect locally and downstream, classifies severity and detectability across affected parties, and then specifies the compensating control that would catch or contain each significant failure. The output is not a choice among options — it is a failure-and-safeguard map that tells the decision what protections any path must carry to be acceptable. It is the pessimist in the governance process, and its pessimism is where the safeguards come from.
Example¶
A metro transit control center runs a workaround: when a track-circuit display glitches and shows a phantom occupancy, controllers apply a manual override to route trains through the section they can see is clear on CCTV. Before governing this, the team runs a Workaround Failure-Mode and Effects Review. For the workaround itself, it enumerates failure modes: the CCTV feed is also stale, the controller overrides a real occupancy, the override is applied to the wrong section under time pressure. For each, it traces the effect — worst case, two trains authorized into one block — and rates severity (catastrophic) against detectability (low, if displays disagree). Then it does the same for the proposed dispositions: eliminate the override fails if the display glitches during a real service and controllers have no fallback (service collapse); formalize it fails if the informal skill doesn't transfer to new controllers. For the significant failures it specifies compensating controls: an independent secondary confirmation before any override, a mandatory two-person rule, an audible display-disagreement alarm. The review does not pick the path — but no path leaves the room without the safeguards its failure modes demand.
How it works¶
- Analyze failure, for every option. The review runs the workaround and each candidate disposition (including elimination) through a failure lens — the pessimistic complement to arguments about how each performs when it works.
- Enumerate modes, then trace effects. For each option it lists the distinct ways it can fail and follows each failure to its consequence, locally and downstream, rather than stopping at "it might not work."
- Classify severity × detectability across parties. Each failure effect is rated for how bad and how detectable it is, and for whom, surfacing the low-detectability/high-severity cases that most need controls.
- Specify a compensating control per significant failure. The review's product is a safeguard for each failure that matters — the control that catches, contains, or backstops it — not merely a list of risks.
- Feed the safeguards forward. The compensating controls become the conditions attached to whichever path is chosen, especially any permit or transition.
Tuning parameters¶
- Coverage depth — how exhaustively failure modes are enumerated. Deeper coverage catches rare catastrophic modes but costs time and hits diminishing returns; shallow coverage misses the tail.
- Severity/detectability scale — qualitative bands versus numeric risk-priority scoring. Numbers prioritize consistently but invite false precision and can bury a rare-but-catastrophic mode under frequent-but-trivial ones.
- Options in scope — the workaround alone versus every disposition including removal. Reviewing removal's failure modes is what prevents "just ban it" from creating a new hazard; it also enlarges the review.
- Downstream horizon — how far consequences are traced. A longer horizon catches second-order and aggregate harms but adds speculation.
- Safeguard rigor — how strong the required compensating control must be per failure. Stronger controls lower residual risk but raise the cost of any path that carries them.
When it helps, and when it misleads¶
Its strength is that it manufactures the safeguards the rest of governance relies on and refuses to let removal off the hook — by analyzing the failure modes of eliminating the workaround, it catches the common error of trading a visible hazard for an invisible one, and it hands permits and transitions a concrete list of controls rather than a vague "be careful."
Its central failure mode is false completeness: the structured enumeration feels exhaustive, so the team believes it has found every way things break and stops looking — but a failure-mode analysis[n1] only covers the modes you thought to list, and the ones that cause disasters are usually the unimagined interactions. The classic misuse is treating a completed review as a safety guarantee, or computing a tidy risk-priority number and letting a rare catastrophic mode get averaged away beneath frequent trivial ones. The guarding discipline is to treat the review as a living document revisited as real failures appear, to weight severity so catastrophic-but-rare modes cannot be buried, and to pair it with monitoring that catches the modes the enumeration missed.
How it implements the components¶
This assessment fills the hazard-and-safeguard side of governance — the failure analysis that arms the safer options:
distributed_benefit_risk_classification— the review classifies each failure's effect by severity, detectability, and which parties bear it, sharpening the risk half of the benefit-risk picture with a rigorous failure lens.compensating_safeguard_plan— for each significant failure it specifies the compensating control that catches or contains it, producing the safeguard set that conditions any path forward.
It does not rank the options to choose one (multi_path_disposition_rule — that is Multi-Path Disposition Matrix), nor diagnose why the workaround arose in the first place (causal_demand_diagnosis — that is Practitioner Counterfactual Walkthrough); it maps how each option fails, not which to pick or why it exists.
Related¶
- Instantiates: Workaround Governance — this assessment implements the "assess how both the workaround and its removal could fail" step for consequence-sensitive cases.
- Consumes: Multi-Path Disposition Matrix — supplies the candidate dispositions whose failure modes the review analyzes.
- Sibling mechanisms: Multi-Path Disposition Matrix · Temporary Deviation Permit · Practitioner Counterfactual Walkthrough · Benefit-Preserving Transition Plan · Nonpunitive Workaround Review · Linked Root-Cause Repair Ticket · Recurrence and Displacement Dashboard · Structured Workaround Registry · Sunset and Reauthorization Review
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: Workaround Failure-Mode and Effects Review operates as a bounded evaluation of existing evidence or work that produces a finding or disposition because it a structured review of how a workaround and each proposed disposition can fail locally and downstream, classifying the effects and specifying the compensating controls that catch them.
Independent corroboration: The frozen evidence defines Workaround Failure-Mode and Effects Review as 'A structured review of how a workaround and each proposed disposition can fail locally and downstream, classifying the effects and specifying the compensating controls that catch them', so its operative form is Assessment, Review & Assurance.
Nearest alternative: Analysis, Modeling & Optimization — Workaround Failure-Mode and Effects Review includes features of an analytical, modeling, inference, comparison, or optimization procedure that derives insight or a solution, but its defining operation is a bounded evaluation of existing evidence or work that produces a finding or disposition.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Single lineage
Present-day reach: Multi-domain
Rationale: Enumerating how each workaround and disposition can fail, propagating local effects downstream, ranking consequences, and specifying compensating controls is Failure Modes and Effects Analysis. NASA's FMEA handbook formalizes those steps for design and process risk; organizational review applies the engineering method to improvised work.
Related originating lineages:
- Medicine & Healthcare — medicine_healthcare contributes clinical medicine, public health, and recovery practice to this mechanism's defining operation—A structured review of how a workaround and each proposed disposition can fail locally and downstream, classifying the effects and specifying the compensating controls that catch them—without displacing the selected primary historical lineage.
- Organizational & Management Science — Organizational design, management, and operational governance has a distinct contributing or parallel lineage for the mechanism's defining operation: a structured review of how a workaround and each proposed disposition can fail locally and downstream, classifying the effects and specifying the compensating controls that catch them.
- Security Studies & Intelligence Analysis — security_intelligence contributes security engineering, threat analysis, and intelligence practice to this mechanism's defining operation—A structured review of how a workaround and each proposed disposition can fail locally and downstream, classifying the effects and specifying the compensating controls that catch them—without displacing the selected primary historical lineage.
- Systems Thinking & Cybernetics — Systems science's feedback, boundaries, stocks, flows, and regulation tradition supplies an independent formative lineage for the mechanism's workaround failure mode and effects review logic.
Review resolution: The blind reviewers disagree on primary lineage (organizational_management versus engineering_design). Authoritative or primary research supports engineering_design as the best historical origin: Enumerating how each workaround and disposition can fail, propagating local effects downstream, ranking consequences, and specifying compensating controls is Failure Modes and Effects Analysis. NASA's FMEA handbook formalizes those steps for design and process risk; organizational review applies the engineering method to improvised work. The cited NASA GSFC-HDBK-8004, Failure Modes and Effects Analysis directly supports the mechanism's defining operation. All independently supported contributing domains are retained without an arbitrary cap. origin_mode=single_lineage records lineage, while domain_reach=multi_domain records later applicability separately from provenance.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Researched adjudication after independent review; high confidence.
Sources consulted:
Notes¶
[n1] Failure Mode and Effects Analysis (FMEA) — a systematic engineering method for identifying the ways a component or process can fail, the effects of each failure, and its severity, occurrence, and detectability, so mitigations can be prioritized. Its well-known limitation is that it covers only the failure modes analysts think to enumerate, which is why it must be revisited and paired with monitoring rather than trusted as complete. ↩