INTRODUCTION: The Wrong Envelope

You Had One Job

Sometimes in life, we say things we later come to regret. Very occasionally, those become "famous last words", something we are likely to regret, if not for the rest of our lives, for a very long time. If we're unlucky, it'll play out in public.

In Brian Cullinan's case, the famous last words were probably something he said in an interview1 in January 2017:

It doesn't sound very complicated, but you have to make sure you're giving the presenter the right envelope.

Cullinan was talking about his forthcoming role in the 89th Academy of Motion Picture Arts & Sciences Annual Awards. You and I know it as "the Oscars". At the time, Cullinan was a partner at the professional services firm PwC.

The purpose of the - now deleted but very much alive in archive form - interview was to showcase Cullinan and his fellow partner Martha Ruiz's role in supporting the awards.

Unsurprisingly, given the firm they worked for, Cullinan and Ruiz were involved in a simple but crucial logistical exercise. Their job was to count the votes and keep the names of the winners secret until the presenters revealed them during the Oscars ceremony. They would be responsible for handing over red envelopes containing the winner's name to the presenters just before they went on stage. As Cullinan's comment made clear, he had one job to do. In the same interview, he explained that nothing had ever gone wrong.

Hitting the Headlines

Until on 26 February 2017, it did. With most of the ceremony completed without incident, only one award remained. The biggest award of the night; the one for Best Picture. You wouldn't want anything to ever go wrong during the ceremony, but if it were going to happen, this would be the worst possible moment. As you'll already know or have worked out by now, this was the precise moment when Cullinan handed out the wrong envelope, and chaos ensued. If you've never seen it, or haven't watched it for some time, do take a moment to search out a clip on YouTube.

After the ceremony, PwC issued an apologetic statement explaining what had happened:

PwC Partner Brian Cullinan mistakenly handed the back-up envelope for Actress in a Leading Role instead of the envelope for Best Picture to presenters Warren Beatty and Faye Dunaway. Once the error occurred, protocols for correcting it were not followed through quickly enough by Mr Cullinan or his partner.

Thanks to the (in)actions of Cullinan and Ruiz, the winners' names were relegated to being the second biggest story of the night. The Oscars had hit the headlines for all the wrong reasons.

The Business of Influencing Human Decision-Making

As events unfolded in Los Angeles on Sunday night, I was getting ready to start my working week in London. As I waited for my coffee machine to warm up, I mindlessly scrolled through social media. It didn't take long for my feed to fill with video clips from the ceremony. Transfixed, I watched clip after clip, trying to make sense of it. Unbeknownst to the algorithms feeding my insatiable appetite, I wasn't just enjoying the drama. I had a light-bulb moment that would change the course of my career.

At the time, I was a Managing Director at the Swiss Bank UBS, responsible for Compliance and Operational Risk for the firm's asset management division and the EMEA2 region of the firm as a whole. Compliance, as the name implies, involves ensuring the firm is compliant with all applicable rules and regulations. Operational or "op" risk is about ensuring the firm minimises and mitigates the impact of "non-financial" threats such as fraud, cyber, or reputational risk. While Financial Services firms make money from taking calculated financial risks, compliance and operational risks are the kinds you want to avoid at all costs.

Having been in post for a few years, I realised that neither my job title nor my responsibilities reflected the substance of my job. Something was missing. But I couldn't work out what. The envelope incident at the Oscars - simultaneously, a compliance breach in not following protocol and an op risk incident - gave me the answer.

Thanks to Brian Cullinan, it suddenly dawned on me that the businesses of compliance and op risk were influencing human decision-making. It wasn't just part of my job. It was my job! The only way the firm would be compliant was if we could successfully influence the decision-making of the people within it. After all, you couldn't tell a company to be compliant and expect it to respond! Similar dynamics applied to op risk. Whenever things go wrong - in organisations or society - there is always a human component involved. People can create problems, for example, by giving out the wrong envelope at an awards ceremony. They can also make them worse by how they respond. Or, in the case of an awards ceremony where the wrong envelope has been handed out, don't respond.

While I didn't expect ever to have to deal with the risks associated with the delivery of award envelopes at a globally televised awards ceremony - though, as ever with risk, never say never - the case of the wrong envelope taught me a valuable lesson. Properly understanding human decision-making was a vital skill I would need to master. People, it seemed to me, were the most significant driver of risk facing the organisation, and it was my job to help mitigate that.

The Riskiest Part of Banking Isn't the Banking

I wasn't the only person thinking in those terms. Later that year, in an interview with Bloomberg Markets magazine, my ultimate boss, the then CEO of UBS, Sergio Ermotti, said:

The riskiest part of our business nowadays is operational risks. We can have hours of discussion on credit or market risks. But the one thing that really hurt in the last ten years of our industry is op risks, not credit or market risks. If you do something wrong as a bank, or you have people doing bad things within the bank, it costs you much more than any credit risk or market position.3

Which, when you think about it, is quite a statement! He was essentially saying that the riskiest thing about banking isn't the banking. The riskiest thing, Ermotti is saying, is poor decision-making by the bank or its employees. Notice how he distinguishes between doing "something wrong as a bank" and "people doing bad things within the bank". You can see something similar in PwC's statement about the Oscars incident. By emphasising a failure to follow protocol, they're seeking to reinforce the fact the organisation didn't sanction the "bad" behaviour.

To understand why Ermotti might choose to differentiate between the firm's and its employees' decisions, we need to go back to the circumstances of his appointment. In 2011, he'd become CEO of UBS following the resignation of his predecessor Ossie Grubel after the discovery of a rogue trader in the firm's investment bank. Between 2008 and 2011, a trader called Kweku Adoboli engaged in unauthorised trading activities that ultimately resulted in $2.3 billion in losses. At one point in time, Adoboli's trading positions exposed the firm to risk of losses of an eye-watering $11.8 billion.

It's a story I know well because it unfolded on my watch. On September 14, 2011, Adoboli, already subject to a UBS internal investigation into his trading activities, left the office and sent an email admitting what he'd done.

Just ten days earlier, I'd started a new job at the Financial Services Authority, the industry's then regulator, as the head of department responsible for supervising the UK operations of non-UK banks. Since Adoboli was based in London, it fell to my team to lead the regulatory response. As we investigated what had happened, our work focused on understanding how Adoboli had managed to do what he did and ensuring there couldn't be a repeat. But on a personal level, we couldn't help wondering what had driven him and how he'd justified his actions to himself.

Many of the answers came during Adoboli's trial. I was particularly struck by the words of the judge who, in sentencing him to seven years in prison, told him he was

profoundly unselfconscious of your own failings. There is the strong streak of the gambler in you, born out by your personal trading. You were arrogant enough to think that the bank's rules for traders did not apply to you. And you denied that you were a rogue trader, claiming that at all times you were acting in the bank's interests, while conveniently ignoring that the real characteristic of the rogue trader is that he ignores the rules designed to manage risk.4

I don't think Adoboli ever deliberately set out to break the rules. But somehow he did, on an astonishing scale.

Human Risk 1

Equally, Brian Cullinan clearly didn't set out to disrupt the Oscars. Most of us don't come to work to break the rules, make mistakes, or cause problems. Yet we all have the potential, and a few of us do.

On the face of it, Cullinan and Adoboli have absolutely nothing in common. One was a senior partner at a professional services firm who made one simple mistake on a public stage. The other was a mid-level investment banking...