Effective corporate compliance and risk management programs are all about how to make a large organization run well. So within that frame, the school shooting in Uvalde, Texas, last week is an awful, heartbreaking case study for corporate compliance programs, because we can find failures at almost every level.
Indeed, what torments me most about Uvalde is that the only people who didn’t fail at their duties were the teachers giving their lives to protect the students, and the students themselves doing what they’d been told: call 911. Everybody else — the police, the school district, lawmakers allowing gun violence to wrack this country, and the public who voted those lawmakers into office; everybody else — we failed them.
Some people might say it’s crass to use this tragedy for a compliance analysis. I disagree. Nineteen children and two teachers lost their lives because society got something wrong here. We owe it to them to squeeze every last bit of wisdom that we can from this awful thing, so we can try to do better now.
The lessons of Uvalde fall into two parallel tracks. Or, more precisely, we have a bundle of small lessons to consider about controls, training, organizational culture, and the like; plus one enormous lesson about ethical priorities that exists apart from all the others. I’ll start with the smaller, practical lessons and save the enormous one for the end.
Lessons on Controls
First we have lessons of procedure and control design. Around 11:27 a.m. on the day of the shooting, a teacher at Robb Elementary School propped open a door that was supposed to have remained closed. The shooter, Salvador Ramos, had just crashed his vehicle into a ditch near the school at that time, and used that open door to enter the building.
We still don’t know why the teacher propped open that door, and I am not blaming the teacher (who will probably spend the rest of his or her life in anguish) for causing the shooting. Ramos was armed with an AR-15 and he would’ve had no trouble shooting that door to pieces.
The lessons here are more about how policy, procedure, and control design should support each other. For example, let’s say you have a policy to keep doors locked and closed at all times for safety reasons. How could you then design a control to make obeying that policy easy? Because it’s not unreasonable for an employee to think, “Oh crap, I just need to run outside for a moment; I’ll prop open the door rather than fumble for my keys, and return right away.”
Well, your company could implement some system of keycard access, to make opening and closing doors a speedy, hassle-free process. Maybe you could design security systems to alert a central office when a door is left open.
Perhaps this teacher propped open the door because ventilation in the school was poor; or maybe he or she already had a sense that a shooter was nearby, and the teacher was preparing for a speedy evacuation. We don’t yet know the reason. For now, the rest of us should focus on the broader point: you can’t just have a policy for its own sake; you also need controls that work and help employees to follow the policy.
The Police Response: Lesson 1
Much more troubling, of course, was the response of the Uvalde police. If we want to talk about organizational failures, compliance and risk professionals should look here far more than at any propped open doors.
The most generous explanation for the Uvalde police would be to say they suffered failures of information and communication. More than a dozen officers were armed and inside the building, but rather than storm the classroom and kill Ramos, they waited in the hallways for more than an hour.
Why? Supposedly because they believed all his victims were already dead. In hindsight we know that was wrong; students inside the classroom were calling 911 and begging for police to storm the room. If that information was not being relayed to police commanders at the school, that was a horrific failure of information and communication. The COSO internal control framework even has a principle dedicated to this exact issue:
Principle 14: The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
COSO uses pretty anodyne language, but Principle 14 drives at a critical point: organizations need to relay information to the appropriate decision-makers as quickly as possible. For high risks (and for police, there is no higher risk than an active shooter) that information needs to be relayed immediately.
So another lesson for the rest of us is the importance of information and communication systems, especially during times of crisis. Know what your highest risks and greatest crises are. Know what information you’d need to relay, and to whom, during those scenarios. Test that your communication procedures work.
Except, here in the real world, I’m not sure that information failures were the issue with the police.
The Police Response: Lesson 2
Even more disturbing is the possibility that Uvalde police did know children were being murdered inside the classroom, and officers still decided to wait in the hallway rather than enter and try to kill Ramos.
The impulse here is to call these officers cowards, and that certainly feels right to me; but the truth is that we don’t yet know why the police behaved the way they did. So I’m going to hold my rage in check while the Justice Department and others investigate the officers’ conduct.
The bigger question here, however, is whether there were failures of training and corporate culture — failures that might plague police departments more generally, at that.
That is, most people would say the mission of police is to serve and protect the public — including the implicit risk that an officer might die in the line of duty while trying to save the lives of others. Even police officers themselves (at least, the ones I’ve known over the years) would readily agree with that statement.
Except, somewhere along the line, that mission of “serve and protect” brushed up against its darker cousin, “dominate and survive” — where officers exert dominance until others understand that they, the officers, are in charge. (If you doubt this, watch the video of Derek Chauvin, the officer who murdered George Floyd. Watch how he glared at civilians, daring them to challenge his authority while he chokes the life out of Floyd.) And in situations where officers can’t dominate right away — like, say, an active shooter with an assault rifle and body armor — then they wait for reinforcements until they can dominate.
Not many police officers are like this; but too many are. Their training and corporate culture drift away from their primary mission to serve and protect, toward the more seductive idea of dominate and survive. Hence we see the Uvalde police posting photos of SWAT gear and assault vehicles on Facebook; but when children’s lives depended on the officers risking their own, the officers didn’t.
Hence we’ve also seen the videos of Uvalde police too busy subjugating parents to bother with taking down the gunman killing their children. And hence we’re all now disgusted with the Uvalde police in particular, and wondering whether our faith in police has been misplaced all along. (And only white people are considering that possibility now, by the way. Black people have lived with this unease and distrust for years. I don’t blame them.)
The Biggest Lesson of All
For all the above talk about control design, communication, and organizational culture, those lessons pale in comparison to what’s really wrong in the United States that allows gun violence to flourish.
We refuse to do a root cause analysis, because Republican lawmakers have a set of ethical priorities that puts money and power ahead of public safety.
The root cause of the Uvalde tragedy — and the massacre in Buffalo on May 14, and so many other shootings before that — is easy access to assault weapons; that’s it. Ramos even wanted to buy an assault rifle sooner, but had to wait until he turned 18 on May 16. He followed the law in Texas, which allowed an immature and disturbed 18-year-old to buy assault weapons. So did Payton Gendron, the 18-year-old who legally bought an XM-15 assault rifle before murdering 10 people in Buffalo.
If 18-year-old boys can legally buy assault weapons to murder people, that tells us the laws are too weak. That is the root cause of these tragedies.
So why does the United States not perform that root cause analysis? Why don’t we address the problem? Because the Republican Party has a different set of ethical priorities from the rest of America, where GOP lawmakers prize power and money from the gun lobby over the lives of civilians.
There’s an important distinction here, too. I don’t say Republican lawmakers have a different set of ethical values, because they do care about public safety. They just have a different set of ethical priorities, where money and power come before public safety.
Too often, people in the ethics and compliance community talk about “ethical values.” That language misses the mark. The true mark of a successful organization is that its members all have roughly the same ethical priorities: an agreed order or which ethical values come first. That’s why we see companies that boast a great set of ethical values, yet they still commit all manner of misconduct; they don’t make following those values a priority. It requires leadership and commitment.
The same dysfunction plagues our political system today. The root cause of the problem is easy access to assault weapons, and the proper response would be to ban the sale and possession of them. Except, we won’t, because Republican leaders accept gun violence. They accept the slaughter of innocents in exchange for power and money.
Republicans, as a party, have decided to foist this blood-steeped risk onto the public. Nobody else asked for it or wants it, but until we expel the Republican Party from power, we need to engage with it.