Coincidence is not a margin

The most reassuring sentence in a risk review is also the most misleading: we have never had an incident. It is offered as evidence the controls work. It is nothing of the kind. It is evidence that the conditions which would test the controls have not yet arrived together.

Absence of incidents is evidence of untested exposure, not effective control.

A system can run clean for years because the load never peaked, the dependency never failed, and the rare input never appeared, not because the chain that would catch those things has ever been exercised. The quiet record measures luck and traffic, not capability. When the conditions do align, the organisation discovers which of the two it was relying on.

Why the engine discounts the quiet record

AGDA™ measures demonstrated capability under stress, not the absence of past failure. A control that has never been triggered is graded on what can be shown about how it behaves when it is, through drill, through production evidence, through stress. A clean history with no such evidence does not raise measured readiness, because it cannot distinguish a strong chain from an untested one.

This frustrates the instinct to be rewarded for years without an event. The frustration is the point. The years without an event are exactly the period in which untested exposure accumulates unseen, and the only way to know which you hold is to test it before the event does.

The question that replaces the comfort

Instead of have we had an incident, the useful question is sharper and less comfortable:

• When did this control last act, in production or in drill, against the conditions it exists to catch?
• If the answer is never, on what evidence do we believe it would?
• What would the failure look like, and would we see it in time to intervene?

A margin you can name and have tested is a margin. A quiet record is a coincidence you have not yet had cause to examine.