Decision Accounting

The Decision Accounting as a Report-Incentive Mechanism paper models Field 17 as a verifiable report. A decision-maker bears cost kappa to truthfully record the welfare impact W. A misreport is detected ex post with probability p by an independent reader (one of the seven Conflictoring lanes). On detection the decision-maker bears liability L. Truthful recording is a best response iff pL >= kappa (Proposition D.1). This is the condition that makes Decision Accounting a mechanism rather than a rhetorical disclosure field. The condition also separates DA from Myerson-Satterthwaite's private-value impossibility, which shows that no efficient bilateral trade mechanism exists when parties have private information about their own valuations. DA avoids this impossibility because Field 17 is not private information; it is a verifiable report about the system, not about the decision-maker's private value. The unpredictable-reader property makes the detection probability harder for the writer to game. If the writer knows exactly who will read the record, they can tailor the record to that reader's expectations. If the reader is unpredictable — a regulator, a litigator, a journalist, a grand jury — the writer cannot optimize the record for a single audience, and the detection probability rises.

The information-exclusion paper treats the Missing System Theory (W excluded from the parties' payoffs by construction, per the theorem chapters) as an information-exclusion result. In markets, the same fact means W is absent from the disclosed records firms and markets report, by the same construction that keeps W out of the payoff space. The off-ledger status of system welfare creates a specific informational friction. Because the welfare-destruction coefficient β_W is not part of any mandatory or customary disclosure, it is not reflected in equilibrium prices. This explains two empirical observations together: no ex-ante premium for system-welfare risk, and a positive first-mover disclosure advantage for the first firm that voluntarily discloses its system-welfare impact. The system coordinate is absent from the financial statements firms file by construction — the barrier is disclosure exclusion, not estimation cost. Estimating it is cheap: with the published β_W library for the 61 studied market failures and an AI assistant, a firm can convert a domain coefficient into its own system beta in under an hour. Decision Accounting becomes the disclosure event that carries the coordinate. The measurement claim is rank and sign based, not level dependent: DA requires a directional assessment good enough to distinguish degradation from preservation, not a precise level.

The Evidence That Decision Accounting Works paper formalizes a falsification condition: if any organization with a fully implemented Decision-Accounting system suffers a comparable failure, the framework is falsified. This is a strong condition. It means Decision Accounting makes a testable prediction: organizations with fully implemented DA systems will not suffer catastrophic governance failures of the kind that have historically occurred without DA. The burden of proof then shifts to the skeptic to produce a counterexample. The paper presents six documented cases: four where the absence of a DA record enabled catastrophic governance failures (Wells Fargo, Purdue Pharma, Volkswagen, UK Post Office Horizon), and two where the presence of DA records prevented harm or caught bad decisions (Singapore MAS, UK SM&CR). The paper holds the evidence to the standard of investigative journalism: concrete, verifiable, and large-scale. The falsification condition is a specific, testable claim that a single counterexample can disprove.

Field 16 is PREDICTION: a quantified pre-decisional prediction with confidence interval and time horizon. This is the only field that is testable after the fact. The decision-maker must state, before the decision, what they expect to happen and with what confidence. After the fact, the prediction can be compared to actual outcomes. This converts conformism from invisible to detectable. A decision-maker who makes a prediction that is systematically wrong, or who systematically avoids making testable predictions, reveals something about their decision process that would otherwise remain hidden. Field 16 is the mechanism that makes the decision record auditable. Without it, the record is a narrative that can be optimized for any audience. With it, the record contains a testable claim that can be evaluated independently of the narrative.

Sixteen regulatory regimes on four continents independently converged on the same reconstruction architecture over sixty years, without coordination. The convergence stayed invisible because of disciplinary silos. Banking regulation is studied by financial economists. Nuclear safety is studied by reliability engineers. Aviation certification is studied by human factors researchers. Pharmaceutical approval is studied by regulatory science specialists. No discipline cross-references the others. The convergence pattern becomes visible only when the regimes are read across simultaneously. No single researcher or regulator had the incentive or the data to compare decision records across banking, nuclear safety, aviation, and pharmaceuticals. The convergence went unexamined. Decision Accounting is the result of reading across all of them at once and asking what they all require. The answer is that the core governance fields appear in every single regime. The two missing fields, Prediction and System Welfare, are the logical completion of a structure that regulators have been building for sixty years without naming it.

The information-exclusion paper treats the Missing System Theory (W excluded from the parties' payoffs by construction, per the theorem chapters) as an information-exclusion result.

The Decision Accounting as a Report-Incentive Mechanism paper introduces the unpredictable-reader property. If the writer knows exactly who will read the record, they can tailor the record to that reader's expectations. This is Prat conformism¹⁸: the writer optimizes the record for the known evaluator rather than for accuracy. If the reader is unpredictable — a regulator, a litigator, a journalist, a grand jury — the writer cannot optimize the record for a single audience. The detection probability rises because the record must be accurate enough to survive scrutiny from any possible reader. The unpredictable-reader property is what makes the Conflictoring protocol effective. Conflictoring is a seven-lane protocol¹⁹ — employees or whistleblowers, CEOs and boards, plaintiff litigators, shareholders, regulators, policymakers, and communities and the affected public — that imposes costs simultaneously so reform becomes less expensive than preserving the destructive game. Each lane has a different interest and a different reading of the record. The writer cannot tailor the record to satisfy all of them simultaneously, so the only safe strategy is to record the truth.

Conflictoring's seven lanes (see the Conflictoring chapter) each carry a different role and incentive — inside knowledge, standing to sue, sanctioning or rule-making authority, capital that can move — and any of them can trigger review of the same record. When all seven lanes can trigger review of the same Decision Accounting record, the cost of continuing the destructive game rises. The writer cannot tailor the record to a single predictable reviewer. Conflictoring raises the detection probability p by making the record legible to multiple reviewers²⁰ with different incentives.

> The protected case reconstruction describes a Boeing 737 MAX²¹ certification decision involving an > MCAS (the Maneuvering Characteristics Augmentation System, the 737 MAX's automated nose-down flight-control feature) design and training pathway intended to preserve continuity with earlier 737 models. The > retrospective record question is harder: which alternatives were rejected, what safety outcome was > predicted, and what risk to the airworthiness system was accepted? > > The protected teaching material uses a 346-fatality figure²² for the two crashes; the external case > receipt for that figure remains pending. The material treats the certification failure as a > decision-provenance problem alongside engineering and oversight questions. This chapter does not > claim that a record alone would have prevented the crashes. It asks what a contemporaneous record > would have made explicit while the choice remained open. > > The three questions belong on that record: what other designs and training paths were considered > and rejected; what the decision-makers predicted; and what the decision did to the public > airworthiness and certification system on which every party depended. *(Narrator throughline, carried in from the opening chapter: the missing ledger line. Its recurring question — what was decided, who gained, what system carried the residual, what changes the next decision? — is exactly the shape of a decision record. This chapter builds the record that answers it.)*

The pattern the record exists to break Protected Chapter 9 identifies a recurring pattern in four governance cases: relevant information existed before the failure, yet no structured, contemporaneous record forced the decision-maker to state the alternatives, prediction, and system-welfare effect. A later examiner then reconstructs the choice from emails, logs, minutes, and testimony. The source presents record absence as a necessary condition in those cases. That is a falsifiable case-based claim, not proof that record absence causes every governance failure. Decision Accounting asks what changes when reasoning is captured at the moment of decision, by the decision-maker, in a structured record available to authorized later examiners. The seventeen fields, in three components Decision Accounting is a seventeen-field decision record in three components. Its core governance fields recur, often without a shared schema, across regulatory regimes on several continents. The Conflictoring chapter documents that recurrence; this chapter uses the schema to build a record. Component 1 — governance (Fields 1–14). These fourteen reconstruct the ordinary decision record — the information any competent examiner would need: WHO, WHAT, WHEN, WHERE, WHY, EVIDENCE, AUTHORITY, TRAINING, REVIEW, STAKEHOLDERS, CONSEQUENCES, CONSTRAINTS, UNCERTAINTY, COMMUNICATION. *(That is all fourteen listed; every shorter list of the record's fields in this course is marked partial — e.g. "among the seventeen fields.")* Component 2 — prediction and alternatives. > Field 15 · ALTERNATIVES — the strongest options considered and rejected, and why each was > declined. It records the decision space, including what was foregone. > > Field 16 · PREDICTION — a quantified, pre-decisional prediction with a confidence statement and > time horizon. It creates a claim that can later be scored against the outcome. Component 3 — system welfare. > Field 17 · SYSTEM WELFARE — the decision's impact on the system that makes the transaction > possible: the system and boundary, direction and plausible scale of impact, evidence and > uncertainty, and any review trigger. A calibrated crossover horizon may be attached when the > record includes an R3 trajectory analysis; it is not a universal Field 17 requirement. Why these last three, and why here: Field 17 carries the coordinate that — by Missing System Theory — cannot be derived from the two parties' payoffs (the formal statement "W is not a function of the parties' payoffs" is the theorem chapter's; recall only). Field 16 makes the record checkable at all. Field 15 shows whether the excluded coordinate was ever weighed. The preceding chapters argue the coordinate is real and unmeasured on any existing ledger; the record is where it finally gets written down. What reconstruction recovers, and why the record is append-only Reconstruction has a precise meaning here: the system can recover the *point-in-time governance state* — the rules, authority, decision records, and prior decisions that governed the organization at a particular moment. The state answers: what did this organization know, decide, predict, and accept at that time? A structured index may make retrieval fast, but this chapter makes no universal time guarantee. That only holds if the governance history is append-only. Once timestamped, the original content is preserved; a clarification, correction, reversal, or mitigation becomes a new linked record. Authorized viewers therefore see what was written then and what changed later. The multi-audience chapter owns the separate access layer: lawful redaction of a view, restriction of personal data, retention rules, and anonymized derived datasets can protect people without rewriting the protected source history. The prediction→outcome loop Field 16 is what turns a record from a narrative (reshapeable to flatter any later reader) into a claim (gradeable against reality). The loop is simple and is the engine of the whole architecture: 1. Before the decision, the named decision-maker writes Field 16 — the expected outcome, a probability or quantified uncertainty range, a horizon. 2. The record is timestamped and sealed (append-only). 3. After the horizon, the prediction is scored against what happened — for example, with a Brier score, a fixed rule that rewards calibrated probabilities and penalizes confident misses. 4. Repeated exceptions, missed reconsideration triggers, weak entries, and adverse outcomes accrete into a timeline. That timeline is what catches normalization of deviance — Diane Vaughan's term for a lowered standard drifting into "normal" before it becomes catastrophic. A single review sees one exception and waves it through; a scored, append-only record shows the slope — the standard being lowered again and again while the predictions quietly stop matching. Showing the work improves the work, because a careless prediction or a formulaic rationale becomes visible to a future reviewer *while the choice is still open to revision.* *(Two neighbours live elsewhere and are recalled, not taught: whether the writer reports Field 17 honestly depends on the multi-audience incentive architecture owned by the multi-audience chapter. The seven review lanes that activate claims are the Conflictoring chapter's. Here we build the record they read.)*

R3 and T^∗ in plain language — Field 17 application The fiscal-capture chapter owns the R1/R2/R3 design requirements. This subsection applies the R3 requirement to a Decision-Accounting record; it does not introduce a second R3 definition or calibration authority. R3 is the trajectory requirement: record how the system condition is expected to change over time and identify the horizon at which accumulated system loss would overtake the private saving, if the parameters can be calibrated. T^∗ is that crossover horizon. Show the private saving δ in dollars, the annual system-loss rate λ in dollars per year, and the feedback fraction η; in the simple linear model, T^∗ = δ/(ηλ). If η = 0, the linear model has no finite crossover because no system loss feeds back into private surplus. This is a model-derived horizon, not a calendar date or a prediction that collapse will occur. If the parameters, units, or system boundary cannot be supported, write “T^∗ not estimated” and explain which input is missing. R3 is the trajectory component of the Decision-Accounting record: when a calibrated trajectory is in scope, record T^∗; when the inputs do not support a finite estimate, record that status and the missing receipt. Field 17 remains the system-welfare field. Worked — draft Fields 15–17 for the MCAS decision. *(A reconstruction exercise. The entries below are illustrative of what each field would hold, not a transcript of anything Boeing wrote — the point is the shape of a good entry.)* > Field 15 · ALTERNATIVES. Considered and rejected: (a) read MCAS from both angle-of-attack > sensors (sensors measuring the aircraft's nose-up or nose-down angle) with a disagree-alert (an > alert when the sensors conflict) as standard equipment — rejected on cost and on the risk of triggering > new pilot-training requirements; (b) require simulator-based differences training for MAX pilots — > rejected to preserve the "same type rating" (the pilot certification category covering the aircraft > family) selling point. *Recorded rejection reason for each, > named.* > Field 16 · PREDICTION. "With single-sensor MCAS and no disagree alert, we expect no > MCAS-attributable loss-of-control accident over the fleet's first 5 years; confidence 95%." *(A > testable claim with a horizon — the kind of entry that, sealed before the fact, would have been > scored against Lion Air 610 and Ethiopian 302 and found badly wrong.)* > Field 17 · SYSTEM WELFARE. System: public trust that a certified airliner is airworthy, and the > certification regime that underwrites it. Boundary: the MAX certification and operation period, > with the affected flying public and airworthiness institutions named. Direction and magnitude: > negative, potentially catastrophic (mass-fatality, fleet-grounding scale). R3 application when > calibratable: if the private saving and system-loss trajectory can be calibrated, record the > resulting crossover horizon T^∗ and its parameters. If the available evidence cannot support a > finite estimate, record T^∗ not estimated and identify the missing input or receipt. In this > illustrative reconstruction, the immediate failure consequence is the stated boundary assessment; > no calibrated T^∗ is claimed. Notice what the record forces: Field 15 puts the safer design *on the page as a thing that was declined and why*; Field 16 stakes a confidence that reality can refute; Field 17 names the third party — the flying public and the trust system — that the two commercial parties' payoffs never showed. Faded — SVB, a non-decision. In 2021–22, Silicon Valley Bank repeatedly chose not to hedge its interest-rate exposure (protect holdings against losses when rates rise) as the Federal Reserve signalled rate rises. Inaction that repeats against arriving warnings is itself a decision, and the record has to hold it. You are given the scene and Field 17 ("System: depositor confidence and the regional-bank funding system; direction negative; crossover when a rate shock forces asset sales into a deposit run"). You write Field 15 (what hedging or duration-shortening alternatives were on the table, and the stated reason each was passed over) and Field 16 (a quantified, horizoned prediction for the un-hedged book). Independent — transfer. Take a decision you can source — the UK Post Office's reliance on the Horizon IT system while prosecuting sub-postmasters, or a material decision in your own organization. Draft Fields 15, 16, and 17 from scratch: alternatives considered and rejected with reasons; a prediction with a probability or quantified uncertainty range and horizon; and a system-welfare entry naming the system, boundary, direction and magnitude, evidence, uncertainty, and review trigger. If the case supports calibrated trajectories, add an explicitly labeled R3 annex defining T^∗, its parameters, and its horizon. If it does not, state why T^∗ cannot be estimated from the available evidence. Then answer in one paragraph: would sealing this record before the decision have changed the outcome — and through which of the three fields? <details><summary>Complete answer key for the faded and independent work</summary> Faded SVB answer. A passing Field 15 identifies at least two feasible contemporaneous responses to duration risk (losses on long-maturity assets when rates rise), such as hedging or reducing duration, and records the decision-maker's reason for rejecting each. A passing Field 16 states an observable balance-sheet or liquidity outcome, a probability or bounded confidence statement, and a horizon. It does not use later events as if they were known. Field 17 is already supplied; the learner must keep its boundary on depositor confidence and the regional-bank funding system. Independent answer standard. Field 15 names genuine alternatives and rejection reasons. Field 16 is written before the outcome in the logic of the exercise, is observable, states confidence, and has a horizon. Field 17 names a system beyond the direct parties, fixes its boundary and direction, states evidence and uncertainty, and avoids unsupported precision. The final paragraph distinguishes making the reasoning inspectable from guaranteeing prevention. Full credit requires all three fields, correct labels, a sourced case, and one explicit limit on the counterfactual claim. </details>

> An organization keeps detailed documentation: every meeting minuted, every email retained, a > full paper trail a later investigator can comb through. Does that give it what a Decision > Accounting record gives it? > *(a) Yes — a complete contemporaneous paper trail is the decision record · (b) No — a trail is > reconstructed after the fact and holds no pre-committed, scoreable claim.)* > > (b). The misconception is that retention equals accounting. A paper trail is exactly the > fragments an examiner reconstructs from — it records what was said and sent, not necessarily > what was predicted and accepted. Without a Field 16 pinned before the outcome, the retained > material lacks that pre-committed scoring path. Without a Field 17, the record does not supply a > recorded system-welfare account; whether related information appears elsewhere is a document > question. An R3 crossover calculation supplies the trajectory component when its parameters can be > calibrated; otherwise the record states why T^∗ is not estimated. It never substitutes for Field > 17. The record's power is a pre-committed, append-only claim that a later > reader can grade.

> The record only bites if its reader cannot be predicted and pleased in advance. A writer who knows > exactly who will grade the page will write for that one audience — and Field 16 goes soft, Field 17 > goes flattering. the multi-audience chapter: why the record has to face many independent readers at once, and what > that does to the writer who would rather be graded by a friend.