Causal loop diagrams

As a system dynamic model is a representation of the reality, it is less complex and easier for humans to understand than the real world [4]. Simplicity assists think-ing and decision makthink-ing. System dynamic models also help improvthink-ing already ex-isting mental models, which is important to improve organizational security and development. Archetypes are short-hand versions of system dynamic models and are usually drawn as causal feedback loops, modelling a problem over time and conceptualizing real world systems. A causal feedback loop consists of arrows con-necting cause and effect. When cause and effect change in the same direction, the arrow is marked with a plus sign. If the cause and effect change in opposite direc-tions, the arrow is marked with a minus sign. Cause and effect relationships are illustrated in figure 8 and explained as follows. When the number of customers increases, a company’s profit will also increase. This relationship is illustrated with a positive marked arrow. The right hand side of the figure illustrates a negative cause and effect relationship. By increasing the physical security in a building, it can be assumed that the number of burglaries will decrease.

System dynamic models can include both quantitative and qualitative models [4]. System archetypes are mostly qualitative and very effective to communicate

Figure 8: Cause and affect relationships

problems in an organization. System archetypes cannot be simulated, but represent intended and unintended actions or behavior in different settings. A lot of system archetypes were proposed by Senge in his book, “The fifth discipline” [46], looking into system thinking in organizational development. The archetypes suggested by Senge are reduced to four generic archetypes by Wolstenholm [4] in his article

"Towards the definition and use of a core set of archetypal structures in system dynamics". The generic archetypes consist of reinforcing (R) and balancing (B) feedback loops, resulting in intended and unintended results and outcomes. The four archetypes suggested by Wolstenholme, illustrated in figure9, are:

• Underachievement, including a reinforcing feedback loop for the intended out-come, and a balancing feedback loop resulting in an unintended outcome.

• Out of controlincluding a balancing feedback loop for the intended outcome, and a reinforcing feedback loop for the unintended result.

• Relative achievement including reinforcing feedback loops both for the in-tended and uninin-tended outcome.

• Relative control including balancing feedback loops both for intended and unintended outcome or results.

The four generic problem archetypes also include a solution feedback loop. The intention of the solution feedback loop, is to reduce the unintended consequences.

Unintended consequences are often and wrongly ignored, because they tend to happen delayed in time, and possibly also in other places compared to the in-tended outcome. This is illustrated by the line labelled "system boundary". The system boundary can be the boundary for the actual organization, but also the boundary between different departments in an organization. In order to employ system dynamics in a proper manner, it is important to acknowledge that the sys-tem boundaries exist, and take them into account.

The archetypes need some further explanation. For theunderachievement archetype, investments are spent to increase the intended outcome. The intended outcome might for instance be to increase the number of sold tickets or items. The more

items sold, the higher profit, and the feedback loop is reinforcing itself. After a while (delayed), the production line is not able to deliver the demanded number of items within the requested time frame. The intended achievement fails to be realized. A new feedback loop will appear, giving unintended consequences and opposing the intended outcome. The unintended consequence loop is balancing, acting against the intended outcome. The balancing loop is a result of resource constraints, for instance limited number of employees and equipment. The solu-tion is to use some of the resources obtained in the reinforcing loop, to minimize the resource constraints creating the balancing loop. For this example, hiring new employees and improving the equipment, could be a possible solution.

The intended purpose of an out of control archetype is to introduce a control action in order to control or reduce a problem. One example related to information security, might be the introduction of new and more detailed laws for security the organization has to adhere to. The intention of the new laws might for instance be to reduce the number of vulnerabilities in the information system, improving the security. In the beginning, the employees are following the new laws, and the number of vulnerabilities is reduced. As long as the control action is reducing the number of vulnerabilities, the feedback loop is balancing. But often the control ac-tion introduces a system reacac-tion, giving unintenac-tional consequences acting against the intended outcome. For this example, following the new laws require more ef-fort by each employee, exhausting the workers over time, introducing a reinforcing loop acting against the intended outcome. The unintended outcome is often much delayed in time, making the problem even worse. When the workload increases, the implementation becomes less effective, introducing more vulnerability. The so-lution is to introduce a direct link between the problem that needs to be controlled and the system reaction. In order to comply with the new laws, the organization has to invest in higher capacity. The solution archetype acts as a balancing loop reducing the unintended consequences.

The reinforcing, intended loop in the relative achievement archetype increases one organization’s success on the expense of another organization. In order to reduce the unintended consequences, regulatory actions are necessary. In the rel-ative controlarchetype, the intended consequence feedback loop results in a rel-ative outcome for one department in an organization. But this relrel-ative outcome induces a reaction in another department of the same organization, acting against the intended outcome. An absolute target therefore has to be defined in a solution feedback loop in order to stabilize the outcome.

Figure 10: Group Model Building. Adapted from Gonzalez [5]