Collecting evidence is an important aspect in providing assurance of compliance. This evidence often comes in the form of data and plenty of it. Companies measure, gather and store data of all kinds and in increasing amounts. In fact, as companies continue their digital transformation, the amount of data is expected to balloon creating even more opportunities for data mining.
All this data will be analyzed and patterns will be discovered. This will help in updating our system models and processes to make them more efficient. Recent advancements in machine learning will take this to even higher levels and discover patterns that we currently cannot see, and this is good.
However, even with these advancements, what this data will never be able to tell us is how things "ought" to be.
There is an ethical chasm between the world of facts and the world of values (or ideas). This chasm divides the world of what "is" from the world of what "ought to be" and is known as the "Is-Ought Problem" or more commonly "Hume's Guillotine" named after the Scottish philosopher David Hume.
Why is this important to compliance?
There is always a tension between the world of ideas and the objective reality we observe. We are always making judgements as we update our understanding of how the world works. The question is, "which direction do these updates occur?"
In a fashion, we construct a "model" for how we understand the world and then validate that model using our observations. This is the concept introduced by Immanuel Kant's (German philosopher) contribution to Hume's analysis called, "synthetic–a posteriori". In other words, we can deduce cause-and-effect relationships from the real world and use them to update our construction of how the world works that are based on statements of ideas. However, observations are not used to derive the ideas in a logical sense, they only describe them. And this is where the rub is.
In the world of facts, we have statements like:
Apples taste good.
These are things we can only know by observation. These do not directly add knowledge to our ideas of how the world works. They are facts that are true because we observed them.
In the world of ideas, we have other statements like:
All triangles have three sides.
All bachelors are unmarried males.
These are things we know by definition without observation. These are called tautological statements and are true because of reason not based on empirical facts.
However, when we consider things like mathematics we have both. There are things we consider universally true like, 7 + 5 = 12, without observation based totally on our ideas of mathematics. However, at the same time we don't know for sure that it is true until we actually count and discover that it is true in reality. This is the foundation for scientific inquiry which as we know is always preceded by a hypothesis – an idea looking for a descriptive account.
[ As an aside, this is how we think about management systems and validating outcomes. Management systems are based on models for how things get done. These are designed based on ideas, concepts, and categorizations of things in the real world that we are concerned about. How true a model is depends on several factors that include: resolution, fidelity, and effectiveness. This is why we need to apply the scientific method to update our models so that they become "truer" in the sense that they are more universally true.
Validating outcomes is the act of proving our hypotheses. As an example, we can posit a hypothesis that increasing people's awareness of hazards reduces safety incidents. According to our models this is true and have evidence that has been true in the past under certain conditions for specific companies. However, what we don't know for certain is that this is true for all cases under all conditions.
Verification on the other hand is the act of confirming that we followed the correct process for our experiment (so to speak). Many companies only spend time verifying procedures when they also need to prove (perhaps, continually) their hypotheses and update their models accordingly. ]
Here's the point, the models we use to better understand the world are based on value judgments. Humans have the capacity or as Kant calls them, ontological categories, to understand our observations of the world. Now back to Hume, you cannot deduce these categories based on the world of facts; you cannot create an "ought" out of an "is". This may seem surprising particularly to those that believe that you can look at nature and derive moral imperatives. This thinking suffers from the "Naturalistic Fallacy" which argues that just because something is found in nature doesn't mean that it is good.
No matter how much data analysis we do, we can never discover from data how things ought to be. In the words of Gandalf, from the Lord of the Rings, when it comes to crossing the ethical chasm between what is and what ought to be, "You shall not pass!"
This is exactly why compliance needs to be careful. You can use data to verify that actions were taken to support moral values. However, you cannot do the opposite, and use data to determine what these moral values should be.
Bridging the gap - some have tried
John Searle (an American philosopher) argues that one way to cross the ethical gap is through promises. The act of promising by definition places the promiser under obligation. By speaking forth the words, "I promise to pay Mary 5 dollars" one creates an ought (moral action) from an "is".
The most predominate argument given on how to cross the gap is to appeal to a goal or purpose (telos). The argument follows that If you have a goal A, then you should do B, which has been observed to lead to A. The should is created from the goal which is an "is".
One problem. You first need to come up with the goal which requires an "ought." Also, if you have not yet observed a path that leads to your goal you never know what you "could" let alone "should" do.
Neither of these approaches seem to be sufficient to cross the is-ought chasm as they both require ethical decisions either to make a promise or to set a goal.
Take caution with how you use your data
Big data, machine learning, and artificial intelligence will no doubt be applied in earnest to discover patterns and ways to improve, exploit, or even just understand what we observe. However, we need to take caution in using these insights to create normative statements on how things ought or should be. The latter belongs to the realm of values which is entirely reserved to humans not machines.
Data can help us to achieve our goals but cannot tell us what these goals ought to be. That is why it is so important that the first step to improve compliance begin with taking ownership of obligations. This step involves deciding what your goals ought to be and from there everything else follows.