Why Control Dependencies Matter
Two controls may appear to provide separate safeguards while relying on the same person, source of information, system, or decision process. If that shared element fails, both controls may fail together. This is a common-mode failure: one event, condition, or weakness disables multiple controls at the same time.
For example, a claims team might use an automated payment limit and a supervisor review. If both rely on the same incorrectly mapped claim field, the two controls are not independent safeguards against that data error. Counting them as if they fail separately can overstate the protection they provide. A control assessment should therefore consider not only each control's individual design and operation, but also what its operation depends on in common with other controls.
Dependencies can be visible or subtle. Two controls may be performed by different people but use the same data feed. An automated alert and a manual review may both rely on the same mapping rule. Two approvals may be separate in a workflow but subject to the same access rights or management override. Conversely, two controls that address the same risk are not automatically dependent: the relevant question is whether a plausible cause can impair both at once.
Modeling a Common-Cause Failure
A simple model makes the dependence explicit. Let \(F_1\) and \(F_2\) denote the events that controls 1 and 2 fail to prevent or detect a specified error. Let \(C\) be a common-cause event that disables both controls. Suppose \(P(C)=q\). If \(C\) does not occur, assume the controls fail independently, with conditional probabilities \(p_1\) and \(p_2\). This model treats \(p_1\) and \(p_2\) as failure probabilities conditional on no common-cause event; they are not the unconditional failure probabilities.
The first term is the probability that the common cause disables both controls. The second term is the probability that the common cause does not occur and both controls then fail individually. The probability that at least one of the controls succeeds is the complement:
The derivation follows by splitting joint failure into two disjoint cases: the common cause occurs, or it does not. In the first case, both fail. In the second, conditional independence gives \(P(F_1 \cap F_2 \mid C^c)=p_1p_2\). Adding the case probabilities gives the formula. The model is only appropriate when the common cause truly disables both controls and the remaining failures are reasonably treated as conditionally independent. If a shared condition changes failure likelihood without always disabling both, use a conditional-state model instead.
Worked Example: Two Controls Using the Same Data Feed
A hypothetical insurer uses an automated check and a manual review to identify an incorrect policy limit before a renewal is issued. Both controls use the same nightly data feed. Assume a feed failure disables both controls with probability \(q=0.02\). If the feed works, the automated check fails with probability \(p_1=0.03\) and the manual review fails with probability \(p_2=0.04\); assume these remaining failures are independent conditional on the feed working. Calculate the joint failure probability, compare it with an independence estimate based on unconditional failure probabilities, and find the probability that at least one control succeeds.
Method. Apply the common-cause model, then calculate each control's unconditional failure probability before making the independence comparison.
Joint failure with the shared cause. If the feed fails, both controls fail. If it works, the conditional probability of both failing is \(0.03 \times 0.04=0.0012\). Therefore:
The joint failure probability is \(0.021176\), or \(2.1176\%\).
Unconditional failure probabilities. Control 1 fails either because the feed fails or because the feed works and the control fails: \(P(F_1)=0.02+0.98(0.03)=0.0494\). Similarly, \(P(F_2)=0.02+0.98(0.04)=0.0592\). Multiplying these marginals as if the controls were independent gives:
That estimate is about \(0.2924\%\), far below the modeled joint failure probability of \(2.1176\%\). The gap arises because the shared feed failure makes the control outcomes dependent.
At least one succeeds. Take the complement of joint failure: \(1-0.021176=0.978824\), or \(97.8824\%\). The check is consistent: the two possible outcomes, “both fail” and “at least one succeeds,” sum to \(0.021176+0.978824=1\).
Common mistake avoided: Multiplying the unconditional marginal failure probabilities assumes independence, even though a common feed failure affects both controls. Use the common-cause model when its assumptions fit the process.
When a Shared Condition Changes the Failure Rates
Not every dependency completely disables both controls. A shared condition may instead make each control more likely to fail. In that case, define states for the shared condition and calculate joint failure within each state. For two states, \(D\) and \(D^c\), the law of total probability gives:
If the controls are conditionally independent within each state, each conditional joint probability is the product of the controls' conditional failure probabilities in that state. This assumption is about dependence after the shared state is known; it does not mean the controls are independent overall.
Worked Example: Shared Staff Availability and Expected Loss
A hypothetical insurer has two controls over a high-severity claim adjustment: a preparer’s validation and a separate reviewer’s check. Both require the same specialist to be available to answer questions about an unusual claim. Assume that a shared workload or absence condition prevents both controls from operating with probability \(q=0.04\). If that condition does not occur, the validation fails with probability \(0.05\) and the review fails with probability \(0.08\), independently. Separately, assume the underlying processing error occurs with probability \(0.06\) in a year, independently of control failure. If an error occurs and both controls fail, the loss is \(\$180{,}000\); otherwise, this modeled loss does not occur. Find the joint control failure probability and expected annual loss.
Joint control failure. The shared condition causes both controls to fail with probability \(0.04\). Outside that condition, both fail with probability \(0.05 \times 0.08=0.004\). Thus:
The controls jointly fail with probability \(4.384\%\).
Expected annual loss. The error and joint control failure must both occur. By the stated independence assumption, the probability of that combination is \(0.06 \times 0.04384=0.0026304\). Therefore:
Rounded to the nearest cent, expected annual loss is \(\$473.47\). As a check, the expected loss is below the maximum modeled annual loss of \(\$180{,}000\), since the probability of that loss is only \(0.0026304\).
Common mistake avoided: Do not treat the shared absence or workload condition as two separate independent absences. It is one shared event that affects both controls. Also, the assumed independence of the processing error from control failure is needed for the multiplication used in the expected-loss calculation.
Worked Example: A Defect That Weakens Both Controls
A hypothetical claims operation uses a system rule and a review report to flag an incorrect reserve classification. Both depend on the same classification mapping. Let \(D\) denote a defective mapping, with \(P(D)=0.03\). Conditional on a defective mapping, the system rule fails with probability \(0.70\) and the report-based review fails with probability \(0.60\). When the mapping is correct, their respective failure probabilities are \(0.02\) and \(0.03\). Assume conditional independence between the controls within each mapping state. Find their joint failure probability, the probability that at least one catches the issue, and the result of multiplying their unconditional failure probabilities.
Joint failure by mapping state. In the defective-mapping state, the conditional joint failure probability is \(0.70 \times 0.60=0.42\). With a correct mapping, it is \(0.02 \times 0.03=0.0006\). Weight those outcomes by their state probabilities:
The joint failure probability is \(1.3182\%\). Therefore, the probability that at least one control catches the issue is \(1-0.013182=0.986818\), or \(98.6818\%\).
Unconditional independence estimate. The first control’s marginal failure probability is \(0.03(0.70)+0.97(0.02)=0.021+0.0194=0.0404\). The second’s is \(0.03(0.60)+0.97(0.03)=0.018+0.0291=0.0471\). Their product is \(0.0404(0.0471)=0.00190284\), or \(0.1903\%\). This is much smaller than the state-based joint estimate of \(1.3182\%\).
Common mistake avoided: Conditional independence within each mapping state does not justify multiplying the unconditional marginal probabilities. The shared defective-mapping state makes failures more likely at the same time.
Assessing Dependencies in Practice
A useful assessment starts by naming the failure outcome that matters. “The control fails” should be defined in context: for example, an incorrect payment is neither prevented nor detected before release. Then identify each control’s key dependencies and ask whether one plausible event or condition could impair more than one.
Define what counts as failure for each control and the common error or loss the controls are intended to address.
Record shared people, data, systems, procedures, access rights, decision authorities, and timing requirements.
State how a shared event could disable multiple controls or increase their failure likelihood. Avoid treating mere similarity as proof of dependence.
Use a common-cause model when one event disables both controls; use conditional states when a shared condition changes failure probabilities.
Compare joint failure with any independence estimate, state the assumptions, and identify which shared dependency drives the difference.
Evidence can include process walkthroughs, access records, data lineage, system configuration, exception logs, and control-test results. A walkthrough can reveal that two apparently separate checks use the same input. Testing may show whether the shared input is independently validated or merely passed through both processes. Historical samples can be informative, but they may contain few or no instances of a rare common cause. Absence of observed joint failures in a small sample is not, by itself, evidence that controls are independent.
The quantitative estimates are only as sound as their event definitions and assumptions. A common-cause probability should refer to a specific mechanism and period, not an unexplained adjustment. Conditional failure probabilities should be linked to the stated condition. If the available evidence does not support numerical estimates, describe the dependency and its plausible consequences clearly rather than presenting false precision. This analytical discipline is aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus.
Common Exam Traps
- Multiplying marginal probabilities without checking dependence. The expression \(P(F_1)P(F_2)\) gives the joint probability only when the failures are independent. A shared data, system, or human failure can invalidate that assumption.
- Mixing conditional and unconditional probabilities. In the common-cause formula, \(p_1\) and \(p_2\) are conditional on the common cause not occurring. Substituting unconditional rates into those terms can count the shared cause twice.
- Assuming every shared dependency always disables every control. Some dependencies increase failure rates rather than causing certain failure. Represent those cases with conditional states or other probability information appropriate to the scenario.
- Confusing success events. “At least one control succeeds” is the complement of “both controls fail.” It is not the same as “both controls succeed.”
- Reporting a probability without its assumptions. State the shared-cause mechanism, conditional independence assumption, and relevant period so the estimate can be interpreted.
Check Your Understanding
For each problem, make the event definitions and stated independence assumptions explicit before calculating.
- A hypothetical insurer has an automated payment check and a separate review, both of which fail if a shared system outage occurs. The outage probability is \(0.015\). Conditional on no outage, their failure probabilities are \(0.03\) and \(0.05\), independently. Find the probability both controls fail. (Answer: \(0.0164775\), or \(1.6478\%\))
- A shared data defect occurs with probability \(0.04\). Given the defect, two controls fail with probabilities \(0.50\) and \(0.40\); without the defect, their failure probabilities are \(0.02\) and \(0.03\). Assume conditional independence in each state. Find the joint failure probability. (Answer: \(0.008576\), or \(0.8576\%\))
- A processing error occurs with probability \(0.10\), independently of control failure. A common cause disables two controls with probability \(0.02\); otherwise their conditional failure probabilities are \(0.04\) and \(0.06\), independently. If an error passes both controls, the loss is \(\$300{,}000\). Find expected annual loss. (Answer: \(\$670.56\))
- A common cause disables two controls with probability \(0.03\). If it does not occur, the controls fail independently with probabilities \(0.02\) and \(0.04\). Calculate the joint failure probability and the estimate obtained by multiplying the unconditional marginal failure probabilities. (Answer: joint failure \(0.030776\); independence estimate \(0.00339872\))
- A common-cause model has conditional individual failure probabilities \(p_1=0.02\) and \(p_2=0.03\) when the common cause does not occur. The observed joint failure probability is \(0.0100\). Solve for the common-cause probability \(q\), using \(P(F_1 \cap F_2)=q+(1-q)p_1p_2\). (Answer: \(q \approx 0.009406\), or \(0.9406\%\))