The cash drawer came up a few pence over. At a small post office, that could be as puzzling as coming up short: the money had to be somewhere. The sub-postmaster retraced the day’s entries. Near ten, with the tea gone cold, the mismatch turned out to be a first-class stamp keyed in as second. There was a cause. It could be found, transaction by transaction.
That is a problem procedure can handle. A different kind of number began appearing on the Horizon screen: a shortfall in the branch account that the cash in the drawer did not explain. People who ran the branches said something was wrong. The discrepancy did not pause the process.
The helpline is polite. The helpline has a script. The script does not contain the sentence the caller needs, which is: you may be right, and the machine may be wrong.
When does a procedure stop being enough?
The number on the screen signaled a shortfall. It could not explain the discrepancy. Yet a signal can acquire force as it passes through an organization. The branch owner had to account for the books. The accounting system indicated a shortage. A standard process demanded an answer. Each step had a reason. Taken together, they made it increasingly difficult to question the first assumption.
Some sub-postmasters paid money from their own pockets to cover the difference. Others called the helpline, reported shortfalls they could not explain, or insisted they had not taken the money. The chapter describes how some were told, in effect, that no other branch had the same problem. The case moved forward with the system’s account in front of it and the person’s account treated as resistance.
This is how a routine can become dangerous without anyone setting out to do harm. A manager relies on an accounting record because records matter. A support worker sticks to the approved response because they do not have the authority to diagnose the software. Neither choice, considered alone, sounds unreasonable. The organization’s failure takes shape between them: no one is charged with interpreting what the contradiction means, and no one is clearly empowered to hold the next step.
Judgment is the accountable interpretation an organization needs when a case no longer fits what its procedure can safely settle. A procedure is useful when the situation is familiar and the rule fits the facts. Judgment becomes necessary when an output conflicts with what a person can observe. It is also needed when the evidence is incomplete or when applying the rule would carry a consequence the rule was not designed to decide.
That boundary is easy to miss because procedures usually work. They make a response consistent and show what happens next. A case can progress through its assigned steps even after the situation has outgrown them. Those signs of order can conceal the question underneath: does this process still fit what is happening?
In Horizon’s case, the gap between an account and the money in a branch should have changed the work. It called for someone to consider more than whether the normal accounting step had been completed. The institution needed to find out what could explain the difference and whether the software could be wrong. It also needed to reckon with what might happen to a person if it acted before knowing. Finishing the checklist could not answer those questions.
The needed change is not to discard procedure. It is to put a deliberate boundary around it. Procedure should carry the known. Judgment must hold the uncertain.
Who has authority to stop the queue?
The answer has to be a role with clear authority. A vague expectation that someone will speak up cannot stop the process. A frontline worker who sees a mismatch needs a clear route to pause routine action and bring the missing evidence to a named decision-maker. That person needs access to the relevant record and enough authority to keep the organization from treating the system’s output as settled while the discrepancy is examined.
The boundary should be specific enough to use on an ordinary Tuesday. A process might stop when its output conflicts with the underlying record. It can also stop when a person offers information the system has not considered. A separate rule can require a pause before an outcome that could accuse someone of misconduct or remove an important service. These are points where the usual sequence gives way to an accountable interpretation of the case.
Leaders can keep the pause focused on outcomes that cannot proceed on the system’s say-so alone. They need to name who may halt them and give that person time to learn what is missing before the queue restarts. If the authority exists only on paper, if taking time is treated as poor performance, or if the reviewer cannot change the result, the procedure still has the final word.
This design affects people inside the organization as well. Judgment develops through decisions someone is trusted to make, with limits and support. When the system always handles the first pass and the worker only confirms it, the worker may have less practice noticing which cases deserve another look. The queue moves faster today; over time, fewer people may know when to question where it is going.
That loss is hard to see in a productivity report. The numbers may show fewer delays and more completed cases. They cannot show the exceptions no one recognized, or the employees who stopped raising them after their warnings made no difference. A process that leaves no room for disagreement also takes away one way the organization learns what its tools cannot see.
A person watching every screen will not preserve judgment on their own. Leaders have to design the work so that a person with the right context can recognize when the standard answer no longer fits, and is allowed to interrupt the next step. Then they have to decide what the interruption means: review, correction, disclosure, or a more serious change to the process. Sometimes the answer will be that the procedure worked and the person was mistaken. The point is that the organization makes that decision with its eyes open.
A queue will often be waiting on the other side of a pause. The question is whether the person who sees the mismatch can make it wait, and who will stand behind that choice.
This essay draws on Chapter 6, “Judgment Begins Where Procedure Ends,” of AI in the Org Chart.