What hospitals can teach banks about reviewing mistakes

Every teaching hospital in America holds a meeting that most industries would find unthinkable. Once a week or once a month, the physicians gather and present, in front of their colleagues, the cases that went wrong — the missed diagnosis, the delayed surgery, the patient who died when they should not have. It is called the morbidity-and-mortality conference. It has existed for a century. And its single most important rule is that the first question is never 'who'.

I chaired my first M&M as a young attending in 2003, presenting my own case: a woman in her sixties whose aortic dissection I had read as a musculoskeletal pain for forty minutes. She lived, barely. I expected to be humiliated. Instead the senior physician asked three questions, in order: what did you know at each moment, what should the system have put in front of you that it did not, and what will we change by Friday? The department added a one-line prompt to the chest-pain template that week. I have never forgotten the order of those questions.

When I joined Meridian Trust's board in 2018 and was asked to chair the audit committee, I brought the M&M with me. Banks, I quickly found, review errors the way most organisations do: a mistake is discovered, a person is identified, a memo is written, and the person is quietly moved or quietly stays. The memo describes what the person should have done. It rarely describes what the system should have caught. Nothing changes by Friday.

So we changed the review. Every operational error above a small threshold — a misdirected wire, a loan document with the wrong rate, a customer told the wrong thing — comes to the committee as a case. The person involved presents it themselves. The committee asks the three questions. The word 'who' is not used, and I enforce that with the same lack of humour I use in the emergency department. The output is a list of changes, each with a name and a date, and the next meeting opens by checking whether they happened.

Two things followed, as they do in hospitals. First, the number of reported errors went up — sharply, in the first year — because people report what they will not be blamed for. Helen Kowalczyk, the bank's chief risk officer, told the board that this was the best risk news she had received since she arrived: she was finally seeing the errors that had always existed. Second, the number of repeated errors went down. A mistake reviewed properly is a mistake the system now catches.

The hardest part is not the rule; it is the discipline of applying it when the error is expensive and the person's name is obvious. In August a wire for $18,400 went to the wrong account. It was recovered in two days. The banker who sent it presented the case. The committee found that the confirmation screen showed the account number in a font size that the banker, who is fifty-eight, could not reliably read on the branch's older monitors. Three controls changed, one of which cost nothing. The banker still works for us and now trains others on the new screen. In the old model she would have been the finding.

I still work two emergency shifts a month. People ask why a hospital president would do that, and the answer is the same reason a bank director should sit at a teller's window once a year: you forget what the building is for otherwise. In the emergency room, in the boardroom, and at the audit committee, the first question is never 'who'. It is: what should have caught this? Ask it, and then change something by Friday.