All Green on Paper
How a rotten culture turns local failures into systemic risk
The flood the paperwork missed
On the evening of 7 October 2017, an SMRT train captain named Choo Ah Heng spotted water on the tracks between Bishan and Braddell stations. It was 5.14pm. Within minutes, the water at the deepest point of the tunnel had risen almost to the electrified third rail. Services were suspended, passengers were brought safely out of the tunnel, and a stretch of the North-South Line was shut for about 20 hours.
A heavy downpour had overwhelmed the tunnel's flood pumps. That alone would have been bad luck. What investigators found next was not.
The anti-flood system had not been maintained for most of a year. Maintenance records for three consecutive quarters said the work had been done. Those records didn't match the logs showing who had actually gone onto the tracks and whether the pumps had ever been switched on. In the end, 13 staff were held responsible for failing to maintain the system, and some had falsified records.
The paperwork was complete. The maintenance wasn't.
SMRT's CEO at the time, Desmond Kuek, said the company still had deep-seated cultural issues. When asked to explain, he pointed to how much supervisors took responsibility and how much ownership staff took for things that weren't working. The Transport Minister replied in Parliament that culture means the values and practices of management just as much as those of the workers, and that growing the right culture is everyone's job, from the top down.
That exchange raises the question this post is about. When something goes badly wrong, was it a few bad apples, or the barrel they were kept in?
Why culture matters
Every organisation has policies, procedures, controls and sign-offs. They describe what should happen. Culture decides what actually happens, especially when nobody is watching.
The Bishan maintenance record was itself a control, and it recorded something that never happened. More paperwork doesn't fix that. It just adds more forms that can be signed without the work being done.
Controls tell you something is wrong. Culture decides whether anyone does anything about it. That is why culture is the control that sits on top of every other control. Every alert, checklist, limit and escalation path eventually lands in front of a person. That person decides what to do based on what the organisation has taught them gets rewarded, tolerated or punished.
Singapore has three stories that show how this goes wrong. Each one matches a symptom most people will recognise from their own workplace.
Symptom one: the form becomes the job
Whatever the motives of the individuals at Bishan, the pattern is familiar. When completing the record is what gets checked, the record can quietly become the product. Add enough time pressure and little enough independent verification, and some people will tick the form without doing the work.
This is what happens when an organisation fixates on KPIs. The number stops measuring the work and starts replacing it. A bank that rewards accounts opened gets accounts opened. A bank that rewards alerts closed gets alerts closed. Whether the risk behind them has actually been dealt with is a separate question, and often nobody asks it.
Symptom two: speaking up costs you
In mid-2018, attackers stole the personal data of about 1.5 million SingHealth patients. They also took outpatient medication records for about 160,000 of them, including the Prime Minister.
His manager was the designated security incident response manager. He didn't escalate. He told the team that once the incident was reported there would be "no day and no night" for them, with management constantly chasing for updates. At the inquiry, he said he had asked himself what he would gain from reporting it. He also believed escalating wasn't his job.
This is what can happen when escalation becomes personally costly. Nobody has to be punished for raising a problem before others learn that raising one will cost them. If the person who sounds the alarm inherits the late nights, the scrutiny and the questions, silence starts to look sensible.
Singapore's data protection regulator later criticised the belief that an incident should only be escalated once it was "confirmed." By the time an attack is confirmed, the data is usually already gone.
What happened next is worth noting. The two employees directly involved were dismissed. But IHiS also imposed significant financial penalties on five members of its senior management, including the CEO, for what it called their "collective leadership responsibility." Responsibility did not stop with the two people closest to the decision.
Symptom three: the rules stop at the top
For decades, Hin Leong Trading was a Singapore success story. O.K. Lim built it from a single delivery truck into one of Asia's largest oil traders. It is widely credited with helping Singapore become the world's top ship-refuelling port.
Then oil prices crashed in April 2020 and the truth came out. In court filings that year, Lim admitted that the company had been hiding about US$800 million in futures trading losses while reporting healthy accounts. He took responsibility for directing the company not to report them. He also admitted that oil pledged to banks as collateral had been sold and the proceeds used for general purposes.
He was later convicted of cheating HSBC of about US$111.6 million using fabricated oil sale contracts, and of instructing a former employee to forge documents for one of them. In November 2024 he was sentenced to 17½ years in jail. In March 2026 the High Court reduced the sentence to 13½ years, citing his age and the restitution he had made, but upheld his conviction.
This is what happens when management doesn't walk the talk, in its most extreme form. When instructions from the top can override financial controls, the organisation learns that the written rulebook comes second to the person giving the orders.
Why one firm's rot becomes everyone's problem
Engineers call the most dangerous kind of failure a "common-mode failure." It means a single cause that knocks out every safety layer at once.
Bishan is a good example. The flood protection had several layers: float switches that were supposed to start the pumps, and an alarm that was supposed to warn staff. None of that helped, because every layer depended on maintenance that wasn't being done.
Banks are built the same way. They have three lines of defence, run by three different teams. The business checks its own work. Risk and compliance check the business. Internal audit checks both. The idea is that if one team misses a problem, the next one catches it.
But three teams means different people, not different cultures. They answer to the same leadership, chase the same targets and pick up the same unwritten rules. If those rules say a ticked form is good enough, raising problems gets you into trouble, and nobody argues with the boss, every team learns to look away. The problem doesn't slip past one layer. It slips past all three. A rotten culture isn't one weak control. It weakens every control at once.
A rotten culture isn't one weak control. It weakens every control at once.
Signed off, never done
The most dangerous organisation isn't necessarily the one with no controls. It is the one where every control looks complete on paper. The checklist is signed. The alert is closed. The audit finding is marked resolved. The board pack is green.
And underneath all of it, the work was never done.
What good looks like
The encouraging part is that Singapore also has examples of doing this well.
After the Bishan flooding, SMRT offered staff an amnesty period. During that window they could admit to past lapses without penalty, before a company-wide audit began. Some staff came forward. That is a culture fix, not a paperwork fix. It made telling the truth safer than hiding it.
The investigators also caught the falsified records by comparing them against independent evidence: the logs of who had gone onto the tracks, and whether the pumps had actually run. The lesson is simple. Don't just check the record. Check the record against reality.
The IHiS penalties on senior leadership sent a clear signal that culture comes from the top. MAS's accountability regime does the same, by making sure senior managers answer for what happens under them.
What to do about it
For businesses
Verify the record against reality. For critical controls, regularly compare sign-offs with independent evidence such as system logs, access records and physical checks. If a form can be completed without the work being done, eventually it will be.
Escalate on suspicion, not confirmation. Rewrite escalation criteria so that a possible incident is enough to trigger a report. Waiting for proof is how data leaves the building.
Make reporting cheaper than silence. If escalating an incident means a week of late nights and scrutiny for the person who raised it, people will stop raising incidents. Give whoever sounds the alarm support and resources, not extra punishment.
Consider an amnesty before an audit. When you suspect problems are widespread, give people a safe window to come forward first. You will learn more in a week than an audit finds in a quarter.
Make sure nobody is above the controls. No founder, star performer or top rainmaker should be exempt. If one person can override finance, risk and audit all at once, you don't really have three lines of defence. You have one person.
Measure culture through leading indicators. Useful ones include the time between an alert
and a human decision, the share of alerts closed with no action, repeat audit findings, the number of waivers granted, and near-miss reporting rates. A sudden drop in near-miss reports is a warning sign, not good news.
Hold leaders collectively accountable. When the front line fails, ask what leadership did to make that failure more likely, not just who at the front line should be dismissed.
For individuals
Never sign for what you didn't do or didn't see. Your signature is a control. At Bishan, the signatures themselves became the lapse.
Escalate in writing, early. A dated message raising a concern creates a clear record of what you saw, when you raised it, and how the organisation responded.
Ask the right question. The SingHealth manager asked what he would gain from reporting. The better question is what everyone loses if you don't. And "it wasn't my job to escalate" appears in inquiry reports again and again. It rarely holds up.
Watch for your own normalisation. If something that bothered you six months ago now feels like "just how things are done," the culture has started to change you.
Be the train captain. The Bishan flood was caught quickly because one alert person on the front line spoke up at 5.14pm. Culture isn't only set in the boardroom. It is also set by the people who notice something is wrong and say so.
Comments