Quality
and Requisite Variety: When Your Organization Discovers That Its Quality
System Can Only Handle as Much Variation as It Has Responses For — and
the Gaps Between What Your Process Throws at You and What Your
Procedures Cover Become the Space Where Every Major Defect Is Born
There is a law in cybernetics that almost nobody in quality talks
about. It was formulated by W. Ross Ashby in 1956, and it states
something so simple it feels almost trivial: for a system to
successfully regulate a process, it must have at least as much variety
in its responses as the process has in its disturbances.
In plain language: your quality system can only control what it has
prepared for. Every type of variation your process generates demands a
corresponding type of response. If your process can produce fourteen
different failure modes and your control plan only addresses nine, the
remaining five are not risks. They are guarantees. It is only a matter
of time.
Ashby called this the Law of Requisite Variety. And once you
understand it, you start seeing it violated everywhere — in every
surprise audit finding, every customer complaint that “came out of
nowhere,” every defect that your perfectly documented procedure failed
to prevent because the procedure was written for a version of reality
that no longer existed.
The Audit That Exposed the
Gap
I worked with a medical device manufacturer that had one of the most
impressive quality management systems I have ever reviewed. Their
documentation was meticulous. Their control plans covered every critical
dimension. Their inspection frequencies were calibrated to statistical
models. Their operators were trained and retrained. Their calibration
program was airtight.
And then an auditor found that they had been shipping catheters with
a burr on the tip — a burr so small it was invisible to the naked eye,
but large enough to cause microtrauma during insertion.
The burr was caused by a tool wear pattern that their control plan
had never anticipated. Their process could generate this failure mode.
Their quality system had no response for it. The gap between what the
process could do and what the system could handle was precisely where
the defect lived.
The auditor wrote it up. The company launched a CAPA. They added a
new inspection step, a new tool wear monitoring protocol, a new
acceptance criterion. They closed the gap.
And then, eight months later, a different tool on a different line
developed a different wear pattern that produced a different kind of
defect — one their newly updated control plan still didn’t cover.
Because they had solved the specific problem, not the structural
one.
The structural problem was this: their quality system did not have
requisite variety. It had more responses than most, but still fewer than
the process demanded.
Why Most Quality
Systems Are Under-Varieted
The uncomfortable truth is that most quality systems are designed for
the variation we expect, not the variation that actually exists. And the
gap between the two is where the most consequential defects are
born.
This happens for several reasons.
First, we write procedures based on history, not
possibility. When you draft a control plan, you look at what
has gone wrong before. You study past defects, historical data, lessons
learned. But Ashby’s Law is not about what has happened. It is about
what can happen. The space of possible disturbances is always
larger than the space of documented ones. Your FMEA captures the failure
modes you have imagined. It does not capture the ones you haven’t.
Second, we optimize for efficiency, which often means
reducing variety. Every additional inspection step, every
additional control measure, every additional response mechanism costs
time and money. Lean thinking correctly identifies waste. But there is a
line between eliminating waste and eliminating the variety your system
needs to survive. Cross that line, and your process becomes efficient at
producing defects it cannot detect.
Third, we confuse documentation with variety. Having
a procedure that describes what to do when something goes wrong is not
the same as having the organizational capability to actually do it.
Requisite variety is not about pages in a manual. It is about the range
of responses your system can actually execute — in real time, under
pressure, when the unexpected happens at 2 AM on a Sunday and the senior
engineer is not available.
Fourth, our processes change faster than our quality
systems. Every engineering change, every new supplier, every
material substitution, every equipment upgrade introduces new variety
into the process. If the quality system does not absorb an equivalent
amount of new response variety, the gap grows. And most quality systems
update reactively — after something has already gone wrong.
The Three Domains of Variety
To apply Requisite Variety to quality management practically, it
helps to think about three distinct domains where your system needs to
maintain variety balance.
1. Detection Variety
Your measurement system must be capable of detecting the full range
of variation your process can produce. This is not just about
measurement system analysis or gauge R&R — though those matter. It
is about whether you are even looking for the right things.
A company I consulted with in the automotive sector had robust SPC on
every critical dimension of their injection-molded parts. They monitored
means, ranges, and trends with discipline and precision. But they had no
detection capability for a specific type of internal void that occurred
when humidity in the raw material exceeded a threshold. Their process
could generate the defect. Their measurement system could not detect it.
The variety of the process exceeded the variety of the detection.
Detection variety means asking: what can my process produce
that I cannot currently see? Not just what it has produced, but
what it is capable of producing. This requires imagination, scenario
thinking, and a willingness to look beyond historical data.
2. Response Variety
Once a deviation is detected, your system must have an appropriate
response for each type. This is where many organizations discover their
variety deficit most painfully.
Consider a simple example: a CNC machining operation discovers that a
dimension is trending out of specification. The control plan says to
stop the process and notify the supervisor. But what if the supervisor
is in a meeting? What if the trend is gradual enough that the current
batch is still in spec but the next one won’t be? What if the root cause
is the material, not the machine? What if stopping production will cause
a missed shipment to your largest customer?
A single response — “stop and notify” — is insufficient variety for
the range of situations the process can generate. A system with
requisite response variety has pre-planned responses for different
scenarios: gradual drift vs. sudden shift, material-related
vs. tool-related, single-machine vs. systemic, low-impact
vs. customer-critical.
3. Adaptation Variety
This is the highest level and the most neglected. Adaptation variety
is the ability of your quality system to evolve its own response
repertoire as the process changes. It is meta-variety: variety in the
ability to generate new variety.
Organizations with high adaptation variety have structured mechanisms
for learning from surprises. When an unexpected failure mode appears,
they don’t just fix it — they update their entire approach to
anticipating failure modes. When a new type of variation emerges, they
don’t just add a control — they review whether their process for
identifying variation is adequate.
Adaptation variety is what separates organizations that get safer
over time from organizations that just get more documented over
time.
The Practical Implications
Understanding Requisite Variety changes how you approach several core
quality activities.
In FMEA development, it pushes you to expand your
imagination of failure modes beyond historical data. It suggests using
techniques like pre-mortems, red teaming, and cross-functional scenario
workshops to discover failure modes that your process can generate but
that no one has seen yet. The goal is not to predict every specific
failure — that is impossible — but to ensure your system has enough
variety to respond to failures you haven’t specifically predicted.
In control plan design, it means building in
flexible response mechanisms rather than rigid ones. Instead of
prescribing a single action for each failure mode, design response
protocols that can adapt to context. This might mean empowering
operators with decision frameworks rather than decision trees — giving
them principles rather than scripts.
In audit preparation, it means auditing for variety
gaps, not just compliance. Instead of asking “does the procedure exist?”
ask “does the procedure cover the full range of situations the process
can generate?” Instead of checking whether inspections are performed,
check whether the inspections are capable of detecting what the process
can actually produce.
In continuous improvement, it means measuring
whether your system’s response repertoire is growing at the same rate as
your process’s variation. Every process change should trigger a variety
audit: what new disturbances has this change introduced, and does our
quality system have corresponding new responses?
The Variety Trap in Digital
Quality
There is a particular danger in the current rush toward digital
quality systems and Industry 4.0. Digital tools are excellent at
increasing detection variety — sensors, IoT devices, and machine
learning algorithms can detect patterns that human inspectors cannot.
But there is a seductive illusion here: the belief that more data equals
more variety.
It does not. More data of the same type is not more variety. A
thousand temperature sensors giving you the same measurement you already
had is not increased variety. True detection variety comes from
measuring things you weren’t measuring before — from adding new
types of detection, not new instances of the same type.
Similarly, automated response systems increase speed but not
necessarily variety. An automated line stop is faster than a manual one,
but it is still a single response. If your process needs five different
responses to five different types of deviation, and your automated
system only has one — “stop the line” — you have speed without
variety.
The most dangerous quality systems are the ones that feel
comprehensive because they are fast and digital, but actually have low
variety because they are narrow and rigid.
Building Requisite Variety
So how do you actually increase the variety of your quality system?
Here are practical strategies I have seen work.
Diversify your detection portfolio. Don’t just add
more of the same measurement. Add fundamentally different types: visual,
dimensional, chemical, functional, environmental, temporal. Use
different measurement technologies. Cross-train inspectors from
different backgrounds — a person who has worked in a different industry
sees failure modes that your industry veterans have been blind to for
years.
Build response flexibility, not just response count.
It is tempting to try to write a procedure for every possible scenario.
This is a fool’s errand — the space of possible scenarios is infinite.
Instead, build response capacity: train people in principles
and decision frameworks, give them the authority to improvise within
boundaries, and create fast feedback loops so that improvised responses
are captured and standardized when they work.
Conduct regular variety audits. Periodically —
perhaps quarterly — gather a cross-functional team and ask: “What can
our process do that our quality system cannot currently handle?” Don’t
limit this to known failure modes. Use structured imagination exercises.
Bring in outside perspectives. The goal is to map the variety gap before
it produces a defect.
Design for graceful degradation. When your quality
system encounters a disturbance it has no specific response for, what
happens? In most organizations, the answer is: confusion, delay,
escalation, and eventually a frantic response crafted under pressure. A
system with requisite variety is designed to fail gracefully — to have
default responses that are good enough even when they are not specific.
This is the quality equivalent of aircraft having backup systems that
are less precise but still functional.
Learn from near-misses aggressively. Every near-miss
is information about the variety gap. It tells you that your process
generated a disturbance that your system almost couldn’t handle. Most
organizations treat near-misses as proof that the system works.
Requisite variety thinking treats them as warnings that the system is
running close to its limits.
The Deeper Lesson
Requisite variety is not just a quality tool. It is a way of thinking
about the relationship between your organization and the complexity of
the world it operates in.
Every process is more complex than the procedures that govern it.
Every product has more potential failure modes than any FMEA can
capture. Every supply chain has more potential disruptions than any risk
assessment can enumerate. The question is not whether there is a gap
between the variety of your challenges and the variety of your
responses. There always is. The question is whether you know where the
gap is, whether you are working to close it, and whether your system is
designed to survive the disturbances that fall in the gap.
Ashby’s Law is ultimately a law of humility. It tells us that no
quality system will ever be complete. There will always be disturbances
we haven’t anticipated, failures we haven’t imagined, variations we
haven’t measured. The organizations that thrive are not the ones that
pretend otherwise. They are the ones that build systems with enough
variety to absorb the shocks they can predict, and enough adaptability
to develop new variety for the ones they can’t.
Your quality system is only as strong as the variety of its
responses. The disturbances you haven’t prepared for are not
possibilities. They are appointments. And they are coming.
Peter Stasko is a Quality Architect with 25+ years
of experience transforming organizations across automotive, aerospace,
and pharmaceutical industries. He specializes in bridging the gap
between theoretical quality frameworks and practical shop-floor
implementation, helping companies build quality systems that are not
just compliant but genuinely resilient. His approach combines deep
technical expertise in tools like FMEA, SPC, and Six Sigma with an
understanding of the organizational and psychological dynamics that
determine whether quality systems actually work — or just look good on
paper.
