Articles

What this library is §

It is not a blog. The articles are not independent pieces that happen to share a subject, and they are not written in the order they occurred to anyone. They are a sequence: each one uses what the previous one established, and each one is written so that the next one becomes possible.

It is one branch of the Silent Expiry knowledge hub, and the teaching one. The canonical definition governs, the Evidence page carries the documented cases, The Premise Test is the practice, and the companion workbooks are the forms. This library is the reasoning that connects them.

The canonical definition states the concept in its final form. That is the right document to cite and the wrong document to learn from, because it begins where a reader ends. This library begins where a reader begins — with a recurring nonconformity, a number nobody can justify, an audit that passed three weeks before the failure — and lets the pattern accumulate before the reader is asked to accept anything about it.

The state those observations have in common is this one:

Silent Expiry is the state of a control that remains documented, in force and verified as compliant while at least one condition its protective effect depends on has ceased to be true — and whose failure produces no signal. A control in this state continues to behave exactly as specified. It no longer protects anything.

Every article from 1 to 9 ends by naming that state, in those words, after its own observation is complete — the name arriving as a label for something the reader has just recognised, never as the explanation for it. From article 10 the term is in ordinary use, because by then it has been earned.

Nothing here forms part of the canonical definition. Where an article and the definition disagree, the definition governs, and the article is corrected.

How to use it §

If you have never met the term. Start at article 1 and read in order. The first seven articles carry no framework and ask you to accept nothing; they describe things you have already seen, and each one names the state only at its close. If nothing in those seven is familiar, the rest of the library will not be useful to you, and that is a legitimate outcome.

If you already understand the concept. Levels 4 to 7 are the working material — the test, why verification misses it, how to write a control that carries its own premise, and how to make the practice survive the person who introduced it. They can be read on their own.

If you are looking for something specific. The eight worked Examples and the documented cases on Evidence are indexed separately and do not require this sequence.

Relationship to the Premise Test. The Premise Test is a case series: one ordinary control at a time, run through the three questions, with a verdict. It is the practice. This library is the reasoning behind the practice. The two are read in parallel, not in sequence.

The progression §

Seven levels. Each answers one question, and each is written so that the question the next level answers has already become unavoidable.

The order is deliberate in one respect that is easy to miss. Levels 1 to 3 are descriptive and can be read by anyone. Level 4 is where the reader stops reading about controls and starts testing one. Nothing before article 23 asks the reader to do anything, because a diagnostic offered before the reader has seen the pattern is a checklist, and checklists are what this concept is about.

Every article carries the same closing shape, so that the sequence reads as one body of knowledge rather than as separate pieces: what was observed, what it is called, why it matters for long-lived controls, where the argument goes next, and what to read after it. A reader never reaches the end of an article without a next step inside the hub.

Level 1 · Observe §

Seven things a practitioner has already seen, each described before it is named. No framework and no claim: the purpose of this level is to establish that there is something here that existing categories do not name, and then to give it the name. Every article closes with the same statement of what Silent Expiry is, after its own observation is complete.

• 1 · Why the same nonconformity keeps coming back — Recurrence after a closed, verified corrective action is usually read as weak root-cause analysis. Sometimes the analysis was sound and the answer has expired. Names the state at the close. Published.
• 2 · The number nobody in the room can justify — Every quality system contains chosen numbers — a sample size, an interval, a limit. The number survives; the person who chose it, and the reason, generally do not. Names the state at the close.
• 3 · When “we have always done it that way” is not laziness — The sentence is treated as resistance to change. Read literally, it is a report that a control has outlived the memory of its own justification. Names the state at the close.
• 4 · The audit that passed three weeks before the failure — A pattern common enough to be unremarkable, and strange enough to deserve an explanation better than “the audit missed it”. Names the state at the close.
• 5 · Controls that are followed perfectly and protect nothing — Compliance and protection are different properties. Most quality systems measure the first continuously and the second almost never. Names the state at the close.
• 6 · What a closed corrective action does not tell you — Effectiveness verification asks whether the problem recurred. It does not ask whether the conditions that made the action appropriate are still present. Names the state at the close.
• 7 · The difference between a system that works and a system that used to — Both produce identical records. This article is about why that is not a paradox, and what would distinguish them if anyone looked. Names the state at the close.

Level 2 · Understand §

The mechanism, stated precisely. Articles 8 and 9 close with the naming statement as Level 1 does; from article 10 the term is in ordinary use. This level introduces the premise, the three conditions and the canonical definition — which by now should read as a summary of what the reader has seen rather than as a claim.

• 8 · Every control was built for a reason — The reason is a statement about the world that was true when the control was written. It is a separate object from the control, and it is almost never maintained as one. Names the state at the close.
• 9 · What a premise is, and why it is not a requirement — A requirement is what you must do. A premise is what has to be true for doing it to help. Quality systems manage the first with great care. Names the state at the close.
• 10 · The three conditions — The full test, and why all three must hold together. A concept that holds when only two are present would be a description of every failure, which is to say a description of none.
• 11 · Condition 1 — a reason existed — What separates an expired control from one that was wrong from the start. The condition that excludes design error, and why it must not be relaxed.
• 12 · Condition 2 — the premise lies outside the verification — The premise may be documented, published, even well known. What matters is whether the check that governs the control ever interrogates it.
• 13 · Condition 3 — the failure is mute — Muteness is a property of routing, not of information. Signals usually exist somewhere. The question is whether any of them reach the thing that could change the control.
• 14 · Detection changes the exposure, not the phenomenon — Why an organization that has learned to find expired premises still has them, and why that is the correct thing to expect.

Level 3 · Recognise §

Where the state lives. Eight articles on the forms it takes in real systems — and one on where it does not live, which is the more useful half.

• 15 · Five symptoms of an expired premise — Recurrence that survives good analysis, procedures followed exactly, numbers nobody can source, grammar that hides a count, and the veteran’s aside.
• 16 · Proxy variables — when the count stops tracking the thing — Operating hours standing in for calendar time, spend standing in for criticality, headcount standing in for capability. The commonest signature in the documented record.
• 17 · Intervals — the control that fails by never arriving — An interval control does not break while running. It fails by not coming due, and the compliance check answers not due, correctly, for years.
• 18 · Thresholds and limits inherited from a different world — Action limits, control limits and acceptance criteria carry an assumption about variation that was measured once, and is rarely measured again.
• 19 · Sample sizes and the supplier that changed — A sampling plan encodes a defect rate. When the rate moves, the plan keeps producing correct dispositions of an unrepresentative sample.
• 20 · Qualifications, competence and the person who left — A qualification records that someone was capable on a date. Currency of the record and currency of the capability are different things.
• 21 · Approved lists and the site that changed hands — Approval attaches to a name. Protection attached to a plant, a process and a team, any of which can be replaced without the name changing.
• 22 · Where Silent Expiry does not live — the seven exclusions — Poor execution, negligence, technical failure, obsolescence, root cause, drift and latent conditions. The exclusions are what make the term usable.

Level 4 · Diagnose §

The first level that asks the reader to do something. Three questions, applied to one control at a time, with an explicit standard for what counts as evidence and what does not.

• 23 · The three questions — Date, Witness, Counterfactual — The whole diagnostic, in a form that needs no software, no register and no permission, and that takes about ten minutes per control.
• 24 · Asking Date — when would this have stopped being true? — The question that converts a vague unease into a testable claim. Most premises cannot answer it, and the inability is itself the finding.
• 25 · Asking Witness — who outside this function would know? — If the only person who could confirm the premise is the person who owns the control, the premise has no independent verification and never had.
• 26 · Asking Counterfactual — would anything alarm? — The question that separates the controls that matter from the ones that merely look old. It is also the question that finds the self-revealing cases and removes them.
• 27 · Materiality — degraded is not absent — A twenty percent erosion of margin is a degraded control, not an absent one. The threshold, and why overstating it discredits the finding and the term.
• 28 · One control, one premise — the unit of analysis — An accident is not a control. Analysis is done one control-and-premise pair at a time, and a single event usually contains several, most of which are excluded.
• 29 · Grading what you find — Directly supported, partly inferred, unestablished, excluded. A grading scale exists so that a weak finding can be recorded honestly instead of being either inflated or discarded.
• 30 · Reading an accident report for premises — How to extract a control, its premise and the routing of signals from a published investigation — and how to tell when the report cannot support the reading.

Level 5 · Verify §

Why the verification already in place did not find any of this. Seven articles on the structure of audit and review, written for people who conduct them.

• 31 · What an audit actually verifies — Conformity of practice to record, and of record to requirement. Both comparisons are between two documented things, which is precisely the limitation.
• 32 · The third axis — record, execution, premise — Two of the three are audited continuously. The third has no standard instrument, and this article is about why that gap is structural rather than accidental.
• 33 · Why effectiveness review is a lagging comparison — Effectiveness asks whether the problem returned. A premise that has expired without an incident produces a clean effectiveness result.
• 34 · Management review and the questions it does not ask — The standard inputs are outputs of the system. None of them can report that a condition outside the system stopped being true.
• 35 · Internal audit under ISO 9001:2026 — What the revised clause changes, what it does not, and where a premise question fits inside a conformity audit without breaking it.
• 36 · Designing an audit question that reaches a premise — Practical wording. The difference between “show me the calibration record” and “show me what this interval assumed about use, and who confirms it”.
• 37 · Evidence — what would prove this is not Silent Expiry — A finding that cannot be refuted is not a finding. The specific evidence that disqualifies a case, and why looking for it first is the discipline.

Level 6 · Prevent §

Designing controls that carry their own reason. This is the level at which the practice becomes cheaper than the alternative, and the level most likely to be adopted piecemeal.

• 38 · Writing the reason down at the moment of the decision — One field, filled once, at the only moment when the reason is known without research. Everything else in this level depends on this article.
• 39 · The premise register — what it is and what it is not — Not a risk register, not a document list, not a new management system. A short list of statements about the world with dates and owners attached.
• 40 · Choosing a premise owner — The owner of a premise is rarely the owner of the control. Choosing the wrong one is how a register becomes a document nobody reads.
• 41 · Setting a review date for a premise, not a document — Document review cycles verify that text is current. A premise needs a date chosen from how fast the world it describes can move.
• 42 · Designing controls whose premises are self-revealing — The best outcome is a control that announces its own expiry and leaves the scope of this concept entirely. How to build one, and when it is not possible.
• 43 · Change control and the changes nobody decided — Management of change governs decided changes and does it well. The undecided ones — drift in use, in supply, in staffing — have no trigger and no owner.
• 44 · Compensating controls that are actually relied upon — A second control only restores protection if the organization identified it, relied on it and tested it. Coincidental coverage is not a compensating control.
• 45 · What to do when you find one — The disposition: record it, size it, decide whether the control is repaired, replaced or removed, and resist the reflex to raise a nonconformity against a compliant control.

Level 7 · Institutionalise §

Making the practice outlast the person who introduced it — including the honest account of what the concept does not explain.

• 46 · Making premises part of onboarding — The cheapest transfer point. A new engineer asking why a number is what it is costs nothing and is the last moment the question is socially free.
• 47 · Knowledge loss and the premises that leave with people — Retirement, reorganisation and turnover remove premise-holders faster than they remove controls. What can be captured, and what cannot.
• 48 · Supplier and outsourcing premises — Every outsourced process carries premises held by someone outside the organization, verified — if at all — by an audit that visits once a year.
• 49 · The annual premise review — A single recurring exercise: which premises would we not accept if we were writing the control today. How long it takes and what it produces.
• 50 · Measuring the work — what to count — Premises with a date, premises with an owner, premises reviewed and found false. Why counting findings rewards the wrong behaviour.
• 51 · Teaching the concept without a manual — How to introduce a vocabulary in an organization that already has too many. The one sentence and the one question that carry it.
• 52 · Why Silent Expiry exists — and what it does not explain — The closing article. What the concept adds, what it borrows, what it cannot account for, and the cases it correctly refuses.

Publication and revision §

One article a week, in the order above. Article 1 is published; the rest appear at /articles/NN/ as they are written, at permanent URLs that are never reused and never redirected. The sequence is fixed: an article may be revised, but it will not be renumbered, and nothing will be inserted between existing numbers.

Articles are dated and carry a revision number. Where an article was written against an earlier revision of the canonical definition, it is corrected or marked, and the change is recorded in the Revision history. The definition governs; the articles conform to it.

Corrections and counter-examples are the mechanism by which all of this has been revised. A worked case that breaks the three-condition test is the most useful thing a reader can produce.

The same material, as an investigation §

This library takes the concept apart one piece at a time, which is the right way to learn something and a poor way to experience it. The Norwood Files does the opposite: four years inside one plant, in which the pattern is met the way it is actually met — late, from the records, after several correct explanations have already been given and accepted.

The complete investigation

The definition, the four workbooks and every article here are free, and stay free. Nothing on this site asks for an email address.