Dr Peter Stephenson.

The Dark Pyramid · Organisational Vulnerability Audit

Where could serious organisational harm develop, persist and escalate?

A practical executive diagnostic. Fifteen prompts across the three faces of the Dark Pyramid, followed by an action plan for the vulnerability that matters most.

How to use Score independently first. Discuss the largest disagreements and the connections between vulnerabilities - not simply the total.

Your answers are saved only in this browser, on this device, so you can come back to them. They are sent nowhere unless you ask for a copy by email.

Free access

Enter your email to open the audit

One email address opens both Dark Pyramid tools and their printable versions on this device.

I use your address to see who is using the tools, and to email you only if you tick the box. Your answers in the audit stay in your browser unless you ask for a copy by email. Privacy notice.

Scoring key

Score each prompt from 0 to 4

Choose one score for each prompt. Use evidence, not instinct.

0-1Green: resilient or minor vulnerability
2Amber: mixed evidence or potential vulnerability
3-4Red: significant or serious vulnerability requiring attention

Red does not mean failure is likely.

Internal (f)actors

People, power, culture and internal systems

1Power is concentrated in people who can override normal challenge or controls.

2Bad news is filtered, softened or delayed as it moves upwards.

3People may face personal or career costs for challenging successful or powerful colleagues.

4Performance pressure or incentives could encourage unacceptable shortcuts or risk-taking.

5There are areas where a serious problem could remain hidden from senior management.

Key questionWho can make something happen even when others think it is a bad idea?

External (f)actors

Customers, investors, advisers, partners and market pressures

1Important external stakeholders benefit from us continuing to appear successful.

2We depend heavily on customers, investors, lenders, suppliers or partners who can shape decisions.

3External advisers may be economically or reputationally invested in our existing direction.

4We tend to discount critics, former employees, journalists or other uncomfortable external voices.

5Industry norms, competition or market expectations could normalise behaviour we would otherwise question.

Key questionWho outside the organisation benefits from us continuing to believe things are going well?

Regulatory (f)actors

Boards, assurance, compliance, auditors and formal regulators

1Those expected to stop harmful activity may lack information, independence or authority.

2Commercial priorities can override or dilute risk, legal, compliance or professional concerns.

3Oversight bodies rely heavily on information selected or interpreted by management.

4Responsibility for a key risk is fragmented, making it easy to assume someone else is dealing with it.

5We could comply with formal rules while still creating significant harm.

Key questionWho has both the information and the authority to say “stop” - and why might they fail?

Interpret the pattern - not the total

Look for what reinforces what

The Dark Pyramid is designed to reveal relationships and reinforcing conditions, not to produce a single probability score.

Do not average away disagreement. A cluster of amber/red vulnerabilities that reinforce one another across different faces of the pyramid can be more important than a high total score.

INTERNAL EXTERNAL REGULATORY OUTCOMES Who bears the consequences if we are wrong?

0 of 15 scored. Each dot is one of your scores. Now rate each face green, amber or red using judgement, not a mechanical average.

Internal
External
Regulatory

What to look for

  • Where are amber/red scores clustered?
  • Which vulnerabilities reinforce one another across faces?
  • Where do executives disagree most - and why?
  • Who would score this differently if they were in the room?
  • Which safeguard should stop a harmful pathway - and why might it fail?
  • Who receives the benefit, and who bears the consequences?

Action plan

Trace one vulnerability through the system

Choose a vulnerability and trace how it could develop through the system.

  1. Trigger
  2. Enables
  3. Reinforces
  4. Fails to stop
  5. Harm

Action to break the pathway

Repeat as necessary: each one gets its own pathway and action.

Prefer paper? Download the printable version (PDF, A4, 2 pages).

Diagnostic aid based on Stephenson, Bolden & Witzel (2026), The Dark Pyramid, British Journal of Management. doi:10.1111/1467-8551.70057. Scores indicate areas for inquiry, not a validated probability of failure.