RIVER Brief | Edition 7
What four books reveal about why strong organizations still get blindsided — and what leaders can do about it.
The org chart is full of boxes. Board. Risk. Audit. Cybersecurity. Technology. Data. Legal. Business.
Most governance frameworks are full of boxes too.
But consequential decisions do not stay in boxes. They move.
A strategy moves from the board into a business unit. A technology design moves into delivery. A model moves from experimentation into production. A control exception moves from one team to another. Evidence moves upward. Accountability moves sideways. Context gets translated — or lost.
That is where trouble begins.
Putting Governing AI Risk — The RIVER Charter alongside three others from our book series — Tim J. Leech’s Mission-Critical Governance, Patrick M. Hayes’s Integrated Assurance, and Christopher Stitt’s Scaling Pyramids — surfaced one recurring failure pattern:
The books operate at different levels of the organization, but they converge on the same vulnerability:
Governance often does not break inside the boxes. It breaks in the arrows between them.
An organization can have a thoughtful board, mature risk functions, strong technology teams, capable auditors, and experienced leaders — and still get blindsided when evidence, authority, and accountability stop traveling together.
1. Start with purpose: what must not fail?
Mission-Critical Governance starts one step before risk lists or assurance reports: purpose. Leech’s challenge is not that boards lack intelligence or diligence. It is that governance systems can be busy, compliant, and information-rich while still failing if boards have not defined why they exist and what mission-critical objectives follow from that purpose.
Purpose is not a preamble. It determines what deserves sustained board attention. Leech’s purpose-anchored approach begins by defining board purpose clearly, identifying the mission-critical objectives that determine enterprise survival and success, and aligning uncertainty, risk, assurance, culture, and performance around those objectives. That is a different question from asking whether the board received the risk report or whether the committee met on schedule.
A board can see dozens of dashboards and still lack line of sight to the few objectives the enterprise absolutely cannot afford to misunderstand.
At the board level, the handoff question begins with purpose and meaning: when purpose becomes objectives and strategic intent moves into the organization, does everyone still know what must not fail — and why?
2. Assurance has to travel with the work
Patrick Hayes moves closer to the operating system. Integrated Assurance argues that cybersecurity and IT operations cannot be treated as separate worlds, particularly inside large, complex enterprises where legacy systems, global operating models, local requirements, innovation, and compliance constantly collide.
The larger lesson is not limited to cybersecurity. Assurance is weaker when it becomes something added after the operating decision. If one team considers the work ready while another team is still reconstructing the evidence, the organization has created a handoff problem even if both teams are individually competent.
The stronger model is assurance embedded into how the work moves: shared evidence, common expectations, visible exceptions, and enough alignment that resilience is part of delivery rather than a review of delivery after the fact.
At the operating level, the vulnerable seam is evidence: when work crosses a boundary, does the proof travel with it?
3. AI multiplies the seams
In Governing AI Risk — The RIVER Charter, the starting point is convergence. AI rarely creates a single-domain problem. One meaningful use case can touch data lineage, model behavior, human judgment, cybersecurity, third parties, customer outcomes, regulatory expectations, operational resilience, and business value at the same time.
Organizations still tend to govern those domains through separate structures. The technology may be modern; the handoffs often are not.
That is where Risk Debt accumulates. A deferred control, an ambiguous owner, an untested dependency, a data exception, or a shortcut that appears manageable in one function can become consequential when another part of the system depends on it later.
AI raises the stakes because it can increase both speed and connectivity. The faster the work moves — and the more systems, people, models, and vendors it touches — the more dangerous a weak handoff becomes.
With AI, the hardest seam is convergence: when the decision crosses domains, who sees the whole risk instead of only their piece of it?
4. The middle carries the governance system
Christopher Stitt’s Scaling Pyramids supplies the human layer that governance discussions often underweight. His book focuses on leading from the bottom and middle of complex organizations — influencing up, down, and across; building trust; navigating politics and process; and creating change without relying only on formal rank.
One of the book’s most useful ideas is that the middle of the organizational pyramid is not simply a waiting room for the next promotion. It is a center of gravity where culture, performance, and credibility are built or broken.
That is also where many governance handoffs become real.
Boards can define purpose. Risk can set thresholds. Technology can define architecture. Cybersecurity can define controls. Audit can define assurance. But someone still has to reconcile those requirements inside a real program, product, transformation, or operating decision — usually with imperfect authority, competing incentives, and a deadline that does not care about the org chart.
In the organizational middle, the handoff becomes human: who carries the decision across the boundary when nobody owns the entire system?
The fifth idea: strong boxes can still make a weak system
These four books do not make the same argument. That is exactly why the combination matters.
Together, they expose four failure points in the handoff: purpose and meaning, evidence, convergence, and human ownership.
The org chart shows the boxes. Risk lives in the arrows.
Mature governance is not only the quality of each function. It is the quality of the handoffs between functions – the points where purpose becomes objectives, objectives become work, work becomes evidence, evidence becomes judgment, and judgment becomes accountable action.
A company can strengthen every box on the org chart and still remain fragile if the arrows are weak.
Which handoffs deserve explicit governance?
Not every handoff needs another control, committee, or approval. The question is which ones are capable of materially changing a consequential outcome if meaning, evidence, context, or decision authority gets lost. For a board, that may be a handoff affecting a mission-critical objective. For an executive team, it may be where business value collides with technology, security, privacy, data, legal, or risk. For Audit, the question is whether assurance survives the chain rather than stopping inside individual functions.
The handoffs worth governing explicitly are the ones where failure could materially alter the outcome — and where no single leader currently owns the integrity of the end-to-end decision. Those are the seams I would test first.
The Handoff Test
This is not a proposal for another governance framework. It is a practical design test.
Start with one consequential initiative — an AI deployment, a major transformation, a cybersecurity change, a regulatory commitment, an acquisition, or a product launch — and identify the next three handoffs capable of materially changing the outcome.
1. What outcome is being handed off? What does the receiving team now need to preserve, decide, deliver, or protect — and what would materially change if the handoff fails?
2. Who owns the decision at this boundary? Is ownership explicit before, during, and after the handoff — and who has the authority to challenge, stop, or redesign the work when needed?
3. What evidence must travel with it? Can the receiving team see why the work is believed to be ready, what remains uncertain, and which assumptions are still open?
4. What dependencies, controls, or risks could be lost in transfer? When business value, architecture, security, privacy, data, legal, risk, and delivery priorities collide, what context or condition must not disappear between teams?
5. How will we know the handoff worked — or failed? Does the outcome, exception, or unresolved risk become visible and escalate, or can it disappear into minutes, email, backlog, or informal agreement?
If those answers are obvious, governance may be stronger than the org chart suggests.
If nobody can name who owns the decision at the boundary — beyond ‘the committee will work it out’ — you may have found the real risk.
Why this matters more in the AI era
AI can increase both the number and speed of organizational handoffs, while many operating models still rely on boundaries designed for slower and more separable decisions. A single use case can move through product, data, technology, model governance, cybersecurity, privacy, risk, legal, procurement, compliance, operations, and customer-facing teams before it reaches production.
Adding more committees can create more interfaces without creating more accountability.
The answer is not to eliminate specialization. Specialized functions exist for good reasons. The answer is to make the seams visible, deliberate, and testable — and to make sure the evidence and decision rights move with the work.
Where resilience is actually built
Many consequential governance failures become visible after the fact as missing context: one team knew something another team did not; one function believed another had approved; one committee discussed a risk but nobody owned the consequence; one leader saw the problem but did not have the authority to stop the work. Each is a handoff failure — meaning, evidence, ownership, or authority did not travel with the work.
Governance fails in the handoffs. Resilience is built there too.
One question for leaders, operators, risk professionals, auditors, technologists, and anyone who has had to make a complex organization move:
When a consequential decision crosses functions in your organization, what is most likely to get lost — meaning, evidence, ownership, authority, or context?
Books featured in this RIVER Brief
• Governing AI Risk — The RIVER Charter: An Enterprise Resilience Standard — Alex Golbin
• Integrated Assurance: Unified Risk Strategy — Patrick M. Hayes
• Mission-Critical Governance: Focusing on What Matters Most — Tim J. Leech
• Scaling Pyramids: Leadership Lessons from a Mid-Level Bureaucrat — Christopher Stitt
