Communication

Most organizations have a risk acceptance process on paper. What they actually have is hallway conversations and comment threads that vanish when projects close. When something breaks, everyone reconstructs who knew what from memory, under pressure, with lawyers involved. Aviation solved this problem decades ago with the MEL. The framework forces explicit conditions, named owners, and real expiry dates. Security work has similar machinery. We just let it collect dust while risks drift between teams unowned.

You did the hard work. Found the buried metric, rebuilt the report, put the lever in the top-left tile. The meeting went beautifully. Everyone nodded. Then nothing changed. Here’s what I keep relearning: a lever is not a mechanism. It’s a person with a calendar, a bonus structure, and reasons to leave things exactly as they are. Most reports die in the gap between who requested them and who has to work differently on Monday.