“Wooden-headedness, the source of self-deception, is a factor that plays a remarkably large role in government. It consists in assessing a situation in terms of preconceived fixed notions while ignoring or rejecting any contrary signs.” – Barbara Tuchman, The March of Folly: From Troy to Vietnam (1984)
The monthly numbers were exactly what you’d want to see. Revenue on track, margins holding, nothing in the report that needed explaining twice. It was only afterwards, in the sort of loose conversation that happens once the formal part of a meeting has ended, that someone mentioned Sarah couldn’t take leave over month end. Nobody else, it turned out, fully understood how the reconciliation actually worked. Not the steps that were written down, but the parts that weren’t.
Nothing had gone wrong. Nobody had hidden anything or failed to do their job properly. The report was accurate. It was simply reporting on a version of the business that didn’t quite match the one actually running.
A similar thing happens more often than most owners notice. A customer complaint gets resolved smoothly, in a way the business is happy with, and it’s only later you learn the real reason it went well: one long-serving employee remembered an informal agreement, made years earlier, that exists nowhere in writing. The system worked. It just wasn’t the system on paper that made it work.
What a Good Report Leaves Out
Financial and operational reporting became the way most businesses watch themselves because it does that job well. It measures what can be measured, assigns what can be assigned, and gives a leadership team something reliable to look at every month. None of that is a criticism. A board pack can be immaculate on the numbers and still leave something truly important sitting entirely outside its scope, not because anyone was careless, but because there was never a line on the template for it.
A service dashboard shows every target being met. It doesn’t show that the service manager is personally intervening most days to keep it that way. A forecast holds together because the founder knows, from years of experience, which customer promises can be trusted and which can’t. That knowledge never appears anywhere in the forecast itself. It sits behind it.
That differs slightly from the limits of what formal assurance can establish. An audit or compliance review examines defined obligations and controls. Ordinary management reporting sits closer to the daily life of the business, yet it carries a similar boundary. It won’t fail an audit. It’s simply built to answer a narrower question than the one that actually determines whether the business holds together.
The Job Title That Hides the Risk
An organisation chart shows positions, authority and reporting lines. It rarely shows what people have accumulated around those responsibilities through years of experience, remembered exceptions and personal trust.
A long-serving operations manager holds the history behind supplier decisions nobody else remembers making. A finance manager knows, almost by instinct, which anomalies are harmless and which suggest something worse. A salesperson understands the personal commitments sitting underneath a major contract, commitments that were never written into it. Their formal responsibilities may be properly delegated and clearly documented. The real role has grown up around those responsibilities through memory, trust and years of simply handling the exceptions nobody else knew how to handle.
Key person dependency doesn’t announce itself as a business risk, because it usually starts as competence. Someone becomes very good at their job, the business comes to rely on that, and over time that reliance turns into exposure without anyone deciding it should. Two people can hold the same job title, and everyone in the building still knows only one of them is trusted with the difficult cases. A manager resigns, and the procedure manual turns out to describe the standard process faithfully while saying nothing about the exceptions that made it actually work.
How Bad News Slows Down on Its Way Up
Knowledge concentrated in one person is one version of this. Information that exists more widely, but changes shape as it travels, is another.
Bad news is rarely suppressed by anyone giving an explicit instruction not to raise it. More often, people try to resolve a problem on their own before it needs to trouble senior management. They soften the uncertainty, leave out the more awkward detail, wait for confirmation before saying anything, or wrap the problem in enough reassurance that it feels contained by the time it’s mentioned. Each of those choices, taken on its own, is reasonable. The cumulative effect is that leadership ends up with a cleaner account of the business than the one being lived a level or two down.
The business culture does a great deal of this work, usually without anyone intending it to. A leadership team can say, quite sincerely, that it wants honesty, while reacting with visible impatience to uncertainty or rewarding the managers who always appear to be firmly in control. People learn quickly which information travels easily and which requires careful handling first. Morrison and Milliken’s research on what they call organisational silence found something close to this: that silence tends to be a collective response, rather than an individual failure of nerve, born from a shared sense across the organisation that speaking up simply isn’t worth the risk.
A recurring customer complaint gets handled locally for weeks, because each individual instance seems too small on its own to escalate. A delayed project gets reported as “being managed,” because admitting real uncertainty feels less acceptable than reporting something that at least sounds definite.
The problem was present. The organisation may even have discussed every part of it. What failed to travel was its significance.
Relationships the Business Does Not Own
There’s a further layer beyond internal knowledge, and it sits in the relationships a business assumes it owns.
A customer buys from the company, signs its contracts, and appears correctly in the CRM. The commercial relationship is recorded. What isn’t recorded is that the relationship itself, the trust that makes the customer comfortable, still rests largely on one person. This shows up most sharply in founder-led businesses, where the founder’s own relationships and judgement often carry more of the commercial weight than anyone has properly acknowledged. It’s a pattern I’ve watched play out, and described in how an organisation gradually learns to depend on what the founder personally carries.
But this pattern is not just limited to founders. A senior salesperson leaves and customers reconsider arrangements management assumed were secure. A technical specialist departs and a supplier becomes less accommodating because the personal history has gone. The relationships were always visible. What remained uncertain was whether they belonged to the organisation or merely passed through it.
A business may grow, employ more people and strengthen its systems, yet still rely on a few individuals to translate trust, history and judgement into commercial continuity. The risk here is that it can therefore appear scalable while some of its value remains personal.
Why the Risk Register Can’t Hold This
Put these observations next to each other and something becomes visible that none of them show on its own.
The operations specialist knows nobody else understands the exceptions. The account manager knows one particular customer only really trusts the founder. Employees further down know which problems can be raised freely and which need careful framing first. Each person holds a piece of the exposure. What’s often missing isn’t information at all, but how and where those separate pieces become visible together, as a pattern rather than a collection of unrelated facts.
These risks sit awkwardly between the responsibilities a business already has in place. Operations sees whether the work gets done. Finance sees whether the numbers hold up. HR sees retention and succession. Sales sees the customer relationship. Each function reasonably assumes the whole picture is being watched somewhere else, without anyone actually having that responsibility.
When Everyone Knows the Risks examined business risks that were already recognised but left without an owner. This sits one stage earlier than that. The exposure hasn’t yet become a recognised risk at all, because no single role was ever expected to gather the fragments and see the shape they make together, and that, more than any single dependency or delay, is often what the resilience of a business ultimately rests on.
A board may eventually ask who should have identified the exposure. The uncomfortable answer is that every relevant person saw the part that belonged to them. Nobody had been asked to see what happened when those parts were combined.
It’s also why this category of business risk resists the tools built to manage the others. A risk register needs a clear event, an assigned owner, something measurable enough to track. This kind of exposure has none of those. It doesn’t get entered anywhere, not because anyone decided it wasn’t worth entering, but because nothing about the way risks get recorded was built to contain it.
The Report Remains Right
None of this means the reports were wrong – the figures were accurate. The dashboard reflected what it was designed to measure, Sarah really was excellent at her job, and the informal agreement really did resolve the customer’s problem. Every individual account of the business was true.
It’s only when you stand back from all of them at once that a different question starts to form, one that has very little to do with the accuracy of anything anyone reported.
Perhaps the risk was never invisible at all. Perhaps it was only ever waiting for someone whose job it was to notice.
If something similar were sitting unnoticed inside your own business right now, whose job would it actually be to see it?
If you enjoyed this article you can subscribe here to receive future articles.
—
0 Comments