The finding
Smaller organisations often have a reputation for being more exposed to risk than larger ones, simply because they have fewer resources to absorb a shock. What is less often discussed is that smaller organisations frequently have better risk visibility — not because they manage risk more rigorously, but because the people making decisions are close enough to operations to see problems forming without needing a formal reporting mechanism to tell them.
Larry E. Greiner’s research on organisational growth phases helps explain why this visibility does not scale automatically. Each phase of growth in Greiner’s model is governed by a different dominant coordination mechanism — direct supervision in the earliest phase, giving way to delegation, then formal systems, then more collaborative and networked coordination as the organisation grows further. Each transition trades a degree of direct, first-hand visibility for a degree of formal reporting. The trade is not symmetrical: formal systems are good at surfacing risks they were designed to detect and comparatively poor at surfacing risks nobody thought to build a report for.
The result is a structural pattern rather than an occasional failure: as organisations grow, the category of risk visible to leadership narrows to whatever the current reporting structure was designed to capture, while the actual range of risk the organisation is exposed to continues to expand alongside its operations, its headcount, and its complexity.
How this shows up in practice
In a small organisation, a leader might notice a quality problem by walking the floor, overhearing a conversation, or fielding a complaint directly. As the organisation grows, that same leader increasingly relies on a dashboard, a report, or an escalation process to surface the equivalent problem — and each of those mechanisms only reports what it was built to measure. A new kind of risk, arising from a part of the business that did not exist when the reporting structure was designed, can develop for a considerable time without triggering any of the existing formal signals, simply because no one built a channel for it.
This is not usually a failure of diligence. The formal systems that replace direct observation are often well designed for the risks they were built to catch. The gap opens specifically around risks that emerge after the reporting structure was set, in parts of the organisation the structure was not designed to watch.
Why it happens
The mechanism is the same one that governs governance more broadly during growth: coordination methods that work at one scale are replaced by different methods at the next scale, and the replacement is rarely comprehensive. Formal risk reporting tends to be built in response to risks that have already materialised — a near-miss, an incident, a regulatory requirement — rather than designed in anticipation of risks that have not yet appeared. This means every formal risk system carries an implicit bias toward the past: it is very good at watching for a repeat of what has already happened, and structurally blind to categories of risk that simply did not exist when it was built.
As organisations add layers of management and formal process, this blindness compounds, because each additional layer between where a risk originates and where leadership sits is another point where a signal not covered by the existing system can be filtered out — not deliberately, but simply because nobody at that layer has a formal channel for raising it.
Where it varies
The gap between actual risk and visible risk tends to be widest in organisations that have grown quickly through acquisition or rapid geographic expansion, because the reporting structure inherited or hastily extended to cover new territory was rarely designed with that territory’s specific risk profile in mind. It tends to be narrower in organisations that have grown more gradually and have had more opportunity to revise their reporting structure incrementally as new categories of risk became apparent.
Sector also matters: organisations operating in more heavily regulated environments often have more comprehensive formal risk reporting by requirement, which narrows — though does not eliminate — the gap, since regulatory reporting still tends to track known, previously identified risk categories rather than emerging ones.
A common misconception is that adding more reporting — more dashboards, more frequent updates, more metrics — closes this gap. In practice, additional reporting built on the same underlying design assumptions tends to increase confidence in the existing categories of risk without addressing the categories that fall outside them. An organisation can substantially expand its formal risk reporting and still have no better visibility into a genuinely new category of risk than it did before, because the expansion was built to see further into familiar territory rather than into unfamiliar territory.
The consequence of this gap tends to be asymmetric in its timing. Known-category risks, well covered by formal reporting, are typically caught early enough to manage with some choice in the response. Risks that fall outside every existing category tend to surface only once they have already caused a visible problem — a customer complaint, an operational failure, a compliance breach — because nothing in the existing structure was watching for them, and by the time they are visible, the range of available responses is usually narrower and more reactive.
For how this pattern presents in other kinds of organisation, see other sectors.
Questions worth considering
- When was the risk reporting structure last redesigned, and has it been revised to reflect parts of the organisation that did not exist at the time it was built?
- What risks would leadership only discover today through direct, informal contact — the same way a much smaller version of the organisation once discovered everything?
This perspective is part of Governance.
Your team is facing similar challenges?
Subscribe to The Riddle Ledger
Perspectives are sent as they are published, with no promotional email, and you can unsubscribe at any time.