The symptom
Consider an organisation where a quality sign-off is required at a particular stage of a process, and has been given on every single occasion for more than two years — including on work that was later found, downstream, to be defective. The sign-off has never once been withheld.
What leaders usually conclude
The natural first read is that the person responsible for the sign-off is not doing the check properly — going through the motions, approving by default rather than by genuine assessment.
What the evidence suggests
In the scenario above, the sign-off is requested at a point in the process before the information needed to assess quality is actually available. The person responsible has raised this twice. The control exists in the wrong place in the sequence: it produces a record of assurance without the underlying possibility of assurance, because the thing being signed off cannot yet be properly evaluated when the signature is required.
This has a direct parallel at board level as organisations scale. A board’s oversight function is frequently formalised — sign-offs, quarterly reviews, approval gates — well before anyone checks whether the information reaching the board at that point in its own cycle is actually sufficient to support genuine judgement rather than ratification of a decision already effectively made elsewhere. As organisations grow, the distance between where information is generated and where the board sits tends to increase, and a governance structure built for a smaller, closer organisation can end up asking the board to sign off on things at a point in the information flow where meaningful oversight is no longer structurally possible — not because the board has become less diligent, but because the sequence around it has shifted while the sign-off point stayed fixed.
Competing explanations
There is a real difference between a control that has failed because the people operating it are not doing their job, and a control that has failed because it sits in the wrong place in a sequence that has since changed. The first calls for a conversation about diligence. The second calls for moving the control itself — closer to where the information genuinely becomes available — and no amount of encouraging the existing sign-off point to be “more rigorous” resolves a problem that is structural rather than behavioural.
A third possibility deserves consideration: that the control was correctly placed when it was designed and has simply not been revisited since the organisation’s information flow changed shape, which makes this less a design flaw than a maintenance gap — a control nobody has re-examined since the conditions that once justified its position quietly stopped applying.
The consequence of leaving a misplaced control in place is not neutral. A sign-off that has never once been withheld, over a long enough period, tends to be treated by everyone downstream as reliable evidence that the thing it certifies is genuinely sound — precisely the assumption the scenario above shows to be unsafe. The organisation is not merely failing to catch some defects; it is actively generating a paper trail that says quality has been checked and confirmed, when in fact the check that was meant to happen structurally could not. This is a more serious problem than an absent control, because an absent control is at least honestly absent, while a misplaced one manufactures false confidence.
A related misconception is that board-level oversight, once formalised into a recurring sign-off or review cadence, can be assumed to remain well placed indefinitely. Formalising a control is often treated as the end of the governance work rather than the start of an ongoing obligation to confirm the control still sits where genuine judgement is possible. As the distance between information generation and board review continues to grow with further scale, a control that was well positioned at the point of formalisation can drift out of position again, sometimes more than once over an organisation’s life, without any single decision ever having moved it.
It is worth noting, too, that the person operating a misplaced control is often the first to recognise the problem, precisely because they are the one being asked to certify something they cannot actually assess. In the scenario above, the signer raised the issue twice — meaning the organisation had the information needed to catch this well before it became a pattern spanning two years. That the signal was raised and not acted on suggests the barrier was not a lack of awareness but a lack of any established channel for a control’s own operator to prompt a review of where the control sits.
For how this pattern presents in other kinds of organisation, see other sectors.
Questions worth considering
- Does the information available at the point of the governance control genuinely support the judgement the control is meant to provide?
- When was each board-level sign-off last checked against the organisation’s current information flow, rather than the flow it was originally designed for?
More on this topic: Governance.
Your team is facing similar challenges?
Subscribe to The Riddle Ledger
Perspectives are sent as they are published, with no promotional email, and you can unsubscribe at any time.