The board plan counts a large customer renewal. The customer is positive, so the forecast treats the money as likely. But procurement has not started, the promised product work depends on one engineer and the cash plan leaves little room for a delay. Each fact looks manageable in its own system. Together, they could remove the company's options.
Hidden operating risk is not simply a list of bad events. It is the gap between an outcome the company believes it can deliver and the way the work actually holds together under pressure. Finding that gap requires more than an owner and a recovery checklist. It means understanding ordinary work, the compromises shaping it and how much surprise the company can still absorb.
1. What must remain true, and for how long?
Start with three to five outcomes whose failure would materially change the company: payroll runs, customer data remains protected, an important launch works, a permission remains valid or runway reaches the next proof point. This follows the useful core of ISO 31000: risk only becomes meaningful in relation to an objective.
Then state how much deterioration the outcome can absorb. “The launch cannot slip” creates alarm but no decision. “A delay beyond five working days threatens the renewal and brings cash below the board's agreed floor” identifies an impact limit. Operational- resilience practice uses the same move: define the important service and the maximum disruption it can tolerate before mapping what supports it.
- Outcome: what must keep working for customers, cash, compliance or the next company milestone?
- Impact limit: at what point does degraded performance create material harm?
- Decision window: how much time remains between the first warning and the loss of a useful option?
2. How does the outcome actually hold together today?
Map the work as people perform it, not as the policy or project plan says it should happen. Include the people, information, permissions, technology, providers and handoffs that keep the outcome true. Then add the manual fixes, exceptions and judgement calls that disappear from the clean version of the process.
Erik Hollnagel's distinction between work-as-imagined and work-as-done matters because variation is not automatically failure. People adapt to incomplete tools and changing conditions every day. That adaptation often creates reliability. It becomes fragile when it is invisible, concentrated in one person or consuming capacity faster than the company can replenish it.
- People: who carries knowledge, authority or trusted relationships that have no substitute?
- System: where can one provider, credential or dataset interrupt several outcomes at once?
- Adaptation: what does the team repeatedly do to make the official process work?
- Assumption: which plan input is being treated as fact without fresh evidence?
3. What happens when the operating model stops making sense?
Rasmussen's work shows how repeated pressure can move normal work towards a boundary without anybody choosing to become reckless. A shortcut saves the launch. Nothing bad happens. It is used again, and the absence of failure is mistaken for proof that the operating model is sound. The risk was not hidden because nobody knew it; it was hidden inside a history of local successes.
Coupling makes those compromises consequential. Acme's renewal, the runway plan and the next fundraise may all depend on the same product delivery and founder relationship. Silence prevents the pattern from becoming visible: the engineer knows the delivery is brittle, sales knows procurement has not begun and finance knows the payment date matters, but no owner sees the combined system.
Amy Edmondson's research connects psychological safety with the learning behaviours that let teams expose errors and ask for help. That is why “what are we not saying?” is not a culture exercise on the side of risk management. It is part of the sensing system.
Match the response to the kind of uncertainty
One risk process cannot handle every threat. Kaplan and Mikes distinguish risks that should be prevented, risks accepted in pursuit of strategy and external risks the company cannot control. Their later work on novel risk adds a further warning: familiar responses can become dangerous when events combine at an unfamiliar scale, speed or pattern.
- Preventable: use a clear boundary, control, separation of duties or independent check.
- Strategic: expose the assumption, run a bounded test and set the decision gate before the result arrives.
- External: create alternatives, buffers, insurance where appropriate and severe-but-plausible scenarios.
- Novel: treat anomalies and combinations that do not make sense as a reason to slow interpretation, assemble expertise and give somebody authority to respond.
Test capacity while the company still has options
A recovery document proves that somebody wrote a recovery document. Test whether the company can detect the disruption, make the decision and continue within its impact limit. The exercise can be modest: restore the export, have the deputy run payroll, remove the main provider from a tabletop launch or model the cash plan without the expected renewal.
David Woods's resilience work pushes beyond returning to normal. The deeper question is whether the system can extend its capacity when surprise exceeds the plan. Slack, modularity, alternative routes and access to relevant expertise preserve that capacity. Efficiency removes it easily because unused capacity looks wasteful until the operating model stops making sense.
The test is therefore not “did the backup work?” It is “did we notice in time, preserve the important outcome and learn which assumption about our capacity was wrong?” A company becomes safer when a test changes the operating model, not when it confirms the existence of a checklist.
Objective-aware AI can see risk before a register can
Most monitoring watches systems: uptime, cash balance, overdue work or contract dates. These signals are useful but isolated. An AI that understands the company's accepted objectives can ask a more useful question: does the current evidence still support the operating assumptions behind those objectives?
That changes early detection. The agent can notice negative space: a renewal counted in the cash plan without procurement progress, a launch objective without a recent recovery test or a filing that still has an owner but no valid credential. It can find correlated fragility when several objectives depend on the same person or provider. It can also see compensation load: a growing pattern of manual fixes that keeps the headline metric healthy while the operating margin for error disappears.
A company agent such as Cady could maintain that objective– evidence graph across decisions, customer conversations, work, calendars and company records. The useful output is not a synthetic risk score. It is a sourced divergence: this objective assumes X; these records now show Y; this is the decision window; this owner should review it.
That is also how the system can improve without pretending to predict the future. Preserve which signals were escalated, how the owner judged them and what happened next. Over time, the agent can become more selective about the patterns that precede consequential drift in this company. The objectives and risk appetite remain human decisions; the agent makes it harder for relevant evidence to remain fragmented, stale or silent.
Build an objective-aware risk review
Give the agent a standing job: test whether current company evidence still supports the operating assumptions behind a small set of accepted objectives. It should find divergence and preserve context, not produce a longer list of things to fear.
- Evidence pack: accepted objectives and impact limits; decisions and assumptions; customer, cash, work and calendar records; owners and dependencies; exceptions, incidents and the last credible resilience test.
- Working brief: compare the operating assumption with current source evidence. Look for stale proof, contradictions, missing expected events, repeated compensation and dependencies shared by several objectives. Rank by the decision window and options at risk, not dramatic language.
- Permitted action: prepare a focused owner review showing the objective, assumption, divergence and sources. Request missing proof, draft a bounded test and schedule the agreed recheck after human approval.
- Review gate: people set objectives, impact limits, risk appetite, priority and closure. The agent must not invent likelihood, turn absence into a fact, change production or quietly rewrite an objective to make the evidence fit.
- Learning record: preserve why the pattern was accepted, dismissed or reframed, which evidence changed the decision, whether the test exposed lost capacity and what outcome followed. Supersede rejected interpretations rather than allowing them to linger as model memory.
Over time, the agent learns which patterns genuinely precede drift in this company and which create noise. The system becomes more selective because every escalation, decision and outcome remains attached to the objective and evidence that produced it.
A useful next move
Choose five outcomes the company cannot casually lose. Set an impact limit for each, then ask the people doing the work where they compensate for the operating model. Capture one drift, coupling or silence pattern worth testing. Remove everything that would not change a decision, boundary or investment.
Continue with Claire Hughes Johnson’s operating system, or read how runway preserves decision time.