You cannot govern drift by watching everything. It concentrates in four places, and inspecting those four beats any platform that promises to watch them all.
Once leaders accept that the system they run has drifted from the system they documented, the next question is the practical one. Where do I look? You cannot reconcile everything at once, and the attempt is how a lean team burns its attention and still misses the leak. You do not need to watch everything. Across four decades of programs, drift concentrates in four places, and if you inspect those four on a cadence, you catch most of it for a fraction of the effort.
What the Market Sells You Instead
The standard answer to “we cannot see our risks” is a platform. An enterprise governance suite that instruments everything and assumes a central risk function to read it. Most mid-market organizations have neither the budget nor the function. And here is what the platform vendors leave off the slide: even fully instrumented enterprises miss drift, because the tooling checks whether a documented control exists, not whether anyone still performs it. Watching the four places is how you aim scarce attention at where the money leaks, with the team you already have.
Place One: Decision Rights
Decision rights are the rules for who decides what. They are the first thing to move, because they move whenever people do. A manager leaves and their approvals get absorbed by whoever is nearby. A reorganization renames a function while the old gate keeps operating under someone who no longer holds that role. A busy leader delegates a call informally, and the informal arrangement hardens into the real one. On paper the decision belongs to a defined role. In practice it belongs to a person, and when the person changes, the right drifts with them while no document catches up. The cost surfaces later, when a decision made by the wrong authority has to be unwound.
Place Two: Controls
Controls are the checks that keep the system safe, and they drift by erosion. A control that adds friction gets worked around under pressure. The workaround becomes the norm. Eventually the control exists in the documentation but not in the work. I call this a phantom control. The audit binder says a second review happens. The running system stopped performing that review eleven months ago, the first time a deadline made it inconvenient. Phantom controls are dangerous precisely because they read as present. Leadership believes the safeguard is operating. It is not. The organization is exposed in the exact place it feels most protected.
Place Three: Workflows
Workflows drift through optimization, the least suspicious cause of all. Teams improve their own work. They find shortcuts, reroute steps, drop tasks that stopped adding value. Each change makes the local workflow better and moves it further from the documented one. When those local optimizations are never coordinated across teams, they also stop fitting together. One team gets faster by handing off earlier. The next team was built to receive later. The seam that used to work now generates rework, and both teams are certain the other one changed something.
Place Four: Assumptions
The fourth place is the quietest and the most consequential. Every process rests on assumptions about the world. Volumes look like this. Customers behave like that. This data source is reliable. This vendor is stable. Those assumptions were true at design time, and assumptions do not announce when they expire. A process built for hundreds of transactions a day meets thousands and holds on heroics until it does not. A rule written for one customer profile runs against a base that has quietly shifted. The workflow did not change. The world beneath it did, and the design no longer matches the reality it was built for.
Hold on to this one, because assumptions are where drift meets artificial intelligence. When you put an automated system on top of a process, you hand it your assumptions and it runs them at scale, faster than any human could. If the assumptions have gone stale, you have not fixed the drift. You have accelerated it. That is a thread we pick up later in the season, and it is the reason stale assumptions belong permanently on your inspection list.
Why All Four Read Green
Here is what ties the four together and makes them dangerous. Every one can be fully drifted while your dashboard stays green. Decision rights that migrated to the wrong person still produce approved work. Phantom controls still show complete in the record. Optimized workflows often improve the same metrics leadership watches. Stale assumptions produce clean output right up to the day volume or behavior tips past their limit. None of the four trips an alarm, because none breaks the reported picture. They break the running system underneath it, and the reported picture is not looking there.
This is not a rounding error. Across the programs I have seen, hidden costs of this kind run to between forty and sixty percent of total program overruns. On a ten-million-dollar initiative, that is two to three million dollars that never appears in a standard status report, because standard status reports measure the documented system and the leak is in the running one.
What It Costs When You Do Not Look
A regulated mid-market operation I worked with ran a dual-approval control on a sensitive process. Two sign-offs, every time, and the system of record showed that control at full compliance, month after month. The second approval had not been performed in nearly a year. One approver had left, their responsibilities had been absorbed informally, and the record kept showing green because the field was being completed, not because the review was being done. It surfaced in an external audit, which is the most expensive possible way to find a phantom control. A quarterly reconciliation would have caught it in an afternoon.
The Reconciliation Habit
You do not need a platform to inspect these four places. You need a habit. I call it reconciliation, and it fits in one afternoon a quarter. Put the documented system and the running system side by side and ask four questions, one per place. Who decides this now, and does the document agree? Which controls do we claim, and which do we perform? Where does the real workflow diverge from the drawn one? Which assumptions did we build on, and are they still true? One system. Four questions. One afternoon. Run on a cadence, not triggered by an incident.
This is the AGE Framework™, our Adaptive Governance Engine, doing its most basic and most valuable work. It gives you a repeatable way to read the running system against its design, so adaptation is something you govern on purpose rather than discover after it has cost you. That discipline matters most in a mid-market organization, where there is rarely a standing risk function to catch drift for you, so the limited governance attention you have needs to go where drift concentrates. Hope is not a cadence. A reconciliation you run is.
The Point
Drift is not everywhere at once. It lives in decision rights, controls, workflows, and assumptions, and it hides in all four behind a green dashboard. Knowing the four turns an overwhelming problem into an inspection you can schedule with the team you already have. The harder question is not where to look. It is who is supposed to be looking, and in most organizations the honest answer is no one. That is where this series goes next.
Build a view that inspects all four
The Executive Dashboard Template is designed to surface the running system, not only the plan, across decision rights, controls, workflows, and assumptions. Download it from the TransformXperience Insights hub and run your first reconciliation this quarter, one afternoon that tells you which of the four places has already drifted.
