When Governance Meets Its Match: The Vertical vs. Horizontal Risk Tension

The way we govern and oversee organizations is undergoing a seismic shift driven by the changing nature of risk in the modern business world. For decades, corporate governance has been built around a hierarchical model, with information flowing up through management and oversight coming down from the board. This structure was designed for an industrial-era world where risks were more contained and change moved more slowly.

Today’s landscape is vastly different. Risks are no longer neatly contained within organizational boundaries but instead spread horizontally across functions, geographies, and systems. Cyber incidents can have far-reaching consequences that go beyond technical issues to affect the law, operations, and reputation. AI deployment brings together multiple risks simultaneously, from product liability to compliance and brand risk.

The existing governance model is struggling to keep pace with this new reality. We’re seeing more meetings, longer agendas, and broader expertise being added to boards, but these are merely Band-Aid solutions that reinforce the existing scaffolding without fundamentally changing its structure. The nature of risk is evolving in a different direction – becoming more interconnected, external, and fast-moving – and our governance architecture is not designed to absorb this complexity.

A key mismatch lies between the company as the unit of analysis and the reality that most consequential risks sit outside the firm in systems upon which it depends. Boards are no longer just overseeing what the company does but also what it relies on – cloud infrastructure, AI ecosystems, global supply chains, and digital platforms. This is not unique to tech companies; manufacturers, retailers, healthcare providers, and financial institutions all rely on interconnected systems that expose them to risks they don’t control.

Another issue arises from the cadence of governance versus the cadence of change. Boards operate on cycles – quarterly meetings, scheduled strategy reviews, formal reporting – but many risks evolve continuously, sometimes overnight. This creates a mismatch between oversight, which remains periodic, and risk, which has become continuous.

Directors are expected to understand multiple areas simultaneously, from technology and AI to cyber risk and geopolitics. Experience still matters, but its half-life is shrinking, and cognitive bandwidth may be becoming the real limiting factor in governance. Some of the friction between boards and management may reflect this deeper mismatch.

The current structure is straining against its own design, and a deeper shift is needed towards forms of governance that are less dependent on periodic escalation and more oriented toward continuous visibility; less bounded by the firm and more connected to the systems around it. This may not mean replacing the board entirely but rather recognizing that effective governance can no longer reside solely within it. The challenge ahead will require a fundamental rethinking of our governance architecture, one that’s better equipped to handle the complexities of the modern business world.