Loading...
Loading...
L
Path-dependent accumulation of oversight structures that rarely contract, creating vertical expansion in review and sign-off requirements. New layers are added after each crisis or failure, but old layers are almost never removed.
After a data breach, a company adds a new security review committee on top of the existing IT governance board, compliance team, and risk committee. Each layer persists independently—governance only grows.
GCC Section 5.2