IT teams talk a lot about Technical Debt, but it is a really powerful lens for risk teams to use when thinking more broadly about their organisation.

Risk event processes can incentivise organisations to add low‑value controls that protect individuals from blame but gradually erode judgement, empowerment, and adaptability. Over time, this control‑heavy response to failures makes organisations more brittle; better at managing yesterday’s risks, but less able to respond intelligently to future shocks.