The tension it resolves
Organizations tend to displace risk downstream into compliance and audit reviews, which arrive too late to shape the original choice. By the time a risk becomes a formal control issue, exposure may already be built into the strategy or incentive system itself.