Engineering Leadership
The Engineering Cost of Ignoring Governance
July 2026 · 4 min read
Across the pieces I have written on this site — about translating control language into requirements, about the gap between a documented control and an effective one, about what a hospital taught me on reliability — one idea keeps resurfacing in different clothing: a technical decision is also a security decision, and it is also a governance decision, whether or not anyone in the room names it that way. This article is the closest I can get to stating that thesis directly, rather than letting it stay implicit in whichever domain a given piece happens to be about.
Governance gets treated, understandably, as a constraint on engineering speed — something to negotiate down in a planning meeting, something to defer until “after we ship.” The uncomfortable finding, in every environment I have worked in, is that ignoring it rarely saves the time it appears to save. It moves the cost downstream, to a moment when it is more expensive to pay and harder to explain why it is owed.
The bill always arrives, just later and larger
Deferred governance shows up in a small number of recurring forms: a rushed retrofit performed under audit pressure, built by whoever is available rather than whoever understands the system best; a security incident that traces back to a decision nobody was accountable for making; a system so opaque that, when someone finally asks how it reached a given outcome, no one can answer with anything more convincing than a guess. None of these are unusual failures. They are the ordinary, predictable shape that deferred governance takes once enough time has passed for the original context to be forgotten.
Every technical decision already carries the other two
A schema decides who can query what later, which is an access decision whether or not anyone called it one at design time. A logging decision decides what can be reconstructed after an incident, which is a governance decision about what the organization will be able to prove. Skipping an approval step to hit a deadline is a governance decision made by default, by the person under the least pressure to think about it as one. As I discuss in 'From ISO 27002 Controls to Engineering Requirements', the translation between control language and engineering requirements works in both directions — which means an engineer who never reads a control document is still making the decisions those controls describe, just without the vocabulary to notice.
A passed audit is not proof the deferred decisions were good ones
The most dangerous version of deferred governance is the one that survives an audit anyway, because a point-in-time check samples a system on a good day and extrapolates that the sample represents the year. I go into this gap in more depth in 'Compliance Is Not the Same as Control Effectiveness', but the short version matters here too: a passed audit tells you a control worked when someone was looking, not that the underlying decision was sound the rest of the time nobody was.
Stakes make the pattern visible, but they do not create it
It took building software for hospitals, where I write about the lesson at length in 'What Hospital Information Systems Taught Me About Reliable Software', for this pattern to become impossible to ignore — a database inconsistency there is not an abstraction, and an access decision made carelessly has a person attached to it. But the pattern was never exclusive to healthcare; high stakes simply made a truth visible that holds everywhere else too, quietly, in systems where the consequences of ignoring it take longer to show up.
If there is one thesis this whole site keeps circling back to, it is this: engineering, security, and governance were never three separate disciplines that happen to interact occasionally. They are three names for the same set of decisions, viewed from different distances. A team that treats governance as something to negotiate away is not saving engineering time — it is spending that time later, at a worse rate, on a version of the same decision it never got to make deliberately the first time.