Session Description

Your control framework is mapped, audited, and certified. Your evidence is filed. Your reports come back clean. And still — the outcomes the framework was supposed to secure aren't showing up. Incidents occur in domains your controls said were covered. Programs pass audit and fail in practice. The gap shows up in safety, security, quality, privacy, AI governance, sustainability — wherever a control framework stands between an organization and the outcomes it's accountable for.

The standard explanations point at threat sophistication, program maturity, or resourcing. None of these reach the actual cause. The actual cause is structural — and without a concept of regulation, the function of controls doesn't make sense.

Regulation in the cybernetic sense is a regulator connected to a system under regulation, holding the system within bounds so it delivers the intended outcome. Without the regulator, the system is uncontrolled. An organization is itself a…