Risk & Rebels

The Monthly Letter

Issue No. 2 | August 2026

This summer's hard lesson: It's much easier to identify key-person risk when the key person isn't you.

I've spent a lot of August thinking about RayCor as a true business, not just the work that happens inside it. That has forced me to look at some things I'd immediately flag if I were advising somebody else: revenue concentration, relationships that run primarily through the founder, knowledge that hasn't been transferred, and decisions that still require me because I'm the person who remembers the history.

There's a strange tension in building a professional services firm. You spend years becoming the person people trust to solve difficult problems. Clients call because they want your judgment, and referrals happen because someone knows what you can do. Being indispensable is rewarded. Then one day you realize you've built a company that needs you to be indispensable.

I've started noticing versions of this everywhere lately, well beyond RayCor. The employee everyone calls because she knows how something actually works, the executive who has quietly become the routing mechanism for decisions nobody else owns, and the ten-year veteran who can spot something nobody thought to put in the procedure (or twenty-six-year veteran, in my husband's case.)

We usually recognize these people as tremendous assets, as well we should, but I think we should also be asking a different, and slightly uncomfortable, question: If your most indispensable person disappeared for 30 days tomorrow, what would break?

FEATURE

What Happens When the Person Who Built It Isn't There?

Every organization has knowledge that doesn't appear in any policy, procedure or shared drive. There are always at least a few people with institutional knowledge: someone remembers why the company stopped doing something a certain way, or knows that a seemingly routine exception caused a problem three years ago. There's always a person who knows which control matters more than it looks like it does on paper, or which client situation warrants a phone call before anybody follows the standard process.

The longer people work somewhere, the more of this knowledge they accumulate. Eventually, some of them become extraordinarily good at filling the gaps between how an organization is supposed to work and how it actually works. That's incredibly valuable, but it's also easy to mistake for organizational maturity. If you give a mediocre process to an experienced operator, she can probably make it work and fill in some gaps. If you put unclear ownership in front of an executive who always steps up, he'll make the decision - but is it the right one? The work gets done, so the underlying weakness stays hidden.

I've seen this happen with Chief Compliance Officers for years. In fact, I wrote about it in last month's newsletter. A question has no obvious owner, so Compliance figures it out. Product and Operations disagree, so Compliance mediates, or translates, or gets yelled at. Eventually one very capable person becomes part executive, part institutional memory and part air traffic controller.

Founders aren't particularly different.

RayCor was built around my expertise and relationships. In the beginning, that was exactly how it needed to work. Nobody starts a consulting firm on Monday and wakes up Tuesday with institutional infrastructure and a management layer. But businesses change, and the risks change with them. I've spent a good portion of this year trying to think seriously about what it would take to build RayCor into a company that is bigger and more durable than my individual capacity. That means asking questions I don't particularly enjoy asking:

How much knowledge still lives in my head?

Which client relationships could function without me at the center of every conversation?

Which things am I still doing because I'm uniquely good at them, and which am I doing because I've simply never stopped?

Where have I built a repeatable methodology, and where am I still recreating the answer from experience every time?

And, maybe most importantly, if I couldn't work for a month, what would happen?

That last question will sober up a founder pretty quickly!

The answer, though, can't be to document every thought an experienced person has ever had. I've seen the other extreme too: organizations trying to solve complexity with more procedures, more approvals, more templates and increasingly elaborate documentation. You can create plenty of bureaucracy that way without capturing much judgment.

I recently recorded one of my absolute favorite Risk & Rebels conversations (link below!) with Ricky Rambharat, a statistician and former OCC quantitative regulator. Ricky talked about watching experienced bank examiners walk into an institution and notice things he couldn't necessarily see by looking at a model. Years of examining different institutions had taught them what to look for, where to probe and when something deserved another question. He described that experience as priceless.

I loved that observation because anyone who has worked around experienced regulators, operators, lawyers, risk professionals or founders knows exactly what he means. There are things people learn through pattern recognition that are difficult to reduce to a checklist. Sometimes they can't even immediately explain what caught their attention, but they know enough to keep pulling the thread.

We're now running headfirst into this problem with AI. We want technology to make decisions faster, find patterns humans miss, synthesize enormous amounts of information and automate work that used to require people. Much of that will happen, and some of it already has. At the same time, we're discovering how much human judgment was hiding inside processes we assumed were straightforward. Take the phrase "human in the loop." It sounds reassuring. We all hear it constantly in AI governance conversations.

But what is the human actually doing?

What information can they see? How much time do they have? Do they understand how the system reached the recommendation? Can they disagree with it? Do they have the authority to stop the process if something looks wrong? Putting a person somewhere in a workflow doesn't automatically preserve human judgment any more than writing a procedure automatically captures institutional knowledge. The harder work is figuring out which parts of good judgment can actually be transferred.

Sometimes the answer is documentation; sometimes it's better evidence about why decisions were made; and sometimes it's training, cross-functional ownership or forcing somebody other than the usual expert to run the process. Or sometimes it's simply making the experienced person explain the question they're asking before they give everyone the answer.

I'm doing versions of this inside RayCor now. Some of my work over the past year has involved taking things I've historically done through experience and turning them into methodologies other people can understand, challenge and eventually use. I've also had to become more deliberate about where I actually need to be involved and where my involvement is just habit. I don't think my objective is to build a company where someone doesn't matter very much; I'd much rather build one full of people who matter enormously. But their expertise should accumulate somewhere besides their own heads. The organization should get smarter because they were there.

So here's the question I've started asking myself, and I think it's worth asking inside any growing company:

If your most indispensable person disappeared for 30 days tomorrow, what would break first?

Whatever answer comes to mind is probably telling you something.

🎙 RISK & REBELS

You Have to Be a Little Obsessed With Uncertainty

That's one of the first things Ricky Rambharat told me when we sat down for this week's Risk & Rebels.

Ricky is a statistician and former OCC quantitative regulator, so I expected us to talk about models, data and risk. We did do some of that, but what I didn't expect was how much of the conversation would end up being about uncertainty, disagreement and the limits of our own judgment.

At one point, I suggested that we build models, controls and frameworks partly because humans are uncomfortable with uncertainty and want to control it. Ricky disagreed with me (which is the best part of the podcast).

He doesn't think we control uncertainty. We can understand it better, gather evidence, make better inferences and prepare ourselves to change course when something unexpected happens. We also talked about experienced bank examiners seeing things models don't, why unexpected results can be more useful than the ones you predicted, what makes him skeptical about AI, and how he tests his own judgment.

One habit in particular stuck with me: when Ricky makes a judgment, he tries to convince himself that he could be wrong.

For someone whose career has revolved around evidence and inference, I found that wonderfully human.

The new episode of Risk & Rebels with Ricky Rambharat is out this week.

→ Risk & Rebels: Episode 001 (YouTube)

FIELD NOTES

Four Things I've Been Noticing Lately

1. Everyone hates checklists until they're selling one.

I've had a few conversations recently with people building AI and AI governance products who are skeptical of frameworks and checklists. The criticism is usually that governance can't be reduced to a series of boxes somebody checks, and I agree with that.

Software doesn't escape the problem. Someone still decided which questions the product asks, what gets flagged, what evidence matters and what happens next. Every tool has assumptions embedded in it, whether they're visible to the user or not.

So when somebody tells me their technology is better than a framework because frameworks encode somebody else's judgment, my next question is usually: Whose judgment did you encode? [Cue spicy conversations from here].

2. Your AI inherits your organizational mess.

I had lunch recently with a banking leader and we got onto the subject of Copilot. She raised a problem that should probably be getting more attention.

Think about what lives inside the average company's SharePoint environment after ten or twenty years: outdated policies, conflicting versions of documents, abandoned folders, permissions nobody remembers granting, files without clear owners and information that probably shouldn't be available as broadly as it is.

Now give AI access to it. The technology may be new but the information environment underneath it isn't.

I've been thinking about that conversation ever since because it changes the starting point for AI governance. Before asking what an AI system can do with your information, it might be worth asking what information you've given it to work with in the first place. Sometimes AI governance starts in SharePoint. Who would have thunk it, huh?

3. Who audits the AI that's auditing the AI?

We're starting to see increasingly sophisticated products that promise to monitor AI systems, test controls, generate evidence and help companies demonstrate that their governance works. Good. There is plenty of governance work that technology can make faster and better.

But I've heard versions of another claim recently that make me pause: the idea that the technology can effectively provide its own assurance.

Maybe it can provide excellent evidence. Maybe it can continuously monitor things a human could never review at the same scale. Those are meaningful capabilities. But I still want to know who challenges the conclusion.

We've spent decades developing concepts like independent testing, validation and credible challenge for a reason. AI may change how we perform those functions. I'm not convinced it eliminates the reason they exist.

P.S. If these AI governance questions are showing up in your organization too: I recently launched the AIRE AI Governance Masterclass with Joseph Cuanan of ComplyGraph. We built it for compliance, risk and governance professionals who are increasingly being asked to govern AI in practice.

→ Learn more about the AIRE AI Governance Masterclass

4. Clients can come from anywhere.

I went to a StableCon event this month and ended up meeting someone I'd been prospecting. There was no brilliant funnel strategy; we just happened to be in the same place, talking about something we were both interested in.

It reminded me that some of the best business development I've done over the years hasn't felt like business development while I was doing it. Go places. Meet people. Ask good questions. Be genuinely interested in what other people are building. Increase your surface area for good things to happen.

You still need a pipeline and a strategy, but there's something to be said for creating enough surface area for luck to find you.

BEHIND THE SCENES

Apparently I Have a Podcast Now

For years, people told me I should start a podcast, and for years I found very good reasons not to. Then I finally started one, and now my calendar is full of recording sessions.

This month I've been talking with people from very different corners of risk, technology, compliance and entrepreneurship. I've also learned fairly quickly that recording a podcast and building a podcast are two different things.

I'm figuring out what makes a conversation worth listening to after the novelty of "two people talking into microphones" wears off. I've learned that I like disagreement much more than polished consensus. I've learned that the best question on my list is sometimes irrelevant five minutes into the conversation. And I've learned that I would much rather leave people wanting another ten minutes than ask them for an hour because that's what podcasts are apparently supposed to do.

So we're going to do some experimenting. My plan is to release a new Risk & Rebels conversation every other week while continuing to record interesting people whenever they're available. That gives us room to edit thoughtfully, build a pipeline of episodes and, hopefully, avoid turning the show into another piece of content that exists because the calendar says it's Tuesday.

The part I'm enjoying most is that I genuinely don't know where some of these conversations are going when I start them. That's exactly what I wanted. There are polished conversations everywhere else already, and I'm much more interested in what happens when somebody changes their mind, disagrees with the premise, admits they got something wrong or says the thing they probably wouldn't put on a conference slide.

We're still early; I'm sure I'll change plenty about the show as we learn. But for now, I'm having a lot of fun asking the questions.

ICYMI (IN CASE YOU MISSED IT)

🎙 Risk & Rebels: Ricky Rambharat

A statistician and former regulator walks into a podcast and tells the host she can't control uncertainty.

We went from there.

→ Risk & Rebels: Episode 001

📌 The Human API Problem

Somewhere along the way, a lot of Chief Compliance Officers became the human API connecting the rest of the organization.

Product has a question? Ask Compliance. Operations isn't sure who owns something? Ask Compliance. Nobody wants to make the decision? Compliance will figure it out.

I wrote about this recently and expected it to resonate with a few compliance people. Instead, it sparked one of the biggest conversations I've had this year. Apparently, there are a lot of Human APIs out there.

→ Read the post and conversation

💭 Delulu really might be the solulu.

In 2009, I moved to New York in the middle of a recession with no job and no interviews lined up. There were quite a few unglamorous years between that decision and building RayCor. This month, I paid off the last of my undergraduate and law-school debt.

That one felt good.

→ Read the post

ONE MORE THOUGHT

One of the strange things about becoming experienced at something is that people start paying you to know the answer. I've built a career around walking into complicated situations and helping people figure out what to do. Naturally, you get pretty comfortable having an opinion.

The older I get, though, the more interested I am in the moment when somebody realizes their first answer was wrong. Ricky said something during our conversation that I think I'll carry with me for a while: whenever he makes a judgment, he tries to convince himself that he could be wrong. There's confidence in that, oddly enough. You can have a strong point of view without becoming attached to being right. You can make a decision with the evidence you have and still leave enough room for new information to change it.

That's probably useful for regulators, founders, executives and statisticians, but it's also useful for the rest of us. So I'll leave you with a question this month:

If your most indispensable person disappeared for 30 days, what would break first?

Hit Reply and tell me. Seriously. I'm curious what people say, and I have a feeling the answers will be interesting.

Until next month…

If someone forwarded this newsletter to you and you enjoyed it, I'd love to have you join us. Every month I share one idea I can't stop thinking about, a few observations from the field, and conversations with people making difficult decisions when the answers aren't obvious.

Christina
Founder & CEO, RayCor Consulting