One List, Read Both Ways

The commitments missing from your kept list are where the exposure is

A company that has written down what it deliberately holds constant has done something useful and has done half of it. The other half is on the same page, in the space around the entries, and most teams never turn it over.

Nothing below is measured, and it comes from reading scaling companies closely. The exercise at the end takes about fifteen minutes and needs no information the company does not already have.

Two artefacts that turn out to be one

A kept list names the arrangements a company protects on purpose: this one stays, here is why, here is who gets asked. It is a short document and it is built forwards, from what the company values toward what it will defend.

A register of accumulated exposure runs the other way. It asks which arrangements the company now depends on and cannot account for, and it is usually built backwards, after something has gone wrong, from the failure toward the choice that produced it.

Set them side by side and the second is the complement of the first. Every arrangement a company relies on is either deliberately kept or quietly accruing, so a company holding one list is holding the frame of the other. The commitments absent from the kept list are not neutral. They are the exposure, and their absence is the only evidence anybody currently has of where it sits.

What that is called, and where the definition lives

CloudFruition holds a definition for the accruing half, and it is quoted here exactly as its source states it:

Decision Debt is the accumulated cost of technology decisions made without evidence. It compounds silently, and it is invisible until an event makes it visible.

The mechanism behind it, how the borrowing works and where the bill eventually arrives, is set out on the model's own page and is not repeated here. What this piece adds is narrower and more useful to anybody who has already done the kept-list exercise: you are closer to an exposure register than you think, and the gap is a reading rather than a project.

The objection is that you cannot inventory what has not surfaced

There is a serious position against this and it is held by people who have run real incident processes.

You can only manage what surfaces. An audit finding, an incident, a question in a diligence room: those are real events with real detail, and a register built from them is grounded in things that actually happened. An inventory assembled in advance from what somebody imagines might matter is speculation with a spreadsheet around it, and it competes for attention with work that is definitely needed.

That position is right about the quality of the evidence and wrong about the timing, and the interval is where the argument sits. The surfacing is when the cost gets priced, not when it was taken on. By the time an arrangement produces an audit finding it has usually been depended on for a year or more, and the company could have named it at any point in that year without waiting for the event.

So the real choice is between naming an arrangement while naming it is free, and naming it after somebody else has set the date.

Reading the list the other way

The practical move is small. Take the kept list and, for each entry, ask what the company relies on in the same area that is not on the list.

A company that keeps a human in credit approval relies on how the underlying scoring is built, who can change the thresholds, and what happens when the person is on leave. None of that is on the kept list, all of it is relied on, and it is exactly adjacent to something the company already cared enough to write down.

That adjacency is the trick. It replaces the impossible question, what have we forgotten, with a bounded one that has a finite answer per entry. Three kept commitments produce perhaps nine or twelve neighbours, and neighbours are where a company that already thought carefully about one thing failed to think about the thing beside it.

What to do in fifteen minutes

Write your kept list, or take the one you have. Beside each entry, write two arrangements the company depends on in the same area that nobody has ever decided about.

Then sort those neighbours by one question: if this turned out to be wrong, when would we find out? The ones where the honest answer is at the next audit, or at the next diligence conversation, or when a customer tells us, are the ones to look at first. They are not the largest. They are the ones where the interval between being wrong and knowing is longest, and interval is what turns a choice into a cost.

You do not need to fix any of them this week. Naming three is the whole exercise, and a named arrangement stops accruing quietly whatever else happens to it.

Of the things your company depends on, which one would only announce itself in a room where somebody else had set the agenda?