The document had seven approvals on it by the time it failed. Legal, finance, the risk committee, two vice presidents, a director, and the divisional head. Every box green. Every signature real. And when the thing went wrong in a way a careful reader would have caught on page three, the review found something more unsettling than negligence. Nobody had been negligent. Everybody had done their job. Their job simply was not reading page three.
Walk the chain backwards and the failure is almost elegant. Legal assumed finance had pressure-tested the numbers. Finance assumed the risk committee owned the downside. The risk committee saw two VP signatures already sitting on the page and reasoned, not unreasonably, that two VPs do not sign things nobody has checked. The director saw the risk committee's stamp and relaxed. The divisional head saw everyone. At no point did a single person hold the whole decision in their head and decide it was sound. Each of them approved the approvals of the others.
A signature is supposed to mean I checked this. In a long enough chain it means I saw that someone else did.
This is the part that governance decks never model. When you add an approver to a decision, you believe you are adding a set of eyes. You are also adding a reason for every other set of eyes to look less hard. Each signature already on the page is social proof, and social proof is sedative. The seventh signer scrutinizes least, because six people apparently already agreed, and the human brain treats six agreements as a fact rather than as six people each waiting for someone else to object.
So the rigor does not accumulate. It dilutes. A decision routed through one accountable reviewer gets one genuine act of scrutiny. The same decision routed through seven gets, on a good day, a fraction of one, spread so thin across the chain that no individual slice is heavy enough to make anyone stop and actually think. You did not multiply the checking by seven. You divided it.
The organization tells itself the opposite story, and tells it proudly. Seven sets of eyes. Robust controls. A multi-stakeholder sign-off process. What it has actually built is seven people each watching the other six, a room full of sentries all facing inward, every one of them reassured by the presence of the others and none of them looking at the thing they were assembled to guard.
There is a tell, and once you see it you cannot unsee it. The length of an approval chain is very often inversely proportional to how much anyone wants to own the decision at the end of it. Chains do not grow around the choices people are confident about. They grow around the ones that frighten them, because a long chain is the most respectable method ever invented for being able to say, afterwards, that we all agreed. Every added name is not another check. It is another person to stand beside when the question finally arrives. Governance by human shield.
And here is the quiet cost, the one that never makes the post-mortem. The chain is not just failing to catch errors. It is manufacturing confidence while it does so. The more approvals a decision carries, the more bulletproof it feels to everyone downstream of it, and the less anyone upstream actually interrogated it. Confidence and scrutiny, in a serial approval chain, move in opposite directions. By the time a proposal has collected seven signatures, it radiates a certainty that no one in the chain ever earned, and the organization acts on that certainty as if it were verification.
Notice, too, what the chain does to the one thing it was built to produce: a record. When the failure is finally examined, the sign-off log reads like diligence itself. Seven names, seven dates, seven approvals in clean sequence. It is the most exculpatory document in the building. Nobody can be singled out, because the paperwork proves the process was followed to the letter. The trail that was supposed to establish accountability turns out to be the instrument that quietly dissolves it. The audit comes back clean. That is the finding, not the reassurance.
The same architecture that fails to stop bad decisions is also extraordinarily good at stopping good ones. Because every signer can delay without ever having to decide, caution compounds down the line while judgment never appears. The reversible, obviously sensible call waits eleven weeks for a chain that will not read it. The catastrophic one sails through because it happened to arrive on a page that already looked busy with approvals. Slowness and recklessness are not opposites here. They are the same defect wearing two coats.
None of this requires anyone in the chain to be careless, which is precisely why it survives every reform aimed at carelessness. You can staff the chain with your most conscientious people and produce the same outcome, because the defect does not live in the signers. It lives in the shape. Seriality plus shared credit generates diffusion the way a slope plus water generates a river. Swap all seven names for seven sharper ones and the eighth decision fails the same way, on the same page three, for the same structural reason nobody will say aloud, because saying it aloud implicates the org chart rather than a person.
You did not build a control. You built a machine for turning unexamined decisions into examined-looking ones.
That is the reframe worth sitting with. The approval chain is not the place where judgment happens. It is the place where accountability goes to be subdivided until no single piece of it is heavy enough to make anyone read page three. Ownership was never missing. It was distributed, deliberately, into portions too small to feel. Ask any one of the seven whether they approved the decision and each will say yes. Ask who was responsible for it being right and you will watch the same yes dissolve, because responsibility that everyone holds is responsibility that no one carries.
Rebuilding this does not mean fewer approvals, though it often does. It means separating two things the signature line quietly merges: I have verified this claim is true, and I am aware this document exists. Most sign-off chains collect the second and record it as the first. A serious process names, for every approver, the one thing they are actually accountable for having examined, and it puts a single human at the top who owns the substance of the decision rather than the sequence of the routing. Not the person who signs last. The person who would read page three even if the six signatures above theirs were already green, because they know the six signatures are not evidence. They are the risk.
This reflex is visible long before it reaches a document. Put leaders inside a cascading crisis with a clock running and watch what they reach for first. A striking number do not check the situation. They check whether someone else has already checked it, scanning for the reassurance of a prior decision to defer to. It is the sign-off chain rehearsed in miniature, under pressure, with the routing slip stripped away. SSUNDAR's Organizational Crisis Simulation surfaces exactly that moment, the instant a leader substitutes the comfort of a chain for the discomfort of a call, because that instant is where most institutional failures are quietly authored, one deferral at a time.
The most dangerous document in your organization is not the one nobody approved. It is the one everybody did.