The question on the table was a business question. A new way to package the product, a partnership that would move real revenue, a bet with genuine upside on one side and real exposure on the other. It had a clear owner, a leader senior enough and close enough to the market to weigh it. And in the meeting where that leader was meant to weigh it, they said the five most relieving words in corporate life: let us run it by legal. The room exhaled. A hard call had just been quietly converted into a process step.
Three weeks later it came back wearing a careful memo and a recommendation that amounted to no, or to a version so hedged it would never move the revenue it was built to move. Nobody in the business had decided against it. Legal had not decided either, not in the way the business meant deciding. A function whose entire job is to minimize one variable had been handed a question with six of them, and had answered the only one it was equipped to see. The decision was made. It was simply made by the people with the least context and the strongest reason to say no.
Asking whether it is allowed is not the same as asking whether it is right.
Every consequential business decision contains at least two questions that look alike and are not. Is this the right thing to do, and are we allowed to do it. The first is a judgment call that belongs to someone who can see the whole board: the upside, the timing, the competitive cost of hesitating, the strategic shape of the bet. The second is a narrower, specialist question about exposure. When a leader routes the whole decision to legal, or to risk, or to compliance, or to information security, they quietly swap the first question for the second. The conversation stops being should we and becomes can we, and the person who now answers can we has no mandate, no incentive, and often no information to weigh should we at all.
This is not a failure of legal. It is legal doing its job correctly. A control function is measured on the downside it prevents, never on the upside it forgoes. No general counsel was ever promoted for the deal they waved through that worked, and plenty have been burned for the one they blessed that blew up. So the function optimizes, rationally and predictably, for the most conservative reading available. Hand it a yes or no and it leans toward no. Hand it an open question and it narrows the scope until the risk is small and the opportunity is smaller. The organization then treats this output as neutral counsel, when it is in fact a single, systematically biased input being asked to carry a judgment it was never designed to make.
Watch what the routing actually does for the person who starts it and the mechanism gives itself away. If legal says no, the leader is off the hook for a call they did not want to own, and the bet dies with an unimpeachable author and no fingerprints on the one who feared it. If legal says yes, the leader has cover for a decision they can now make without exposure, because someone else signed the permission slip. Either outcome relieves the one person whose judgment the organization was actually paying for. Run it by legal is only sometimes about the law. Often it is about finding somewhere to put a decision that nobody in the room wanted to hold.
A control function exists to tell you the cost of a risk. It was never meant to tell you whether the risk is worth taking. The moment those two jobs collapse into one, your boldest decisions are being made by the part of the organization with the strongest reason to avoid them.
The cost compounds in a direction nobody tracks. An organization that reflexively exports its hard calls to its control functions slowly takes on the shape of those functions. It stops making bets and starts clearing them. The question that governs its behavior shifts from what is the right thing to do to what can we defend if this is questioned later, and those two questions pull in opposite directions more often than anyone admits. Over enough cycles the business loses the muscle to hold a genuine should we in tension and resolve it on the merits, because every time that muscle was needed, the decision had already been handed to the one group guaranteed to answer a different question. The company is not more careful. It is more timid, and it has mistaken the two.
The function you route to is not the problem. The one you do not have is.
Here is the part that should land. The problem is not that legal is too cautious or that risk says no too often. The problem is that the organization has no place where business judgment and risk judgment are supposed to meet and be resolved by someone accountable for both. There is a function that owns the upside and a function that owns the downside, and between them sits a vacuum where the actual decision belongs. So the decision falls, by gravity, into whichever function will catch it, and the function that catches it is almost always the one holding the veto. A leader who cannot integrate is this right and are we allowed into a single owned judgment has not delegated the decision. They have abdicated it to the org chart.
Rebuilding this does not mean overruling legal or sidelining risk, which is how organizations overcorrect and then get hurt in the other direction. It means putting back the thing that went missing: a leader, or a decision forum, explicitly accountable for integrating the specialist input with everything the specialist cannot see, and for owning the call either way. Legal tells you the exposure. Someone still has to decide whether the exposure is worth the prize, and that someone has to be unable to hide behind the memo. The control function becomes an input to a judgment instead of a substitute for one. It is a small change on the org chart and an enormous change in who is allowed to feel relieved when the meeting ends.
It is a hard pattern to catch in a calm room, because the routing looks like diligence and the memo looks like rigor. It is not hard to catch under pressure. When we run leaders through cascading crisis simulations, the reflex surfaces in the first few decisions: some hold the ambiguous call and resolve it on the merits, and some, the moment a control question appears, hand the whole thing to whoever can take it off their desk. The simulation does not grade the choice. It just shows, cleanly and early, who owns a decision and who is looking for somewhere to put one. You can watch your own leaders do it at ssundar.com/simulate, before a real decision does the showing for you.
Every organization has a function that can tell it no. The ones that still make decisions have kept someone whose job is to say it is worth it anyway.