The Governance Vacuum: Who Owns Present-State Proof?

Modern governance systems are built upon the principle of accountability. Responsibilities are assigned, duties are defined, authorities are delegated, and obligations are documented. Across safety, cybersecurity, infrastructure, finance, healthcare, and critical national systems, substantial effort is invested in ensuring that ownership is clear and that accountability can be traced.

Duty-holders are responsible for maintaining safe systems. Auditors are responsible for conducting assessments. Certification bodies are responsible for determining conformity. Regulators are responsible for establishing and enforcing requirements. Insurers are responsible for evaluating and pricing risk. Each participant occupies a defined position within a wider assurance framework intended to support confidence, trust, and responsible decision-making.

Viewed from a governance perspective, the structure appears comprehensive.

Yet serious incidents reveal a recurring and often overlooked question.

What was the condition of the system at the exact moment it was relied upon?

This question frequently emerges during investigations, litigation, insurance disputes, regulatory reviews, and post-incident analysis. It arises because accountability rarely turns upon whether a process existed. Instead, accountability often turns upon whether reliance on a system was justified at a specific point in time.

The distinction is significant.

A system may have been certified. It may have been inspected. It may have passed an audit. Maintenance may have been completed. Procedures may have been followed precisely as required. Documentation may demonstrate that every prescribed governance activity occurred.

Yet these records do not necessarily establish the operational condition of the system when a critical decision was made or when reliance became necessary.

The challenge is not the absence of governance.

The challenge is the absence of ownership over present-state proof.

Most assurance frameworks are designed to demonstrate compliance with requirements at defined points in time. They establish whether a system met a specified condition when it was assessed. They create records of conformity, maintenance, inspection, testing, or review. They provide evidence that governance activities occurred.

What they do not necessarily provide is evidence that the condition observed during verification continued to exist until the moment of reliance.

This distinction creates a subtle but important governance gap.

Responsibility for conducting inspections is assigned.

Responsibility for issuing certificates is assigned.

Responsibility for maintaining records is assigned.

Responsibility for compliance is assigned.

Responsibility for proving present-state condition is often not.

The consequence is that many governance systems operate on an implicit assumption that verified conditions continue to exist until proven otherwise. The interval between verification and reliance is frequently treated as administratively acceptable provided that no formal trigger requires reassessment.

For many years this approach was considered reasonable. Physical systems changed relatively slowly. Operational environments were comparatively stable. Verification intervals were regarded as practical and proportionate methods of managing risk.

Modern systems increasingly challenge those assumptions.

Software can alter functionality without visible physical change. Remote configuration can modify behaviour instantly. Dependencies can emerge across interconnected systems. Environmental conditions can shift rapidly. Operational states can change continuously while documentation remains entirely valid.

As systems become more dynamic, the period between verification and reliance becomes more significant than the verification event itself.

This raises a question that governance frameworks have not traditionally been required to answer.

Who owns proving that a verified condition remained true?

The answer is often unclear.

Certification bodies typically verify conformity at the point of assessment. They do not continuously govern operational reality. Auditors evaluate evidence available during the audit period. They do not continuously observe the system after completion of their work. Regulators establish requirements and oversee compliance. They do not generally maintain continuous operational visibility. Insurers assess risk based upon available information but do not continuously verify the state of insured systems.

Each participant performs a legitimate and necessary function.

Yet none may be responsible for evidencing the condition of the system at the exact moment reliance occurs.

This becomes particularly important when incidents lead to questions of liability, foreseeability, reasonable reliance, and duty of care.

Investigations routinely examine what was known, what could have been known, and what evidence existed when decisions were made. Courts frequently distinguish between the existence of documentation and the existence of operational reality. Regulators seek to understand not merely whether governance processes existed but whether those processes provided a sufficient basis for reliance.

In these circumstances, the absence of present-state proof becomes increasingly visible.

The governance framework may remain intact.

The documentation may remain complete.

The certification may remain valid.

The ownership of present-state evidence may remain undefined.

This is not necessarily a failure of any individual participant. Rather, it reflects the historical design of assurance systems that evolved to verify compliance rather than continuously evidence condition.

As a result, many organisations find themselves in a position where responsibility is clearly allocated while proof of operational reality remains uncertain.

This distinction matters because governance ultimately exists to support decision-making. Decisions are not made in the past. They are made in the present. Reliance occurs in the present. Accountability is ultimately assessed in relation to the present.

A governance framework that can demonstrate historical compliance but cannot establish present-state condition may therefore encounter increasing difficulty as systems become more complex, interconnected, and dynamic.

The issue is not whether inspections, audits, certifications, or regulatory oversight remain important. They remain essential components of governance. The issue is whether those mechanisms alone can answer the question increasingly asked after serious incidents.

What was true at the moment the system was relied upon?

The answer cannot be inferred simply from the existence of documentation. Nor can it be assumed solely because a verification event occurred within an acceptable timeframe.

Present-state condition and historical verification are related concepts, but they are not identical.

One establishes what was known.

The other seeks to establish what remained true.

As assurance frameworks continue to evolve, the distinction between those two concepts may become increasingly important. Accountability has owners. Compliance has owners. Certification has owners. Regulation has owners.

The question that remains unresolved is whether present-state proof has an owner at all.

If accountability ultimately depends upon what was known at the moment of reliance, who owns the obligation to prove what was true at that moment?

About the Author

Paul Mincher is the Founder and CEO of SAFE-Matter Ltd and the originator of the “Unknown Present” concept in safety governance. His work examines the evidentiary gap between regulatory compliance and demonstrable safety in cyber-physical systems.

A survivor of a childhood house fire, he has spent the past decade studying how organisations establish trust in life-critical protections and why serious incidents continue to occur despite formal certification, inspection, and oversight.

His research focuses on how organisations might evidence the operational condition of safety protections at the moment they are relied upon. This work sits at the intersection of safety engineering, accountability, and risk assurance, addressing how regulators, insurers, and duty-holders determine whether protection was actually present when it mattered.

Paul can be reached at https://www.linkedin.com/in/paul-mincher-4abb44310 and [email protected]