Steady State Is an Illusion: The Bridge Is the Unit of Analysis
The strategy canon assumes survival
If practicing the disciplines that carry an organization safely across its transitions is its foundational responsibility, one would expect the dominant frameworks to address them centrally. In practice they do not. The strategic canon, the frameworks most organizations use to think about competition and positioning, treats risk peripherally. Porter's five forces, Blue Ocean Strategy, Jobs to be Done, and the Three Horizons model each ask a version of the same question: given a market, what positions are available, and how should the firm choose among them to achieve defensible returns.
These frameworks are useful, and they are also silent on the question that dominates most organizations' daily existence: which risks must we mitigate, on what timeframe, with what discipline, to be around long enough for any of these strategic choices to matter. The five forces model assumes the firm continues to exist. Blue Ocean assumes the firm can execute a category redefinition. Three Horizons assumes the operational durability to sustain work across several time horizons at once. Each assumption is a precondition, not a given, and the frameworks treat the preconditions as outside their scope.
In an earlier environment that scope boundary was defensible. Organizations that had reached the point of engaging with strategic frameworks had usually already demonstrated enough durability that existential risk was not the daily concern. Strategy was a conversation for survivors. Today far more organizations work on strategic questions without having established that durability, and the frameworks they inherit offer no guidance on the disciplines they would need to achieve it. The problem is not that the strategic canon is wrong. It is that its silences have become expensive.
The risk canon assumes steady state
On the other side of the landscape sits a well-developed body of risk frameworks. ISO 31000 codifies a process standard for risk management. COSO's Enterprise Risk Management framework provides a control-and-audit architecture aimed primarily at public-company boards. The NIST Risk Management Framework, and its more recent AI-specific variant, gives federal agencies and their contractors a structured process for risk identification, assessment, and mitigation. Basel and its supervisory descendants set the banking sector's expectations. Each is valuable within its scope.
Each is also, in a specific way, insufficient for the question this series addresses. ISO 31000 describes how to run a process but is silent on which risks deserve priority in which organizational states. COSO ERM excels at documenting and assuring that controls exist and is less helpful for identifying which disciplines must be built in the first place. NIST's frameworks are process-oriented and sector-specific. Basel is banking. More consequentially, none of them centers the question that now dominates: when competitive timeframes have compressed, which risks must an organization mitigate during a transition, and what are the invariant disciplines by which those mitigations happen. The risk canon tends to treat the organization in a steady state, with established categories, controls, and an audit cadence.
The gap is the transition itself
Between the strategy canon, which addresses positioning but not survival, and the risk canon, which addresses risk but not transitions, sits a gap. The gap is occupied by the question most organizations actually face: we are on some bridge, from an entry-state risk posture to a target-state risk posture, and we need to cross it without catastrophic risk materializing along the way. Which disciplines must we practice to make the crossing safe?
This is the unit of analysis RPBF takes as foundational. Organizations are always on some bridge. Steady state is an illusion. A company that has operated the same way for five years is still on a bridge, the bridge from the risk posture that made sense when its market was stable to the posture that will make sense when its market shifts, which it always eventually does. The organizations that survive are the ones that recognize the bridge they are on, name the risks that dominate at the entry and target states, and practice the disciplines that make the transit possible. The absence of an explicit framework has not meant the question went unanswered. It has meant the question was answered implicitly, locally, inconsistently, and at widely varying quality. RPBF codifies the model experienced practitioners carry tacitly so that it can be taught, applied, and iterated.
What RPBF adds
RPBF does not replace the strategy canon or the risk canon. Both remain valuable for the questions they were designed to answer. What RPBF adds is a framework whose unit of analysis is the organizational transition, whose organizing principle is the disciplined traversal of risk, and whose invariant content is the set of bridge disciplines that carry an organization across its transitions safely. Its contribution can be stated as four claims.
First, every organization is always on some bridge, and the bridge itself, not the entry state and not the target state, is the right unit of analysis for risk work. Second, across bridges of radically different surface content, a common set of disciplines recurs as the practices that make traversal safe. Third, the quality of those disciplines, practiced over time, is the single strongest predictor of an organization's sustained velocity, and therefore of its long-term enterprise value in a world where classical moats decay rapidly. Fourth, because the disciplines are practiced rather than possessed, they cannot be copied, purchased as artifacts, or outsourced. They must be built and sustained inside the organization, though they can be accelerated by productized capability and advisory assistance.
The three-column model
RPBF is, at its simplest, a three-column model. The left column names the risks an organization is currently prioritizing well, the operating constraints that have shaped its decisions, structure, and culture. The right column names the risks that will dominate after the transition, the risks inherent in the target state that the organization is currently under-investing in. The middle column names the bridge disciplines, the practiced capabilities that must be built during the transition to make the crossing possible.
Entry-State Risk Priorities: Risks the organization already prioritizes well, often optimizing against them successfully. They are not wrong; they are what the organization has been competent at managing. Examples: capital burn, speed to product-market fit, and team velocity for a startup.
Bridge Disciplines: The invariant set of practiced disciplines required during any consequential transition: viability and scalability planning; generic design and technical-debt management; auditability and observability; security and separation-of-duty automation; governance by construction.
Target-State Risk Priorities: Risks that will dominate in the target state and that the organization is currently under-investing in. Examples: operational resiliency, governance, and compliance for a maturing startup; model risk, agent governance, and data lineage for any organization adopting AI.
Begin with competence, not deficiency. The framework does not open by cataloging what the organization does badly. It begins by acknowledging that the organization has been competently optimizing against a specific set of risks, and that its current decisions are legible expressions of that optimization. This matters because organizations attempting a transition often fail not because their entry-state priorities were wrong but because they abandon those priorities in favor of target-state priorities before the bridge disciplines are built. A founder-led startup that abandons founder-led sales before the repeatable sales process exists will collapse its revenue. An enterprise that abandons its cannibalization discipline before it has a new-market playbook will watch its core erode while the new market fails to emerge.
Target-state priorities do not replace entry-state priorities. They are added to them. A mature technology company still cares about capital efficiency and velocity, and it now also cares about resiliency, governance, and compliance. The bridge discipline work is what allows the organization to hold both classes of risk at once without dropping either.
Identifying entry-state priorities is empirical work, not an aspirational statement. The useful questions are concrete: what does the organization actually monitor daily, which decisions does leadership reliably escalate, and what behavior does the culture reward? The answers name the risks that are in fact being prioritized, which are not always the risks leadership believes are being prioritized. The same empiricism applies to the target state, whose dominant risks are often visible to outside observers before they are felt inside the organization. Naming them early, while investment in the corresponding disciplines is still optional rather than forced, is one of the most valuable contributions a framework or an advisor can make, because optional investment compounds while forced investment arrives as crisis expense.
Questions for your leadership team
Which bridge are we actually on, as opposed to the one we say we are on?
Look at where attention and escalation have gone over the last six months. The empirical pattern of risk attention usually reveals the transition the organization is confronting, which is not always the transition leadership believes it is confronting.
Are we abandoning an entry-state strength before the replacement discipline exists?
Most failed transitions are not failures of aspiration. They are the result of dropping a competence that still matters before the bridge discipline that would carry the organization across has been built.