CASE TRANSIT MAP / PAPER 056

Handoffs, Escalations and the Geometry of Shared Work

Choose the smallest work geometry that preserves case state, specialised knowledge, independent challenge and timely authority.

CASE TRANSIT MAP / PAPER 056

Handoffs, Escalations and the Geometry of Shared Work

Choose the smallest work geometry that preserves case state, specialised knowledge, independent challenge and timely authority.

Rajesh Ranjan Mahapatra

A practical guide to choosing transfers, typed relays, parallel work, reciprocal workspaces and consequence-led escalation for shared human and agent work.

© 2026 Rajesh Ranjan Mahapatra. 20 min read

Handoffs, Escalations and the Geometry of Shared WorkAll Research Essays

TLDR

  1. Every handoff changes who can see, interpret, own and act on a case; faster transfer does not repair missing state or authority.
  2. Choose among end-to-end ownership, typed relay, parallel contribution, reciprocal workspace and escalation according to dependency and consequence.
  3. Every edge needs a packet carrying purpose, state, evidence, rejected work, uncertainty, authority, commitment, acceptance, service time and receipt.
  4. Escalation changes expertise, authority or resources after a declared trigger; low confidence alone should not flood scarce experts.
  5. Remove an edge only when its integration work disappears, while preserving specialised competence, segregation and credible independent challenge.

01 / Instant is not completeThe receiver inherits a case, not a summary

An agent closes its step in seconds and sends an elegant summary to an investigator. The summary names the apparent pattern and recommends escalation. It omits the source provenance, two rejected hypotheses, a disputed identity link and the fact that one transaction feed is stale. The investigator opens four systems, reconstructs the timeline and asks the operations team what the agent was allowed to conclude. The transfer was fast. The work did not move.

A handoff changes the role that can see, interpret and act on a commitment. It therefore changes more than location. Ownership may move, an intermediate artefact may be consumed, independent evidence may arrive, several roles may adjust shared state, or a different authority may enter because the current role cannot safely complete the case. Calling every interaction a message hides those distinctions. Calling every message a handoff hides whether responsibility moved at all.

This article uses shared-work geometry for the shape formed by roles, case state, commitments and authority. A sequence suits stable dependency. Parallel branches suit genuinely independent work whose outputs can be reconciled. A reciprocal workspace suits work that changes through continuous adjustment. Escalation is a bridge to changed authority, expertise or resource. End-to-end ownership is the zero-edge case when one accountable boundary can hold the required knowledge and authority without defeating independence.

Original synthesis: the five interaction forms, edge packet and Shared-Work Geometry Designer are this article's synthesis of interdependence, coordination, boundary work, transactive memory, resilience and AI governance evidence.
Five shared-work geometries on one case mapA transit-style map shows end-to-end ownership, a typed relay, parallel branches, reciprocal loops and an escalation bridge.END-TO-ENDTYPED RELAYPARALLELRECIPROCALESCALATIONone pod carries outcomeaccepted artefactindependent evidenceshared state + conflict rulechanged authority
Figure 1. Shared work has five distinct forms. The right map depends on coupling, knowledge, independence and authority, not a preference for more or fewer agents.

02 / The strong rivalKeep the case inside one pod when the whole commitment fits

The strongest rival is end-to-end ownership: a human-agent pod should retain the case, outcome and customer context instead of pushing work through specialist queues. This design removes waiting, repeated triage and reconstruction. It is preferable for a low-risk service request when one boundary can hold the necessary knowledge, tools and authority, and when no independent challenge or legal segregation is required. The pod may still use internal tools, but the customer commitment does not cross an organisational edge.

The rival reaches its limit when specialised competence cannot be maintained inside every pod, when a person must exercise a distinct statutory authority, when the same role cannot credibly propose and independently challenge, or when external accountability requires a separable record. Folding a financial-crime investigation, legal privilege decision or independent assurance test into a general service pod may reduce visible handoffs while dissolving the reason those edges existed.

The test is not whether an edge consumes time. Every edge does. The test is whether the integration cost can disappear without losing capability, independence or control. If a senior analyst quietly reconciles two outputs after a formal queue is removed, the edge has not gone. It has become invisible, unmeasured and dependent on personal effort. If a dashboard replaces a transfer but receivers still rebuild purpose from source systems, the interface has hidden the reconstruction tax rather than paid it.

Boundary rule: prefer end-to-end ownership where knowledge and authority can coexist safely. Preserve typed transfers, independent branches or escalation bridges where specialisation, segregation, credible challenge or changed authority creates a real boundary.

03 / Edge packetMove state, evidence and acceptance with the commitment

A useful edge is not “Agent A tells Person B”. It is a contract for what moves, what remains, how the receiver knows it is usable and what happens when it is not. The packet must be machine-readable enough for workflow and human-readable enough for accountable interpretation. It should not compress the case into a persuasive conclusion that makes verification harder.

Case identity and current state
The authoritative case key, version, lifecycle state, locks and pending actions.
Original purpose and affected outcome
Why the case exists, for whom, and which institutional commitment is being discharged.
Evidence and provenance
Sources, retrieval time, transformations, lineage, freshness and access limitations.
Completed and rejected work
What was done, which alternatives were tested, what failed and why it was rejected.
Uncertainty and unresolved conflict
Missing facts, contradictory evidence, disputed links and assumptions that remain open.
Authority held and required
What the sender could decide, what the receiver must decide and which authority is absent.
Next commitment and acceptance test
The precise output requested and the conditions under which the receiver accepts ownership or artefact quality.
Service time, exception and fallback
Response time, urgency basis, refusal route, safe holding state and continuity option.
Receipt
Sender, receiver, packet version, acceptance or rejection, state change and downstream result.
Write and conflict rules
Who may alter which fields, how versions merge, and who resolves incompatible claims.

Acceptance is an active control. A receiver can reject a packet that lacks provenance, exceeds its authority boundary or arrives in an invalid state. Silent queue placement is not acceptance. Nor should acceptance imply endorsement of the sender's conclusion. It confirms that the receiving role has enough state, evidence, time and authority to take the declared next commitment.

A packet should be proportionate without becoming vague. A routine relay may carry a compact structured record, while a contested or consequential case needs richer provenance and rejected alternatives. The minimum is determined by the receiver's commitment and the consequence of error, not by the sender's preference for brevity. Fields can point to authoritative evidence rather than duplicate sensitive material. What matters is that the receiver can locate, interpret and test the evidence without relying on private conversation or an agent's undocumented memory.

Packet repair also deserves a service rule. When the receiver rejects an edge, ownership of the unresolved commitment must be clear during repair. Otherwise both roles may assume the other is acting, or both may change state. The rejection receipt identifies the failed acceptance condition, safe holding state, repair owner and new response time. Repeated rejection of the same field is design evidence: change the source, schema, workflow or role boundary instead of training people to compensate indefinitely.

Anatomy of an edge packetA case packet moves along a transit line carrying ten fields for state, purpose, provenance, rejected work, uncertainty, authority, commitment, acceptance, fallback and receipt.EDGE PACKET · CASE 07F201 State + version02 Purpose + outcome03 Evidence + provenance04 Completed + rejected work05 Uncertainty + conflicts06 Authority held / required07 Next commitment08 Acceptance test09 Service, exception, fallback10 Receipt + write rulesRECEIVER TESTAccept · reject · request repair · escalateSENDERRECEIVER
Figure 2. The packet carries the conditions for acceptance and refusal, not only a conclusion. Rejected work and uncertainty travel with positive evidence.

04 / Five formsMatch the edge to the dependency

FORM 01TransferOwnership of a bounded commitment moves to a new role. Use it when one role finishes its responsibility and another truly owns the next case state. The receiver explicitly accepts; the sender retains a receipt, not shadow ownership.
FORM 02RelayOne role produces a typed intermediate artefact that another consumes. Use it for stable sequential dependence such as an evidence bundle feeding an authorised judgement. Define schema, provenance, quality and rejection conditions.
FORM 03Parallel contributionIndependent work proceeds concurrently and is reconciled later. Use it when different sources, methods or challenge roles should not anchor one another. Preserve independence until a named reconciliation point.
FORM 04Reciprocal workspaceRoles adjust continuously around shared case state. Use it when outputs change one another repeatedly. Declare field ownership, versions, write conflicts, locks, merge rules and the role that resolves incompatible claims.
FORM 05EscalationAuthority, expertise or resource changes because a declared trigger is met. The current role does not merely ask for help; it passes a bounded unresolved commitment to a role equipped to decide or intervene.
ZERO EDGEEnd-to-end ownershipOne accountable pod retains outcome, state and authority. Use it where specialised or independent edges add no compensating value and all needed context can remain inside the boundary.

Sequential interdependence does not automatically require ownership transfer. A relay may be enough when the sender owns its artefact and the receiver owns a later decision. Reciprocal coupling does not mean everyone may edit everything. Shared state needs more explicit write semantics because each action changes the context for the next. Parallel contribution should remain genuinely independent; a shared draft can prematurely turn two branches into one anchored branch with two names.

The geometry can change during a case. A low-risk request begins end to end. Conflicting evidence creates a typed relay to a specialist. Material exposure triggers an escalation to an authorised decision-maker. After the decision, a recovery team enters a reciprocal workspace to repair state. These transitions should be explicit events with packets and receipts, not improvised messages around a static process diagram.

A transfer requires an additional decision: which role owns customer communication and consequence while work is in transit. Moving internal responsibility should not force an affected person to discover a new contact at every step. A stable front-door owner may remain responsible for service while a bounded expert commitment transfers behind it. That arrangement avoids split accountability only when the internal packet, service time and return receipt are explicit. Otherwise the front door becomes a messenger with no authority and the specialist becomes an invisible owner.

Frequency changes the economics of each form. A rare, complex edge can support deliberate human interpretation. A high-volume relay needs typed validation, automated packet checks and sampled semantic review. A reciprocal workspace with hundreds of writes needs stronger versioning and conflict telemetry than a small incident room. Parallel branches earn their cost when independence or elapsed time matters enough to justify reconciliation. The same conceptual form therefore needs different operating machinery at different scale, but its ownership and acceptance semantics should remain stable.

05 / Reconstruction taxUntyped edges make every receiver repay for context

Reconstruction tax is the time and error introduced when the receiving role must rebuild purpose, state, provenance, rejected work or authority from source systems and conversation history. It is often invisible because it appears as expert judgement, preparation or “getting up to speed”. When agents produce fluent summaries, the tax can rise while transfer latency falls: the receiver must verify a persuasive compression whose omissions are unknown.

The tax compounds across a chain. The second receiver reconstructs the original case and interprets the first receiver's modifications. The third must determine which state is authoritative. Each local summary can simplify language while increasing semantic distance from the evidence. By the time an authorised person acts, the case may look coherent because contradictory or rejected material has disappeared from view.

Measure source-system reopening, missing-field repairs, clarification loops, packet rejection, version conflicts and time from receipt to accepted ownership. Do not punish receivers for rejecting incomplete packets. A falling acceptance rate after packet tests are introduced may be evidence that previously hidden defects have become visible. The objective is reliable movement of commitments, not a cosmetic first-pass acceptance target.

Reconstruction tax accumulates across untyped handoffsThree fast summaries cross roles while context loss and reconstruction work grow at each receiving stop.SOURCEROLE BROLE CAUTHORITYFASTFASTFASTreopen 2 sourcesrebuild purpose + statereconcile versions + authorityTRANSFER LATENCY FALLS · TOTAL CASE WORK RISES
Figure 3. Fluent summaries can accelerate visible transit while every receiver pays a larger context and verification debt.

06 / Parallel and reciprocal workIndependence needs reconciliation; shared state needs conflict rules

Parallel contribution is valuable when two branches should bring distinct evidence, methods or challenge. In a financial-crime case, transaction analysis and identity-link retrieval can proceed concurrently. Neither branch should overwrite customer status or see the other's conclusion early enough to anchor its search. Each returns evidence, provenance, uncertainty and rejected alternatives to a controlled reconciliation point.

A collision occurs when parallel branches share write authority without a state model. One agent updates the customer link from a newly retrieved record while another removes it based on a conflicting source. Last write wins, or a chat summary becomes the accidental source of truth. The work was not parallel contribution; it was uncontrolled reciprocal editing.

A governed reciprocal workspace declares authoritative fields, owners, version preconditions, proposed versus committed state, locks where necessary, merge rules and a human or deterministic resolver for incompatible claims. Participants can annotate shared evidence without erasing provenance. Proposed state remains separable from accepted state. The receipt shows which claim changed, which evidence supported it, who resolved the conflict and what downstream work must be reconsidered.

Parallel collision versus governed reconciliationTwo parallel agents collide when both write customer state, while a controlled design sends immutable evidence to a reconciliation workspace with version and conflict rules.COLLISIONGOVERNED RECONCILIATIONAGENT AWRITEAGENT BWRITEBRANCH AEVIDENCEBRANCH BEVIDENCELAST WRITEWINSRECONCILE v7provenance · conflictresolver · receiptCOMMITTED STATE v8PROVENANCE LOST · CASE DIVERGES
Figure 4. Parallel work produces immutable contributions for later reconciliation. Reciprocal writing requires explicit state and conflict semantics.

07 / Escalation bridgeChange authority for a declared reason

Escalation is not failure sent upward. It is a deliberate change in authority, expertise or resources when the current role cannot discharge its commitment under the active conditions. A consequence threshold may be crossed, a legal judgement may become necessary, evidence may conflict beyond the role's competence, or an urgent response may need resources unavailable in the normal route.

Confidence alone is a poor trigger. A model can be uncertain about a low-consequence routine item that a standard fallback can handle, while being highly confident about a case whose material consequence demands authorised review. Escalation combines context and consequence with authority: what changed, what commitment is now blocked, which role can lawfully and competently act, what evidence travels, and how quickly the destination must respond.

An escalation flood occurs when every low-confidence case enters the same scarce-expert queue. Waiting grows, urgent cases compete with harmless ambiguity and experts become a manual exception engine. Split the route. Routine uncertainty can fall back to a deterministic rule, request more evidence or remain with the pod. Material exposure, conflicting evidence, vulnerable-party context, legal boundary or missing authority crosses the bridge. Triage itself needs an accountable owner; “urgent” cannot become a queue-jump label generated by the sender.

The receiving expert accepts a bounded unresolved commitment rather than the entire case by default. After decision, ownership may return with a receipt and updated state. This prevents escalation from becoming permanent upward transfer and preserves the original accountable owner where appropriate.

Response time belongs in the escalation contract because authority that arrives too late is not operational authority. The time should reflect consequence and safe holding capacity, not a generic priority label. If the destination cannot respond, the fallback may suspend an action, preserve funds, notify a duty role or move to an alternate authorised path. A sender must not broaden its own powers because the expert queue is slow. Capacity failure is visible evidence for staffing, policy or geometry redesign.

Review false positives and false negatives separately. An unnecessary escalation consumes expert capacity and delays other work. A missed escalation leaves a role acting beyond competence or authority. Aggregate accuracy can hide both. Sample cases near consequence and context boundaries, including those confidently retained on the normal route. The aim is not to minimise escalation volume; it is to change authority when the case requires it and keep ordinary uncertainty on an appropriate fallback.

Consequence-led escalation bridge changes authorityRoutine uncertainty remains on the normal route while consequence, context or missing authority crosses a bridge to an authorised expert with a response time and return receipt.ROUTINE UNCERTAINTY → EVIDENCE REQUEST OR SAFE FALLBACKCURRENTROLETRIGGERTESTEDGEPACKETAUTHORISEDEXPERTCONSEQUENCECONTEXTAUTHORITY GAPDECISION RECEIPT + RETURNED STATE
Figure 5. The escalation bridge is triggered by changed consequence, context, expertise or authority. Routine uncertainty stays on a cheaper safe route.

08 / Fewer edges, not false simplicityRemove transit only when integration disappears

Coordination cost includes edge count, waiting, clarification, rework, divergence, conflict resolution, authority latency and outcome loss. Reducing one count can raise the others. Collapsing two specialist steps into a generalist pod may remove a queue but add search, training and error. Parallelising sequentially dependent work may reduce elapsed time while multiplying version conflicts. Adding independent challenge raises visible coordination yet protects against common framing and conflicted self-review.

Map the actual work, including informal integration. Ask who reconciles inconsistent outputs, who restores state after a conflict, who explains the case to the authority holder and who keeps a personal spreadsheet because the shared dashboard lacks meaning. If a formal handoff is removed, those activities should vanish, be automated under an explicit contract, or become owned work in the new boundary. Moving them into a senior person's inbox is not simplification.

The end-to-end pod should have a declared boundary: outcome, eligible population, tools, knowledge, authority, exception and stop condition. When a case crosses that boundary, the pod generates an edge packet instead of improvising a plea for help. This design combines continuity for ordinary work with rich edges for the cases that genuinely need them.

End-to-end pod rival and independent-edge boundaryA pod retains low-risk work inside one boundary, while specialist competence, legal segregation and independent challenge remain outside and connect through typed edges.HUMANOWNERBOUNDEDAGENTTOOLS +STATELOW-RISK END-TO-END PODPRESERVE EDGES FORspecialist competencelegal or role segregationindependent challengechanged authorityKeep continuity until a declared boundary is crossed
Figure 6. The pod removes unnecessary transit for ordinary work. Real competence, segregation, challenge and authority boundaries remain explicit.

09 / Worked geometryFinancial-crime evidence moves in parallel; judgement stays authorised

A financial-crime case begins with a named investigator who owns the outcome and holds the decision authority. Two evidence branches run in parallel. One retrieves identity, account and relationship links with provenance and freshness. The other analyses transaction sequences against declared patterns and tests alternative explanations. The branches cannot change customer status, see one another's preliminary conclusions or make the suspicious-activity decision.

Each branch returns an edge packet containing sources, transformations, rejected links or patterns, uncertainty and the next requested commitment. A reconciliation workspace stores proposed claims separately from committed case state. If two branches disagree on an identity link or time window, a versioned conflict record appears. A named case analyst resolves simple semantic differences; material unresolved conflict becomes part of the investigator packet.

Escalation is consequence-led. Low model confidence about a routine descriptor does not consume investigator time. Missing source provenance routes back to packet repair. Evidence of material exposure, a vulnerable-party flag, contradictory identity evidence or a judgement outside the analyst's authority crosses the escalation bridge. The authorised investigator receives the original purpose, complete provenance, rejected hypotheses, open conflict, consequence context and response time.

The investigator records the decision and reasons, then returns a receipt and committed state to the accountable case. Independent challenge remains a separate edge because the investigator should not assure the quality of the same decision process. Recovery or customer-action teams consume only the authorised downstream object, not the agent's preliminary conclusion. This geometry preserves speed in retrieval and analysis without turning parallelism into competing writes or shifting institutional judgement into an evidence tool.

A low-risk address-correction request takes the counter-route. One service pod can verify the person, retrieve current state, apply a policy-bounded correction and issue a receipt. All necessary knowledge and authority fit inside its boundary, consequence is low and no independent review is required. Sending it through a specialist queue would create waiting and reconstruction without adding control. The Designer should therefore remove the handoff.

Worked financial-crime shared-work geometryIdentity retrieval and transaction analysis run in parallel, feed a controlled reconciliation workspace, pass through independent challenge and escalate material conflict to an authorised investigator.CASEOWNERIDENTITY + LINKSprovenance · rejected linksTRANSACTION ANALYSISpatterns · alternativesRECONCILIATIONversions · conflictspacket + receiptAUTHORISEDINVESTIGATORINDEPENDENT CHALLENGEseparate evidence + receiptPARALLEL EVIDENCE · CONTROLLED STATE · HUMAN JUDGEMENT
Figure 7. Parallel evidence work gains speed without sharing premature conclusions. Reconciliation, independent challenge and authorised judgement remain distinct.

10 / Interactive instrumentShared-Work Geometry Designer

Describe one case and its boundary. The Designer returns a geometry and edge packet. It does not reward edge removal by default, and it refuses to treat low confidence alone as a reason to escalate.

Shared-Work Geometry Designer

Choose the dependency, state and authority conditions. Every route includes a packet, acceptance rule, service condition and receipt.

LIVE CASE ROUTE

Run independent work in parallel, then reconcile

Rationale: Distinct evidence or challenge should remain independent until a named reconciliation point.

GeometryTwo bounded branches return immutable contributions to a controlled reconciliation role.
Edge packetCase, purpose, source provenance, rejected work, uncertainty, branch authority, next commitment and reconciliation test.
Acceptance and serviceReject missing provenance; preserve independence; reconcile by the declared time under a named conflict owner.
Fallback and receiptFreeze proposed state on conflict, retain both branches and record acceptance, reconciliation and committed version.
Figure 8. The live result board states the work geometry, minimum edge packet, acceptance and service rule, fallback and receipt.

11 / Operating disciplineMake fewer edges richer and observable

Maintain a case-geometry register for recurring work. Record the outcome owner, eligible cases, roles, dependency form, authoritative state, packets, acceptance rules, service times, escalation triggers, destinations, conflict resolver, fallback and receipts. The register is not a static process map. It should change when work frequency, knowledge, system integration, consequence or authority changes.

Measure the geometry with a balanced set: active coordination edges, waiting, reconstruction, packet rejection, rework, state divergence, unresolved conflicts, escalation precision, authority latency, fallback use and case outcome. Separate justified edges from defects. An independent-review edge can be expensive and still necessary. A zero-edge pod can be quick and still unsafe if it contains a conflict of interest. The goal is the least costly shape that preserves the required operating qualities.

Pair operational measures with edge-level observation. For a sample of cases, follow the purpose and authoritative state from opening through every acceptance, conflict, escalation and return. Check whether completed and rejected work survived transit, whether the right role held the case during waiting, and whether downstream action used the committed rather than proposed state. This trace often reveals costs that queue averages miss: duplicate search, verbal translation, side-channel approval and delayed correction after apparently successful completion.

Economic accounting should include the people who absorb ambiguity. Senior specialists often appear productive because their reconciliation effort is not attached to the originating edge. Support teams may resolve state divergence without charging the workflow that caused it. A realistic cost view attributes reconstruction, conflict resolution, repeated evidence retrieval, missed service and remediation back to the geometry. Only then can leaders compare a richer packet, a shared workspace, an additional independent edge or a genuinely end-to-end pod on equal terms.

Inspect escalations by trigger and destination. Ask whether routine uncertainty is consuming specialist capacity, whether material cases arrive with complete evidence, whether authority holders can respond inside the service window and whether decisions return to the accountable case. A queue is not a geometry if nobody owns triage, priority and stale work. Urgency needs an evidence basis and an accountable exception receipt.

Review removed handoffs for invisible integration. Interview the people who reconcile, reopen systems or maintain side records. Compare total case work and outcome, not only elapsed time at the eliminated step. If integration persists, name and design it. If specialisation is no longer needed because tools and training changed the knowledge boundary, then the edge can genuinely disappear. If independence remains necessary, optimise the packet and service rather than collapsing the role.

Shared work becomes reliable when every role knows what it owns, what it receives, what it may change, what evidence travels and when authority must change. Agents can accelerate retrieval, transformation and routing, but they make incomplete edges more dangerous because fluent output and rapid transit disguise missing context. The answer is neither universal end-to-end pods nor an expanding network of specialist agents. It is deliberate geometry: few enough edges to control coordination, rich enough packets to preserve meaning, and explicit bridges when consequence demands different authority.

SourcesReferences

  1. Thompson, J. D. (1967), Organizations in Action: Social Science Bases of Administrative Theory. routledge.com/Organizations-in-Action.
  2. Galbraith, J. R. (1974), “Organization Design: An Information Processing View”, Interfaces. doi.org/10.1287/inte.4.3.28.
  3. Malone, T. W. and Crowston, K. (1994), “The Interdisciplinary Study of Coordination”, ACM Computing Surveys. doi.org/10.1145/174666.174668.
  4. Okhuysen, G. A. and Bechky, B. A. (2009), “Coordination in Organizations: An Integrative Perspective”, Academy of Management Annals. doi.org/10.5465/19416520903047533.
  5. Carlile, P. R. (2002), “A Pragmatic View of Knowledge and Boundaries”, Organization Science. doi.org/10.1287/orsc.13.4.442.2953.
  6. Star, S. L. and Griesemer, J. R. (1989), “Institutional Ecology, ‘Translations’ and Boundary Objects”, Social Studies of Science. doi.org/10.1177/030631289019003001.
  7. Lewis, K. (2003), “Measuring Transactive Memory Systems in the Field”, Journal of Applied Psychology. doi.org/10.1037/0021-9010.88.4.587.
  8. MacDuffie, J. P. (1997), “The Road to Root Cause: Shop-Floor Problem-Solving at Three Auto Assembly Plants”, Management Science. doi.org/10.1287/mnsc.43.4.479.
  9. Garicano, L. (2000), “Hierarchies and the Organization of Knowledge in Production”, Journal of Political Economy. doi.org/10.1086/317671.
  10. Jensen, M. C. and Meckling, W. H. (1995), “Specific and General Knowledge, and Organizational Structure”, Journal of Applied Corporate Finance. doi.org/10.1111/j.1745-6622.1995.tb00283.x.
  11. NIST (2023), “AI Risk Management Framework Core”. airc.nist.gov/airmf-resources/airmf/5-sec-core/.
  12. Basel Committee on Banking Supervision (2021), Principles for Operational Resilience. bis.org/bcbs/publ/d516.htm.
  13. Institute of Internal Auditors (2026), “Statement of Position on the Three Lines Model”. theiia.org/en/resources/statements-of-position.
  14. European Union (2024), Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. eur-lex.europa.eu/eli/reg/2024/1689/oj.
  15. ISO (2019), ISO 22301: Security and resilience, business continuity management systems. iso.org/standard/75106.html.