Cargo-Cult Controls: When the Form Remains but the Function Is Gone

Over the holidays, I came across a term I had not encountered before: cargo cult. It comes from a strange but instructive chapter of World War II history and it has stuck with me because it perfectly describes a pattern I see in modern risk and control environments.

In parts of the South Pacific during the war, Allied forces built airstrips and temporary bases on remote islands. Airplanes arrived with food, medicine, and supplies. When the war ended, the planes stopped coming. Years later, some island communities rebuilt the airstrips, control towers, and even wooden headphones and signal wands, faithfully recreating what they had observed.

The form remained. The function was gone. The system that made the planes arrive no longer existed.

That same dynamic shows up in modern control environments. Organizations recreate controls that once made sense, continue to execute them with discipline, and produce the expected evidence, even though the conditions and risks that originally justified those controls have materially changed.

The First Trail Marker: The Smell Test

The easiest way to spot a cargo-culted control is deceptively simple.

Remove the control from the story.

If nothing meaningful remains—no credible business impact, no material failure—then the control was never anchored to risk. It was anchoring the narrative instead. This is what cargo culting looks like in risk drafting. The “risk” becomes a mirror image of the control. “The risk is that the quarterly review is not performed.” That is not a risk. It is a checklist item pretending to be one.

This smell test is the first trail marker. It tells you whether you are still navigating real terrain or just following signs that no longer point anywhere.

Carrying Gear for the Wrong Trip

Here is a real world example from my first backpacking trip as a Scoutmaster.  One of my Scouts showed up with a pack full of gear that made perfect sense—just not for the trip we were taking. Multiple GoPro cameras. A heavy, collapsible military shovel for digging cat holes. Gear that would have been fine for car camping. But this was a long-distance backpacking trip. He was going to carry everything on his back for miles. That gear was not aligned to the terrain, the distance, or the objective. It would slow him down, wear him out, and make the hike harder than it needed to be.

Many control environments look exactly like that backpack. Controls introduced years ago to address a specific audit finding, regulatory concern, or system limitation remain in place long after automation, process redesign, or organizational maturity has changed the trail. They are not wrong in isolation. They are wrong for the journey you are on now.

Why the Gear Stays in the Pack

If these controls no longer fit the terrain, why do they persist? Because incentives matter more than intent.

Controls often start as a response to audit feedback or regulatory pressure. Over time, they quietly shift from “this reduces risk” to “this is what audit expects to see."

The control survives not because it works, but because removing it feels risky.

Most regulators articulate control objectives, not prescriptive controls. Yet organizations frequently treat previously reviewed controls as untouchable, fearing that any change will invite scrutiny or reopen old conversations. The result is risk aversion focused on avoiding feedback rather than improving outcomes.

Ritual Is Not the Problem

Sometimes controls become rituals, things we just do.  Rituals themselves are not a failure. In fact, good processes should become ritual. Front-line teams should not have to stop and reason through risk theory every time they perform a task. Consistency and making things second nature is the goal.

Think about camping or hiking gear. Over time, certain items become automatic. Maybe the Scout from earlier always packs his GoPros when we go camping. Most of the time, they earn their place in the bag. They capture moments, add value, and justify the weight. The ritual exists because the benefit is understood.

The problem emerges when the reason for the ritual disappears but the behavior remains. If I pack that same gear without thinking about the terrain, distance, or objective, the ritual turns into dead weight. A ritual rooted in understanding is strength. A ritual performed because no one feels safe questioning it becomes cargo cult behavior. The form survives. The meaning does not.

This is why risk and control assessments belong in both governance forums and on the front line. We should be constantly challenging and refreshing our understanding and making sure we're aligned to the trail.

When Gear Becomes Dead Weight

Controls do not become dead weight all at once. They usually drift there in a few predictable ways.

Most often, it happens when:

• A control starts to fail because people no longer see value in the activity.

• A control no longer fits the environment because the risk has shifted or been structurally addressed.

• A control survives mainly to generate evidence for audit or regulators, without meaningful operational or risk impact.

Each of these looks different on the surface, but they share the same outcome: added effort without added protection.

Not all failing controls are obsolete, and not all obsolete controls fail visibly. Sometimes a control fails because it is poorly designed or poorly executed. People skip it, rush it, or treat it as a box to check because it does not help them do their job. That is a fixable problem.

Obsolescence is different. A control becomes obsolete when it no longer materially changes the likelihood or impact of a risk because other mechanisms have taken over that work. Often, those mechanisms are structural. Automation rarely eliminates risk. It displaces it.

Manual termination reviews may give way to event-driven deprovisioning, continuous identity reconciliation, and automated alerts. The risk moves, and the control should move with it. Keeping the old manual control “just in case” adds weight without adding protection.

The third failure mode is quieter, but just as common. This is where organizations confuse controls with evidence. Evidence exists to demonstrate that a control operated. It is not the control itself.

When activities are performed primarily to generate artifacts for audit—screenshots, exports, weekly reports that no one uses operationally—the control has already started to drift. The work remains, but the risk reduction does not.

A control that exists mainly to prove something happened is often a sign that the underlying risk is being addressed elsewhere, more effectively. Carrying both mechanisms is like hauling redundant gear up the trail. It feels safer, but it slows you down.

How to Repack Intentionally

Avoiding cargo-cult controls does not require perfection. It requires discipline and intent. Repacking your control environment starts with a simple reality check. Ask two questions:

• What specific risk does this control mitigate today?

• If this control were removed or downgraded, what credible failure could occur that is not already addressed elsewhere?

If those answers are unclear, the control is a candidate for redesign, downgrade, or retirement. That is not recklessness. It is responsible packing.

This is what control maturity actually looks like. Mature risk management is not measured by how many controls you accumulate over time. It is measured by how deliberately you choose them, adapt them, and let them go when the trail changes.

If you never remove controls, you do not have a framework. You have a museum.

Put this into practice:

• Inventory your controls and explicitly map each one to a current risk, not a historical one.

• Apply the smell test. Rewrite the risk if removing the control collapses the risk statement.

• Challenge controls that persist primarily to appease audit or avoid questions rather than reduce risk.

• Distinguish between ritual as consistency and ritual as mindless repetition.

• Repack your control environment for the trail you are actually hiking.

Which controls in your environment feel like gear you are still carrying for a trip you are no longer on?