Threshold signing fails at the rate your staff resign

The failure, plainly

Two of the five key holders leave in the same quarter. The remaining three can still sign, so no alert fires. A third leaves; the threshold is now unreachable and the position is frozen. The control that was supposed to prevent unilateral action has instead prevented all action, and the recovery procedure — if it was written — has never been rehearsed.

Why threshold signing drifts

A signing policy is designed once, at a moment when the institution has a particular shape, and then left alone because changing it requires a ceremony. Everything else about the institution keeps moving: people are promoted out of the rota, seconded, or leave. Nothing in the ordinary operation of the system reports on the gap between the number of holders who can sign and the number required, because the system is working right up until it is not.

Modelling attrition

Take the institution’s own voluntary turnover figure, apply it to the holder set rather than to headcount, and ask how long the policy survives. At a 15% annual rate, a five-person rota loses its first holder inside a year on expectation, and the probability of dropping to the threshold within eighteen months is not small. The number is not the point; the exercise is, because it converts a governance assumption into a date.

A working rotation policy

if (activeHolders <= threshold + 1) {
  raise("rotation required", severity.HIGH);
  block(newDelegations); // no quiet drift below the margin
}

The rule is to alarm on the margin, not the threshold. One spare signer above the minimum is not a comfortable buffer; it is the last warning you will get. Blocking new delegations at the same moment prevents the common response — spreading the remaining holders thinner across more vaults — from making the position worse while the rotation is arranged.

What to instrument

• Active holder count against thresholdNot the configured set — the set that can actually be reached and would actually sign this week.
• Days since the last rehearsed recoveryA recovery procedure that has never been executed is a document, not a control.
• Time-to-sign on a live instructionThe operational number that degrades first, and the one an operations team will notice before governance does.

All three belong on the operations dashboard, not in a policy document. The failure this article describes is not a failure of policy design; it is a failure to give the policy a live reading.