Say Something vs. Build Something

For five weeks I've made the same argument from different angles: rules change what organizations are required to do, but rarely change what they are. Disclosure mandates get absorbed by whatever the organization already is — its capacity, its culture, its governance.

A fair question follows: can regulation change what organizations are at all?

Yes. But not the kind we keep writing.

There are two kinds of mandates. Rules that require organizations to SAY something — disclose the breach, post the label, file the 8-K. And rules that require organizations to BUILD something. The evidence from five weeks of posts is about the first kind. The second kind behaves differently, and my own industry produced the best example I know.

In 1996 and 1999, the FCC ordered wireless carriers to be able to locate 911 callers — Phase II required latitude and longitude within 50 to 300 meters. There was no document a carrier could file to satisfy that. The FCC's own implementation record describes what compliance required: developing new location technologies, upgrading networks, and coordinating across carriers, vendors, and public safety agencies. Carriers fought it. They requested waivers. Deployment ran slow. But you cannot paper-comply with an accuracy standard — and the capability got built. The location infrastructure that mandate forced into existence now underpins far more than emergency calling.

SOX Section 404 tells a similar story with an honest asterisk. It didn't just require companies to report on internal controls — it required the controls to exist and to survive an audit. John Coates and Suraj Srinivasan's review of more than 120 studies (Accounting Horizons, 2014) found the institutions SOX created survived intact and financial reporting quality appears to have improved — though causal attribution is weak, and the costs fell disproportionately on smaller firms. Even a capacity mandate routes through capacity distribution. There's no escaping that. But note what nobody claims about Section 404: that firms satisfied it with a filing.

So here's the pattern, stated plainly.

Disclosure mandates are cheap to write, cheap to comply with, and cheap to verify — which is exactly why we keep writing them. A timing window costs the regulator a paragraph and costs the firm a template. Capacity mandates are expensive, slow, contested, and hard to specify. They're also the only kind with a track record of changing what organizations are.

We regulate the announcement because the announcement is what we can afford to regulate. Then we're surprised the announcement is all we get.

If the outcome is what we want, the capacity is what we have to require. Everything else is asking organizations to describe themselves — and they will, in exactly the way five weeks of evidence predicts.

No. 009 in the Threshold Effects series. First published on LinkedIn, August 17, 2026.