Beyond Operational Security: Aggregation Failure, Interface Ownership and the Design of Layered Risk Assurance in Complex Organisations

Organisations that run large public operations distribute risk management across contracted security providers, operational managers, digital teams, executives and public authorities. Enterprise risk management, high-reliability organising and resilience engineering offer partially competing perspectives on prioritisation, interpretation and adaptation in these arrangements. This article asks how organisations should structure layered risk assurance across corporate operations, public gatherings, contracted services and digital infrastructure. It conducts a structured documentary analysis of the published findings of an official public inquiry into a mass-casualty attack at a UK arena, read alongside the published scopes of the principal risk and continuity standards and intergovernmental mass-gathering guidance. The inquiry documents failures of risk assessment and coordination; the article interprets them through two proposed design mechanisms. The first is aggregation failure: scoring instruments that average or net across hazards arithmetically suppress low-frequency, high-severity hazards, a mechanism visible in a counterterrorism assessment rated low while the national threat level was severe. The second is interface non-ownership: responsibilities were allocated to parties while the junctions between them were allocated to none. The article argues these defects are architectural rather than attitudinal, a reading the inquiry's own refusal to find deliberate compromise of safety supports and that enterprise risk management and high-reliability theory give contradictory instructions on aggregation. A Multi-Layer Risk Assurance Model specifies severity-gated registers, named interface owners and verification modes. The analysis rests on one inquiry in one jurisdiction and establishes no counterfactual.