> ## Content Index
> Fetch the complete content index at: https://www.srgstrategic.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Checklists are great. Who makes the next decision?
- URL: https://www.srgstrategic.com/checklists-are-great-who-makes-the-next-decision/
- Published: 2026-10-06T21:22:51.000Z
- Updated: 2026-10-06T21:22:51.000Z
- Author: Shani Raine

Checklists are great... Lord knows where I'd be in life without them.

But even the best checklist eventually reaches a point where it tells somebody to coordinate. Which is fine, until the person with the information isn't the person with the authority, the person with the authority isn't answering, and everybody else is waiting to hear what they are allowed to say. That's a lot of work for one line on a checklist to carry.

On October 5, the Elections Infrastructure Information Sharing and Analysis Center published [Election Ready: A Cross-Sector Preparedness Guide](https://www.cisecurity.org/insights/white-papers/election-ready-a-cross-sector-preparedness-guide?ref=srgstrategic.com), drawing on its October 1 forum. It includes readiness checklists for election officials, law enforcement, technology teams, and the other organizations supporting election operations. Bringing those responsibilities into the same picture matters. The people responding to an incident need different information, hold different authorities, and have different obligations to the public. They also depend on one another to get their own work done.

[![](https://storage.ghost.io/c/d0/ec/d0ece0dd-ecdb-4309-959f-c75e5942a615/content/images/2026/10/Screenshot-2026-10-06-at-5.05.08---PM-1-1.png)](https://www.cisecurity.org/insights/white-papers/election-ready-a-cross-sector-preparedness-guide?ref=srgstrategic.com)

And that dependence deserves a closer look. A plan can be quite specific about each organization's responsibilities while leaving considerable uncertainty about what happens between them. Who verifies an instruction that has come through a third party? What can move forward while that verification is happening? At what point does one organization's caution become everybody else's inability to act?

In my [first election security post](https://www.srgstrategic.com/what-happens-when-the-risks-stop-arriving-one-at-a-time/), I wrote about what happens when several manageable problems begin interacting with one another. Each new problem can change the conditions under which the others have to be managed. A communications failure can make an authority question harder to resolve. That unresolved question can delay a public update. The delay can then leave partners and residents making decisions with less information, even while everyone involved is trying to be careful.

What interests me in the scenario below is how quickly one person’s reasonable decision can change the choices available to everyone else. Waiting for confirmation may reduce the risk of an inaccurate statement while leaving partners without guidance. An offer of help may expand an institution’s reach while raising new questions about who can speak for it.

Everybody may be doing something sensible from where they sit. The difficulty is that they are also changing the conditions for people sitting somewhere else... often without seeing the consequences.

I recorded this walkthrough of *Midterms 2026: Under Pressure* to make those relationships visible. You can pause at each choice and consider what you would need from the other people involved before acting...and what they might need from you.

0:00 

/18:43 

1× 

Midterms 2026: An election scenario walkthrough

There is another layer to this that matters well beyond the exercise. Several safeguards can appear independent on paper and still depend on the same person, provider, or relationship. If the backup channel relies on the service that just failed, it offers little additional capacity. If every correction and approval has to pass through one unreachable official, adding more partners may add more people waiting for the same answer.

Under ordinary conditions, those arrangements can look efficient. Everybody knows whom to call, and an experienced person can quietly resolve ambiguities that never make it into the plan. An exercise gives an organization a way to see how much of its continuity depends on that person remaining available. It also creates a chance to distribute knowledge and clarify authority before somebody has to improvise under pressure.

But the same arrangement can work very differently from one place to the next. Trusted local relationships may absorb a disruption; a small team may have years of experience and nobody available to cover an absence.

That’s why guidance coming from above needs information coming back up. Counting partnerships and backup channels tells us little unless we know whether partners can act and backups can survive the same disruption. Otherwise, the assessment may describe the plan accurately while missing the conditions in which people will use it.

A useful parallel comes from Japan’s [Delta Wall 2026 exercise](https://tokyobrief.com/articles/fsa-delta-wall-2026-cyber-drill-181-institutions?ref=srgstrategic.com), scheduled for October 6–22, with 181 financial institutions expected to participate. The exercise follows the work from initial response through investigation, customer communications, and recovery. But its design also looks beyond getting through the scenario: evaluating what happened, identifying concrete improvements, and sharing what participants learn across the wider industry.

What I find useful is the attention to what changes afterward. An exercise can expose a problem; someone still has to own the follow-through, make a change people can use, and test whether it works.

AI evaluation offers a revealing example. My friend and colleague, Katherine Pratt, PhD, recently [co-authored a paper](https://arxiv.org/pdf/2605.05662?ref=srgstrategic.com) showing that some local models appeared safe because they failed to understand the request. An apparently reassuring result could support the wrong conclusion about what the model was capable of.

For institutions using AI, that problem becomes consequential when confidence in an output turns into action. Consider a team using an AI-generated analysis that has already informed a decision. Now introduce evidence that undermines one of its central claims. How much of the decision still holds...and what, exactly, would justify changing it?

That is where I’d apply strategic disconfirmation, drawing on military red-teaming’s practice of deliberately seeking evidence that challenges a plan’s assumptions. An exercise can follow that challenge through the reasoning behind a decision: which assumptions fail, which conclusions survive, and whether the team can reconsider its judgment once people, resources, or reputations are already committed.

So yes, keep the checklist. Then get the people who will have to use it together, change a few of the conditions they are counting on, and follow the decisions far enough to see what holds. If the next step depends on a person, a channel, an authority, a relationship, or a claim everyone is treating as settled, make that dependence visible while there is still time to do something about it.

The question belongs at the center of any consequential plan: what are we counting on, and have we seen it work under the conditions in which we’ll need it?

If the walkthrough makes you think of a situation your team, institution, or partners should be testing, I'd love to hear from you. Reply to this email, [get in touch](mailto:shani@srgstrategicconsulting.com?subject=Under%20Pressure%3A%20Midterms%202026%20recording%20request), or pass it along to someone who needs to be part of that conversation.

All my best,

![](https://storage.ghost.io/c/d0/ec/d0ece0dd-ecdb-4309-959f-c75e5942a615/content/images/2026/10/Shani-handwritng-1.png)