Doctrine by Drift: Auditing the Policy Your Institution Actually Follows

Every endowment, foundation, and corporate plan in the United States operates two investment strategies. The first is documented: a policy statement ratified by committee, reviewed annually, signed with appropriate ceremony. The second is undocumented — an accumulation of exceptions granted, informal rules of thumb, and small behavioral accommodations that, taken together, may bear little resemblance to the text on file.

We call this the shadow mandate. It is not the product of malfeasance. It is the product of accumulated judgment under pressure — and left unaudited, it eventually becomes the strategy the institution actually runs.

How the Shadow Mandate Forms

The mechanism is mundane. A manager breaches a rebalancing band, and because markets are volatile that week, staff waits rather than trades. A liquidity floor is bent once to accommodate a compelling commitment. A new CIO inherits a hedging practice no one can locate in the policy and simply continues it. Each decision is defensible in isolation. Each becomes precedent.

Over a cycle, these precedents compound. Staff learn what the committee actually wants, as distinct from what it wrote. New hires are trained by observation rather than by document. Within a few years, the informal rulebook governs more decisions than the formal one — and the formal one survives largely as a compliance artifact.

The danger is not drift itself. Drift is information. The danger is that drift goes unexamined until a stress event forces the institution to discover, mid-crisis, that its real exposures were never the ones it ratified.

A Practical Audit

Surfacing the shadow mandate does not require an outside consultant. It requires a disciplined internal exercise, conducted annually, that compares the written policy against observed behavior. We recommend four steps.

First, reconstruct the actual rules. Have a staff member who was not involved in policy drafting review two years of meeting minutes, trade approvals, and exception logs. Their assignment: write down the rules the institution appears to follow, based solely on what was done. The result is frequently unrecognizable to the people who wrote the policy.

Second, catalog the exceptions. Every granted exception should be logged with its rationale and its outcome. A policy breached repeatedly, with benign results each time, is not a broken policy — it is a policy the institution has already replaced and not yet admitted.

Third, interview the operators. Portfolio managers, traders, and analysts know the shadow mandate intimately. Ask them directly: which rules do you apply that are not in the policy? Their answers, aggregated, form the true rulebook.

Fourth, reconcile. The committee should then make an explicit choice for each divergence: ratify the practice into the written policy, or retire the practice from operation. What the audit must not permit is the current default — divergence that is neither sanctioned nor stopped.

Red Flags That Drift Has Become Doctrine

Certain signals indicate the shadow mandate has hardened beyond routine flexibility:

• Staff describe the policy in a form that matches no document on file.
• Exception requests have declined sharply — not because discipline improved, but because staff stopped asking.
• A new committee member's first reading of the policy conflicts with how every veteran describes the program.
• The institution's reported risk profile and its actual stress behavior diverged during the last drawdown.
• Two long-tenured staff members offer different, sincere explanations of the same rule.

Any one of these warrants a formal reconciliation. Two or more suggest the written policy is already an anachronism.

The Governance Obligation

Some will object that informal flexibility is a feature, not a flaw — that rigid policies produce rigid institutions. We agree, with a condition. Flexibility exercised deliberately and ratified in writing is judgment. Flexibility exercised silently and inherited by accident is abdication. The difference is not the behavior; it is the documentation.

The shadow mandate exists in every institution, and it will exist in yours. The only question governance controls is whether it operates with the committee's informed consent — or despite it.