Most serious legal and commercial risks do not announce themselves dramatically. They enter organisations insidiously through small, temporary gaps —…