Standing access is the risk that never makes it onto the risk register

Every infrastructure post-mortem contains the same paragraph, and it is never the one anyone expected...