Load-Bearing Paperwork
#052: What a buckling Manhattan high-rise reveals about why governance systems pass every check right up until the thing they govern fails.
“Most governance systems verify artifacts. Drawings, calculations, sign-offs, permits. What they do not verify, at least not continuously, is reality.”
At 7:57 yesterday morning, construction workers on the 21st floor of the old Pfizer headquarters in Midtown Manhattan watched two steel columns bend into sideways Vs.
Within hours, nine surrounding buildings were evacuated, including a school with 400 students inside. The city froze five blocks of Midtown. The mayor called the situation extremely serious. The building, a 1970s office tower being converted into roughly 1,500 luxury apartments, kept shifting into the afternoon. Thankfully, nobody was hurt. As I write this, the official cause is undetermined.
Nothing I work on carries these stakes, and nothing you work on probably does either. But I have spent the past decade plus building governance for various design and accessibility programs, and I can’t stop reading about this building and its history. The systems logic that produced that moment on the 21st floor is the same logic that fails inside most organizations' governance efforts, including some of the ones I’ve built.
The paperwork was fine
The conversion project passed every formal check. It had an active construction permit, a licensed engineer of record, and approved conversion plans. The developer, the architect, the contractors were all established firms. This was a fully permitted, fully inspected project in the most heavily regulated construction market in America.
The building also had at least 22 violations dating back to 2020, including seven in the second half of 2025 alone, with more than $32,000 in fines, yet none of it mattered. Fines that small are a rounding error on a project this size. Violations that don’t force action are just paper.
So the question everyone asks after something like this: aren't there checks and balances designed to prevent exactly this? There are, and they mostly work the way they were designed to and not in the way most assume they do. Most governance systems verify artifacts — drawings, calculations, sign-offs, permits. What they don’t verify, at least not continuously, is reality: the built thing, under actual load, as it exists right now.
This keeps happening
If this were an isolated case, you could write it off as bad luck. But it’s not.
Davenport, Iowa, 2023: an apartment building partially collapsed during facade repairs, killing three people. Workers and residents had reported bulging walls for months, and an engineering firm warned days before the collapse that sections of brick appeared ready to fall. The building stayed occupied. The paperwork described the danger accurately and changed nothing.
New Orleans, 2019: the Hard Rock Hotel partially collapsed during construction, killing three workers. OSHA cited the project's engineer for beams that were under-designed in load capacity, design errors the review process never caught. The design passed review. The floors sagged anyway.
Philadelphia, 2013: a demolition crew brought a wall down onto an occupied thrift store, killing seven. The demolition plan was fine. What happened in the field was not the plan.
And Surfside, 2021, where 98 people died. Different situation, an occupied building degrading over decades, but the same signature: a 2018 engineering report documented major structural damage, then sat in a file for three years while the condo board debated repair costs.
Different decades, different cities, different proximate causes, but one pattern: the failure was almost never an absence of engineering knowledge. Somebody knew, or the information was sitting in a document somewhere. The failure was the gap between the approved plan and reality, and the absence of anything that forced the two back into alignment.
Three ways the gap opens
Three specific mechanisms show up in these stories, and each has a direct parallel in digital systems work.
As-built drift. A 1970s building has 1970s drawings. Fifty years of renovations later, the drawings describe a building that no longer quite exists. An engineer who models loads against the blueprints is modeling a fiction.
The design system version: your audit checks the Figma library. The library is pristine. Meanwhile production is shipping forked buttons, detached instances, and hardcoded hex values, because the audit inspects the source of truth and the source of truth stopped being true eight sprints ago. Teams are compliant on paper. The DOM says otherwise. I have run audits like this that feel great and prove almost nothing.
Load change without re-review. The Pfizer building was engineered to hold up an office. It is being asked to hold up 1,500 apartments and the massive amount of new support infrastructure. City officials said the columns became stressed as more weight was added to the floors above the failure point. The structure's job changed, and the analysis of what it could bear fell out of sync with what it was being asked to bear.
The design system version is so common it barely registers as risk. A component gets designed for one context, then a second team adopts it, then a fifth. Someone stretches it across a breakpoint it was never designed for, adds a prop, then another. No single change is big enough to trigger review, so no review happens. The column doesn’t buckle when the first floor is added; it buckles on the 21st.
Findings without forcing functions. 22 violations in Midtown Manhattan. In Davenport, months of documented warnings. In Surfside, a report that aged in a file for three years. In every case, the system successfully produced findings that failed to compel anyone to action.
You already know this version. Accessibility bugs aging in the backlog. Drift flagged in retros, nodded at, deprioritized. Contribution guidelines everyone agrees with and nobody follows. Governance that produces findings without consequence is just advance documentation of your future incident report.
The check that worked
What actually saved lives on 42nd Street: the workers who looked at the columns, trusted their own eyes over the paperwork, and raised the alarm. The most sophisticated part of the entire safety apparatus turned out to be humans standing near the real thing with the ability to act on what they saw.
Toyota built its production system around this idea.
The andon cord: any worker can stop the entire line when they see something wrong, and stopping the line is treated as a contribution, not a disruption. The people closest to the work will always detect failure before the metrics do, if you let them.
Your design system has this resource, too. It’s the engineer who says "this component fights me every time I use it." The designer who mentions, almost apologetically, that they detached the instance because the real one wouldn’t do what the page needed. Those are strain gauges.
The question worth asking about your own system is brutally simple. When someone near the work sees something wrong, is reporting it faster and safer than staying quiet? If not, your governance has no last line of defense. The paperwork is all you have.
If you run a system
Some of this is directly actionable.
Audit the rendered thing. Production is the truth, not the library. If your compliance measurement never touches shipped code, you are inspecting the blueprints of a building that has been renovated without you.
Treat accumulated small deviations as one structural signal. Ten minor drifts in one component is not ten low-priority tickets. It is one piece of evidence that the component no longer fits its load.
Give every finding an owner, a deadline, and a consequence. A check that doesn’t compel action is worse than no check, because it manufactures false confidence.
Re-review when the load changes, not when the calendar says so. New team adoption, new context, new scale: these are your conversion permits. Quarterly audits won’t catch a load change that happened in week three of the quarter.
And protect the human escalation path above everything else. Reward the person who stops the line, publicly. The first time someone gets dinged for raising a concern that turned out to be nothing, you’ve taught the whole organization to wait until the columns are visibly bending.
Measurements of the plan are not measurements of reality
Every governance system drifts toward inspecting its own artifacts, because artifacts are legible since they’re static when reality isn’t. The real work is forcing your checks back into contact with the built thing, over and over, especially when the paperwork says everything is fine. Otherwise, your system will face the equivalent of what’s happened on 42nd Street where the specs were approved, but the steel columns hadn’t read them.