It is 4:30 PM on a Friday, and it is the last day of the month. Your team has received a report that some transactions are failing. They track the issue down to data issues that trigger a defect in an update that was deployed earlier in the week.

At 7:00 PM, the last person out the door fixed the issue—our hero! Transactions are flowing again. Month-end processing is saved. We’ll document and disclose the data changes and submit a project that’ll prevent future issues on Monday. Does that follow-through happen?

The save is not the win. The wins come when you can keep the heroics necessary to solve some problems but lose the risk of bending and breaking your rules. Every organization has cowboys and heroes. In all honesty, we depend on them, but they can be a hidden tax on your organization.

Cowboys and heroes

Heroes are specialists who can tackle big problems. They are dependable, available, and operate with high integrity and the best interests of your organization. They are relentless at solving big problems, but they are not going to be able to stick around to document solutions or clean up after themselves. They are indispensable.

Cowboys know practical things that get jobs done and can save the day in a crisis. They bend your norms so they can quickly assess and explore issues and get the job done as quickly as possible since they know the next one is coming right behind it. They are not good at following rules, compliance, or handing skills and solutions off to other people. They can be temperamental.

Earning their keep

When you are doing exploratory frontier work, heroes are your champions and can take a new market or a greenfield application from nothing to something viable quickly. If your CUSO is working on a new integration demanded by the market, heroes can be your front line for high value, quick delivery.

When you are executing a crisis response, your cowboys will round up your issues and work through them one by one until all tasks have been resolved. There is nothing a cowboy dislikes more than having member-impacting outages, system failures, or little nagging issues.

The key to successfully deploying these types of personas is to make sure that your organization is using them surgically, not as part of your organizational structure and processes. Reliance on cowboys and heroes is a reliable signal of low organizational maturity.

There are three main costs that come from misusing your cowboys and heroes. The averted crisis or the new trail you have blazed is often seen as a win. If you look at it through an accounting lens, it is really a loan against your organization that you will have to pay back.

• Compliance – Ad hoc changes become audit exceptions and examiner findings.
• Culture – Over-celebrated heroics teach everyone that process is for other people.
• Knowledge – Heroics lead to single points of failure. Who handles the next incident?

Who is paying for this debt?

As a CUSO, you usually sit outside the direct scope of exams and compliance. This does give you some freedom, but it is also a trap. You will be held accountable by your credit unions, and the bills from your heroics will be paid by your customers.

Ad hoc fixes are not just work for your CUSO; they are often bigger events for customers. This fix does not stay your problem; it becomes one for the credit union. If you do not meet the requirements for consent, notification, documentation, and other critical processes, you are exposing your customers to examiner findings. Speed without process is added risk.

Even though you may not be directly examined by the NCUA and other regulatory organizations, you are examined by proxy. You will be responsible for SOC 2 documentation, responding to security audits and incidents, and fully documenting and complying with your internal processes. Hero activities cause a burden on your organization, and that trickles down to the exams and audits of your customers.

Thinking a bit bigger, the NCUA does not have direct examination or supervisory authority over CUSOs today. If your organization is not keeping this hero tax in check by avoiding system risk and jeopardizing the safety and soundness of the credit unions you serve, you are putting the entire CUSO ecosystem at risk of becoming directly regulated.

So how do you capitalize on the strengths of your cowboys and heroes while minimizing your risk and exposure?

The fix

We need to figure out how we can keep the upside to having our heroes and cowboys while reducing our exposure. The answer to this is to implement Bounded Autonomy. Cowboys and heroes have unique needs. You want them to have autonomy to do what they do best, but you need to put up guardrails. Move fast but keep it between the lines.

Cowboys

• Pre-authorized “flex lanes” (sandboxes, pilot exceptions, known exemptions)
• Explicit “stop” indicators (PII exposure, production changes without review)

Heroes

• “Duty of Care” processes (SOPs, runbooks, incident reports)
• Handoff to owning teams for future prevention.

The second thing that you need to do is to institutionalize turning heroic events and saves into real capabilities. You need to turn your cowboys into teachers and learn from your heroes so you can build up your organizational skills.

• Codify results: Mandatory post-mortems to build SOPs, controls, and training.
• Assign ownership: Shift from a person to an accountable team.
• Lighten up: Processes and gates should be fast and lean, so people use them.

Clint Eastwood

Clint Eastwood made his name playing legendary cowboys and heroes (anti-heroes?) like The Man with No Name and Dirty Harry. Many of his characters start out as isolated loners who do not play nice but evolve to an understanding that taking rough roads can lead to more problems than they solve if you do not find ways to collaborate with them appropriately.

You should support your heroes and cowboys by celebrating their work AND the wins you get by learning from them. Make it part of your culture by institutionalizing your strong personalities so future cowboys and heroes can be used precisely where they are appropriate, not as a de facto assignment.

Otherwise, you will be left where Dirty Harry started, asking one question: “Do I feel lucky? Well, do ya, punk?”—and in this business, you do not want to be relying on luck.