Complex programs can appear controlled while the real risks sit underneath the formal reporting layer. Governance packs may be current, risks may be logged and milestones may be tracked, while the sponsor still lacks a clear view of whether the program can actually deliver.