The Fifth Element: What Boards Should Ask About New-Business Build Programs

McKinsey's recent piece argues that established companies must repeatedly build new businesses or be replaced. The S&P 500's average tenure has fallen from 61 years to 22. Six of the world's ten largest companies are now serial business builders. The diagnosis is correct, and the four elements McKinsey prescribes — strong CEO sponsorship, autonomous structures shielded from the parent's bureaucracy, stage-gated funding tied to validated assumptions, and a dedicated business-building team — are correct.

For boards, the article reads as a useful checklist of what to expect from a CEO who is asking for capital to build new businesses. Each element maps to a board-level question. Are you sponsoring this credibly, or delegating it? Is the venture ring-fenced, or competing with core divisions for budget? Is funding gated to validated assumptions, or does the team get to spend the full envelope on faith? Who is leading the build, and what is their record?

These are the right questions. They are also incomplete.

The element McKinsey leaves out

There is a fifth element the article does not name, and it is the one that increasingly decides whether a new business survives its first regulatory cycle. Governance scaffolding, designed in from day one.

Every business launching today ships into a regulatory environment that did not exist when the McKinsey playbook was first written. EU AI Act enforcement is live. Connecticut's CART Act — signed May 29, 2026 as Public Act 26-15 — puts employment AEDT obligations into force on October 1, 2026, while Colorado's wholesale repeal of its 2024 AI Act this May (replaced by a narrow ADMT transparency regime arriving in 2027) shows how quickly the state-law map redraws itself in both directions. NYC Local Law 144 has been enforceable for two-plus years. BIPA-style biometric privacy regimes are spreading state by state. ISO 42001 is being written into procurement contracts. The Federal Register is moving on AI rules at a pace not seen since the SEC's 2003 sweep.

In that environment, you can run all four McKinsey elements perfectly — brilliant CEO sponsor, beautifully autonomous venture, disciplined funding gates, top-tier build team — and still launch a product that takes a $650M class-action hit, like Patel v. Facebook on biometrics. Or a $365K EEOC settlement plus a permanent consent decree, like the iTutorGroup case on age-screening algorithms. Or Clearview AI on facial recognition — a biometric-privacy class settlement ultimately valued at roughly $51.75 million, on top of a €30.5 million Dutch data-protection fine.

Those were not bad businesses. They had product-market fit, real revenue, customers who valued them. They failed the part of business-building that does not appear in McKinsey's reverse profit-and-loss exercise: the regulatory boundary they crossed without realizing it existed.

What this means at the board table

For directors, the implication is that approving a new-business build program is no longer a conversation about CEO sponsorship, autonomy, funding discipline, and team. It is a conversation that has to add a fifth gate — a governance gate — before the venture is allowed to ship its first commercial-grade product.

The gate is structured around four questions the board should expect the founding team to answer in writing, with evidence:

1. What can this product not do? Not "what is a hard problem we will solve later" — what is the floor below which the product is illegal, unsafe, or indefensible in front of a regulator, a plaintiffs' lawyer, or a journalist? Are those tripwires baked into the architecture, or are they policy aspirations that depend on individual employees making good decisions in real time?

2. How does the system explain itself when challenged? When an auditor, regulator, or enterprise customer asks how a specific decision was made, what does the answer look like? "We will figure that out at scale" is not an answer that survives a 10-K disclosure obligation, a procurement diligence cycle, or a litigation-hold request.

3. Where is the human in the loop, and is that human positioned to actually intervene? A reviewer who sees one in ten thousand decisions and has six seconds to overturn each one is theater, not oversight. McKinsey's article is silent on this, which means the board has to surface it.

4. What does the audit trail look like three years from now? Not the data model — the durable, replayable record that survives a regulatory subpoena, an enterprise customer's third-party assessment, or an acquirer's diligence pass. If the team cannot describe that record today, the venture is borrowing its own future credibility.

A board-level addition to the McKinsey funding gates

McKinsey describes a pattern of incumbents releasing tranches of capital as ventures hit validated milestones. The framework is sound. The board's contribution is to insist that one of those milestones is a governance gate — passed when the founding team can answer the four questions above in a way that survives an external review, not just a chairman's nod.

The four McKinsey elements give you a fast, well-led, well-funded venture. The fifth element is what gives you a venture that is still standing in 2030. Without it, the board's exposure is not theoretical — it is the line item that shows up in the next D&O renewal cycle as a premium increase, a consent decree, or a Caremark-derivative complaint.

What this looks like in practice

Across BoardSight engagements, the boards that have absorbed this lesson are not the ones that have read every paper on AI governance. They are the ones that have rewritten their venture-build approval protocols to include an explicit governance gate, with named evidence requirements, alongside the four elements McKinsey describes. The gate sits inside the regular budget cycle. It is owned by the audit committee. It does not slow down the build — it sharpens it, by forcing the founding team to validate governance assumptions on the same disciplined cadence as revenue and cost assumptions.

For directors approving new-business build programs in 2026, the question is not whether to add the fifth element. The question is whether to add it before the first product ships, or after the first lawsuit lands.

---

This piece adapts a longer essay from Aegis Studios, the venture studio behind BoardSight, on the governance scaffolding that decides whether new businesses survive contact with their regulatory environment. Source article: McKinsey Digital, "Building new businesses: How incumbents use their advantages to accelerate growth."

Updated June 12, 2026: state-law references revised — Colorado's 2024 AI Act was repealed in May 2026 (narrow ADMT successor regime, enforcement 2027) and Connecticut's CART Act (Public Act 26-15) is cited as the current hard-dated US state anchor; the Clearview AI figure corrected to the settlement/fine record.