I was told to assume that any user getting to that page has an organisation, which is also a product owner requirement as user needs should always have one for ~Maslow reasons~.  Because of this I deliberately didn't protect the code against a missing user-organisation (as it's an indication of a problem not an edge case) and the tests needed to match this (and usage reality).