Organisational Governance Is About Decisions, Not Compliance

Organisational governance is treated as reporting and compliance when it should control who decides, what they must check before committing, and how the organisation knows whether that decision worked. Most of what passes for governance is ceremony. The judgement calls happen elsewhere.

When a board tells somebody to sort out organisational governance, what they usually mean is that the organisation feels out of control and the paperwork has started breeding faster than the judgement. The trouble is that most of what passes for governance advice is really advice about reporting and compliance. So much governance ends up as ceremony.

Organisational governance is the system that determines who makes each decision, what they must consider before committing, and how the organisation knows whether that decision worked.

I start there because it defines governance by what it must do. If a governance system does not help people make sound commitments, it may look impressive to auditors, but it is not doing the work. Before submitting an accreditation self-study, compare its claims with current operating evidence and the commitments needed to sustain them.

Click to expand

What is organisational governance?

Corrective work after a regulatory inspection needs continuing checks after the response is accepted. For shipment findings, the follow-up to a customs audit matches the proposed response to the product and transaction records supporting the assessed entry.

Organisational governance controls who can commit the organisation, on what basis, and with what follow-up. In practice it means deciding who may commit the organisation, what basis they need, and what monitoring follows.

Governance reaches further than the board pack. It covers who has authority to commit the organisation on any given matter, what challenge those decisions must receive, what records capture the reasoning, and what monitoring follows. When any of those elements is missing, the governance structure is partial. When all of them work, the organisation has genuine control over its commitments. A contract review needs the same handoff: reviewed obligations must reach the people who will perform and check them. Before licensing an asset, the follow-up to an IP audit traces the right required for the offer to its creator and transfer documents.

Most organisations dodge this. They talk about governance as if it were mainly oversight from above. It is not. It is about shaping the conditions under which decisions are made throughout the organisation. A board does not govern by being informed after the fact. It governs by ensuring the organisation has a reliable way of deciding.

I have had board chairs ask me to "fix governance" when what they really wanted was proof that the existing system could still be defended. Wrong starting point. The first question is whether the apparatus helps anyone decide well. If it does not, you have a control problem disguised as a documentation problem. Before adopting a board-practice remedy, the follow-up to a board evaluation compares the finding with meeting evidence and sets a follow-up check.

Why governance feels like paperwork

Identify decisions that rely on unreliable evidence after a forensic audit before using those inputs again.

Governance feels like paperwork because most governance frameworks were built backwards. They start with what must be reported to the board or the regulator, then push that reporting requirement down through the organisation until everybody is feeding the machine. The machine gets mistaken for governance. For shared business data, the follow-up to a data governance maturity assessment connects authority over definitions to the decision that uses them.

That is the heart of the governance vs compliance confusion. Compliance may be necessary. A compliance obligation tells you what must be demonstrated, not how a good decision is reached. The organisation ends up producing things that look respectable in a file while the actual decision on the desk remains muddy. A risk register does not help you decide because it was never designed to. The whole risk management millstone stays in place because too many interests are aligned behind it.

I have had people say, "Grant Purdy, you are too hard on risk management." Not hard enough. Risk management, as usually sold, is a belief system. It starts with the answer rather than careful definition of the problem. The language in COSO ERM during COVID-19 is a vivid example: an entire framework retrofitted to a crisis, and the Decider is still left with the hard part untouched. If "risk management" is the answer, what was your question? Most organisations never defined the question. They inherited the answer.

The answer stayed because insurers and directors had financial reasons to sponsor more visible controls, and consultants discovered a handsome living in promoting the paraphernalia. Once those interests merged, the edifice took on an air of nobility it had never earned. Organisations ended up with risk committees, appetite statements, and reporting frameworks with twelve tabs, behaving as if the artefact had magic properties.

A reporting requirement is never a good reason to call the exercise organisational governance. That is why apparently sensible questions such as should internal audit perform risk assessment are often asked backwards. Internal audit can test whether the organisation's arrangements are working. If nobody has first defined governance as the system for making sound commitments, audit is left inspecting scenery. The question then becomes what to do after an internal audit when the findings rest on assumptions nobody tested. The same blind spot appears in external quality audits: teams close nonconformities after an ISO 9001 audit without asking whether the auditor's sample represented how the system actually runs. Environmental certification carries its own version: the decision after an ISO 14001 audit is which operating changes will reopen the significant-aspects register before the next auditor arrives. Safety certification has the same edge: after an ISO 45001 audit, the question is whether the hazards the system was built to find include the ones capable of serious harm. A clean opinion after a SOX compliance review carries the same limit: it confirms the controls ran as designed, not that the numbers describe the business. A decision after a financial audit also needs its assumptions matched to the scope of the audit evidence.

Before payment-system attestation, the follow-up to a PCI DSS assessment compares a live payment route with the assessed data-flow diagram.

Keep an effectiveness check beside the corrective action being closed after an ISO 27001 audit.

Look at what the apparatus actually produces. It produces a file that will hold up if someone asks questions later, and it does that well. It tells you nothing about whether the person who signed off understood what they were committing the organisation to. That is the difference between governance versus compliance. Where the two are treated as one thing, the review reads the file, the file was written for the review, and nobody goes near the decision. Follow-up after an inventory audit distinguishes a verified stock balance from stock that can serve the next demand.

Match the coverage of sustainability research to the intended investment decision or public claim after an ESG assessment.

Ethics suffers the same fate. A values statement is the most respectable paperwork an organisation owns, and it defends nobody once a decision is questioned. The connection between business ethics and decision making only becomes real when someone is named on the call and the reasoning is written down before the outcome is known.

Governance is not management

A management response after a government audit needs evidence that its actions address the findings. For a tax dispute, the follow-up to a tax audit puts each disputed amount beside its source records and response deadline.

Set the evidence required before making the next cash commitment after an external audit.

Governance is not management, though organisations constantly blur the line. Governance sets the conditions for good decisions. Management works within those conditions to run the business and execute.

If your governance layer is just more management, you have two copies of the same thing. One tries to run the business. The other pretends to supervise by doing the same job more slowly and with less context. If management is expected to invent its own decision rules every time, governance has abdicated.

I put the distinction bluntly. Governance controls how the organisation is steered. Management lives inside those controls. When the line dissolves, the damage shows up in committees. A board sub-committee asks operational questions it has no business running. Executives create another sub-committee to second-guess managers without clarifying authority. Collective activity increases, ownership decreases. Collective decision making fails when no one takes ownership, and that is exactly what happens when governance and management collapse into each other.

Organisational governance does not manage the plant or the sales team. It ensures the people running those things know what authority they have, what challenge is expected, and what must be monitored after they act. That is control. For a separation, the follow-up to a carve-out analysis checks that essential services have funded replacements.

The practical test I use for any governance system is whether someone can name the person who owns the decision in front of them. If nobody can, the distinction between governance and management has collapsed. I lay out that test and the four signals that it has broken down in governance vs management at the point of decision.

When an IT audit finds a control across systems, name who can change it and what evidence closes the finding after an IT audit. Before disclosing valuable information, the follow-up to a trade secret audit checks its approved recipients and the protection needed for the intended use.

Pick one governance cycle and test whether it produces a decision or just produces paper. Start the Walk →

Who decides, who challenges, who monitors

A reliance decision after a SOC 2 audit needs the customer controls matched to the report scope.

Check agency-specific evidence and responsibilities before relying on a cloud service after a FedRAMP assessment.

A regulatory outcome creates work that must be assigned and checked. The response after an enforcement action turns corrective commitments into recurring evidence checks.

Sound organisational governance must settle who decides, who contributes challenge before the decision, and who monitors after it. Before product launch, the follow-up to a freedom-to-operate analysis compares the version reviewed by counsel with the activity scheduled for release.

The first question is authority. In Deciding, Roger Estall and I used the phrase "the authority of the Decider to make the decision" because most organisations skip this and pay for it later. If authority is vague, the decision will be made anyway, only by drift or exhaustion rather than by design. Start with a decision rights framework: write down who can make which calls. One person, the Decider, must own it. The same question applies to who owns it next. A succession plan names successors for critical roles, and the work after succession planning is testing whether the readiness ratings behind those names would hold if the seat fell vacant tomorrow. The chief executive's seat is the board's own call, and the check after CEO succession planning is whether the candidate specification describes the decisions the next CEO will face or only the strategy the current one set. Before releasing changed customer terms, the follow-up to a terms of service review checks the notice customers will receive and what happens if they decline.

After an issued decision, the follow-up to a dispute adjudication starts with counsel marking the required actions and deadlines.

The second question is challenge. Participants should be chosen because they know something relevant or can puncture bad thinking. Committee habit is not a reason. A great deal of supposed collaborative decision making is only a way of spreading risk to reputation. Real collaboration still needs one Decider; otherwise the discussion produces heat and deniability, not a decision. For board appointments, the follow-up to a board skills matrix turns capability ratings into a nomination brief grounded in demonstrated work. Before relying on transaction advice, the follow-up to a fairness opinion compares the assessed terms and shareholder groups with the final agreement.

For excavation or foundations, the follow-up to a geotechnical investigation brings the ground assumptions to the designer before work is authorized.

The third question is monitoring. Many governance models quietly become absurd at this point. They ask for a report, file the report, and assume control has occurred. Monitoring has no value unless the results reach somebody competent and authorised to act. If the report goes to somebody who cannot interpret it or cannot change anything, the monitoring is ornamental. The most common failure is the gap between monitoring and action. Data gets collected because a policy demands it. The report gets filed. Nobody with authority reads it. After a whistleblower investigation, findings need an independent route to the person who can authorize a response. The next decision after an environmental impact assessment must stay within the assessed activity and its conditions.

Accountability matters inside governance because a system that names authority but not follow-through is unfinished. A system that monitors but does not authorise action is theatre. Good accountability in leadership begins before the decision is made and continues through monitoring of the assumptions on which it rested.

Structure is the arrangement that makes one person own the live call and keeps challenge attached while the call is still open. When that arrangement is missing, every layer of assurance just protects the people who built the maze. A closer look at governance structure shows what the chart must actually contain. None of it survives contact with staff unless the call is written down while it is still open, which is the practical business of making decisions transparent at work.

What governance failure actually looks like

Changes between reporting cycles matter after a double materiality assessment; each finding needs a reason to reopen.

Governance failures are rarely failures of structure. The structure was there. The policies were there. None of it helped anyone decide when it mattered.

The Australian Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry (2017-2019) exposed this at national scale. Commonwealth Bank, AMP, and NAB had boards, risk committees, and constant reporting. Commissioner Hayne found that the institutions had prioritised revenue over the interests of their customers. Staff at Commonwealth Bank sold products customers did not need. At AMP, fees were charged to a dead adviser's account for a decade. In each case the governance apparatus monitored reports, not the quality of the decisions those reports were supposed to reflect. Nobody with authority said clearly and in time: this must stop. For continued customer access, the follow-up to a KYC review matches the final customer finding to evidence that supports the account decision.

At the human level, these are not exotic failures. They are cognitive biases in business dressed in formal titles. Sound judgment in leadership erodes when the system rewards compliance over candour. The decision fatigue examples are visible in every governance failure: weary shortcuts that compound the damage.

Then the institution stalls. Analysis paralysis in business takes hold as committees debate without deciding, and people defend what they built long past the point of usefulness. The sunk cost fallacy examples in governance are everywhere because nobody likes admitting the expensive apparatus never did what it claimed.

A client case from food manufacturing shows the same pattern at operational scale. The plant had precautionary biological-count testing. Routine, well-documented, externally audited. Over eighteen months the instruments drifted out of calibration. Nobody noticed because the monitoring system measured whether tests were performed, not whether the instruments doing the testing were still accurate. Contaminated water reached the product before anyone asked the underlying question. Revenue and reputation followed it out the door.

Every governance failure I have cared about has this structure. The organisation did not fail because it lacked a form. It failed because the form did not force a live human being to respond when the basis of the decision shifted.

That pattern repeats across sectors and continents. I have written about governance failures that survived inside fully functioning oversight structures because the apparatus measured activity, not the decision it was supposed to protect.

What a governance framework should actually do

Payment decisions after an FCPA compliance review need the actual route to the intermediary examined.

Privacy readiness involves decisions about actual processing and supplier relationships. The check after a GDPR readiness assessment names the conditions for proceeding. For an international data transfer, the follow-up to a transfer impact assessment matches unresolved findings to the recipient in the live contract and sets review conditions.

A governance framework should make the next decision better. If it does not, it is decoration or a compliance shield.

The clearest scaffold I know is the Universal Decision-Making Method. It asks five questions: what is the decision, what are the options, what assumptions are we making, are we certain enough to commit, and who will monitor? If an organisational governance framework cannot support those questions, it is not controlling the organisation in any useful sense.

I am wary of any governance model that favours visibility over clarity. If the model does not keep accountability on the person who decides, it is a courier service.

Plenty of tools exist for parts of the problem. A RAPID decision-making framework sorts roles, a decision record preserves reasoning, and the IIA Three Lines Model separates advisory from assurance. Collaborative decision-making models describe how groups contribute. None of those answers the hardest governance question: has the person with authority considered enough to commit?

The range of decision-making frameworks keeps growing. Organisations do not need another management faith. They need a method that helps human beings decide under uncertainty. A governance framework worth having says who decides, makes assumptions visible before approval, and specifies who monitors and what they are authorised to do when reality shifts. If your existing framework cannot do that, do not be sentimental about it. Most boards already have one on paper, which is why the test that matters is whether the framework ever leaves the shelf.

If you are comparing specific layouts, the test is the same. Three Lines, RACI, Delphi all promise oversight, but a governance model that works keeps accountability with the person who decides, not the committee that reviewed. The same test settles whether an approval means anything, which is why someone has to challenge the business case before approval rather than admire the pack.

Workforce changes can reopen a pay decision. What to do after a pay equity audit connects corrections to repeated checks as the workforce changes.

A climate commitment also needs a delivery decision. What to do after a net-zero target checks whether near-term work has enough delivery evidence to justify the commitment.

How to know if your governance is working

Closing a finding after a supplier audit needs evidence that the affected worker received the remedy.

Quality findings need outcome evidence after the corrective work is marked complete. The follow-up after a quality audit defines when a closed finding needs another review. The action agreed after a management review also needs a responsible manager and an operating result that would return the decision to management.

Put one live decision on the table and test the system against it.

1. Who is the Decider for this decision, and what must that person consider before committing the organisation?
2. Which assumptions are visible now, and what would make us revise or stop if those assumptions fail?
3. Who will monitor the result, and is that person competent and authorised to act on what they see?

Those questions are a practical translation of these five steps. If your organisational governance cannot answer them on a real decision, your problem is not missing policy language. Your problem is that the organisation is not actually controlled where it matters. A governance audit that checks the paperwork but never puts a live decision through this test has not tested anything; what to do after a governance audit comes down to running that check before the remediation plan reaches the board.

That is the challenge I would put to any board or chief executive who says they want governance sorted out. Put one significant decision on the table. If the system cannot say who decides or trigger action when reality shifts, stop repairing the paraphernalia. Rebuild how the organisation decides.

---

Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.