Corporate governance has become an expensive exercise in documenting responsibility without necessarily establishing accountability. Organisations have committees, risk registers, policies, reporting structures and assurance functions. Yet when something goes wrong, the question of who owned the decision can produce an extraordinary silence. The paperwork is usually immaculate. The ownership is considerably less impressive.
Consider a financial institution introducing a new digital product. Technology confirms the system works. Compliance reviews the regulatory implications. Legal approves the contractual terms. Risk records the exposure. The executive committee receives a presentation and endorses the proposal. Six months later, a serious control failure emerges. Each function can demonstrate participation, but nobody can establish who accepted the residual risk. Everyone attended the meeting. Nobody owned the consequence.
This is not primarily a failure of governance architecture. It is a failure to distinguish participation from accountability. Organisations routinely confuse consultation with approval, oversight with ownership, and reporting with control. These distinctions matter because governance does not become effective merely because several senior people have reviewed a document.
A risk register, for instance, may identify an unresolved weakness in customer data retention. The issue receives an amber rating, an action owner and a target completion date. Three quarters later, the rating remains unchanged, the deadline has moved twice and the responsible executive continues to report progress. The organisation has not managed the risk. It has institutionalised its postponement.
A risk that survives successive reporting cycles without meaningful intervention is no longer simply an operational problem. It is evidence of a governance decision, whether acknowledged or not.
The difficulty becomes particularly pronounced where accountability crosses organisational boundaries. Take a bank whose customer information is processed by a third-party technology provider. Procurement manages the commercial relationship. Technology oversees integration. Information security assesses technical controls. Data protection examines lawful processing. When the supplier fails to delete information after contractual termination, whose failure is it?
The answer cannot be that everyone was responsible. Shared responsibility requires clearly allocated obligations, not diluted accountability. One executive must own the outcome, while individual functions retain responsibility for their respective controls. Otherwise, the organisation has designed a system in which accountability becomes negotiable precisely when it matters.
Boards should be particularly concerned about the quality of management information. A dashboard displaying twelve green indicators may offer less assurance than a candid report identifying three unresolved weaknesses. Colour-coded confidence is not evidence of control effectiveness. Directors need to understand what has been tested, what remains incomplete, which risks have been accepted and what decisions management requires.
Good governance should make uncomfortable information visible early enough for somebody to act.
There are practical remedies. First, assign one accountable executive to every material risk, supported by named control owners and measurable completion criteria. Secondly, distinguish activities completed from outcomes achieved. Delivering training is an activity; demonstrating improved staff behaviour is an outcome. Thirdly, establish escalation thresholds that prevent overdue actions from becoming permanent features of committee papers.
Finally, require decision records to identify the alternatives considered, the risks accepted, the individual exercising authority and the rationale for proceeding. This is particularly important when commercial urgency competes with control requirements. A decision to proceed despite an unresolved risk may be legitimate. A decision nobody can subsequently explain is not.
None of this requires another governance committee. It requires discipline from executives and intellectual honesty from boards. Governance should not be measured by the volume of documentation produced, but by the quality of decisions made and the reliability of controls maintained.
The ultimate test of governance is not whether an organisation can explain its structure when everything is working. It is whether it can identify who was accountable when something failed.
Until organisations confront that distinction, governance will remain what it too often becomes: an elaborate system for distributing responsibility while avoiding ownership.
- business a.m. commits to publishing a diversity of views, opinions and comments. It, therefore, welcomes your reaction to this and any of our articles via email: comment@businessamlive.comÂ
Michael Irene, CIPM, CIPP(E) certification, is a data and information governance practitioner based in London, United Kingdom. He is also a Fellow of Higher Education Academy, UK, and can be reached via moshoke@yahoo.com; twitter: @moshoke
