Why governance goes out of date
Governance is designed for the organization as it was at a particular moment. Then the business changes. Units are added or merged, people leave, systems are replaced, regulations shift, and the original compromise between central control and local freedom no longer fits.
The signs are rarely dramatic. A committee keeps meeting but decides little. A policy refers to a system that no longer exists. A role description names a job title nobody holds. Because nothing fails outright, the gap widens quietly. Governance reviews exist to catch this drift before it becomes a source of frustration.
Scheduled and triggered reviews
Two kinds of review work well together.
Scheduled reviews
A routine check at a fixed interval, commonly once a year for the overall arrangement, with lighter checks of individual policies on their own cycle. The exact interval is a judgment call: too frequent and it becomes busywork, too infrequent and problems pile up. Put the date in the calendar and name who is responsible for starting it.
Event-driven reviews
Some events should prompt a review regardless of the calendar:
- a merger, acquisition or disposal, which often calls for post-merger integration decisions;
- a major system replacement or migration;
- a significant incident or audit finding;
- rapid growth or contraction;
- a change in regulation or in the organization’s strategy;
- a clear decision to move towards or away from a central model.
What to look at
A review can be organized around the parts of governance described in the overview of governing centralized systems.
Roles. Are owners still in post, and do they have the time and authority for the role? Are there systems or processes with no owner?
Forums. Does each group have a clear purpose and the right members? Are attendance and agenda quality reasonable? Does anything it was set up to do still need doing? A group that has nothing to decide may be ready to merge or close.
Decision rights. Do people still agree on who decides what? Are decisions being escalated unnecessarily, or being made in the wrong place?
Rules. Are policies and standards current, understood and followed? What does the exceptions register show? Are there rules nobody can explain?
Local input. Do units feel heard? Are the advisory groups and request channels still used?
Results. Are decisions timely? Are the problems governance was meant to address improving, staying the same or getting worse? Measuring this properly can be hard, and the same caution applies as with any target: be wary of target side effects when you turn governance health into a score.
Sources of evidence
A review is only as good as what it draws on. Useful inputs often include:
- short interviews or a brief survey of owners, committee members and a sample of users;
- the exceptions register and the request log;
- meeting records: how many decisions, how long they took, how often items were deferred;
- incident and audit reports that point to unclear responsibility;
- the history of recent changes and how smoothly they went.
Be careful with numbers. Survey results from a small group, or counts of meetings, give hints rather than proof. Combine them with conversation, and note what you do not know.
Who should carry out the review
Ideally, someone with a degree of independence from the arrangements being examined, because people are poor judges of their own committees. This might be a person from another function, an internal audit or risk team where one exists, or an outside adviser. In a small business, the owner may do it alongside a trusted manager from a different area. Include voices from units, not only the central team.
Possible outcomes
Reviews should end with decisions, not just observations. Typical results include:
- no change, with a note that the review was done;
- minor adjustments, such as updating a role description or a meeting agenda;
- restructuring a forum or changing its membership;
- moving a decision from central to local, or the reverse;
- retiring or rewriting a policy;
- in larger cases, reconsidering the overall operating model, including whether decentralization or a hybrid arrangement would suit better.
Record what was decided, who will act and when it will be checked. Share the outcome with the people affected; unexplained changes invite suspicion, and a lack of communication around governance changes is a common source of change resistance.
Keeping reviews proportionate
Review has a cost. A light annual conversation among a few people may be right for a small organization. Heavier reviews with interviews and documentation suit complex ones. If the review process itself grows larger than the governance it examines, scale it back.
Reviews also cannot guarantee that governance will be right. They provide a regular opportunity to notice what has changed and to adjust before problems harden. In regulated settings, specific review requirements may apply, and these should be confirmed with qualified compliance advisers.