Governance Theatre Begins When Compliance Replaces Board Judgement
A control structure built to survive inspection can still fail the people expected to govern through it.
Beyond the Checklist
The programme room contains 68 lever-arch files. Every file is indexed. Every control has an owner. Every owner has signed a statement. A weekly report shows 91 per cent completion, with the remaining items assigned dates and responsible executives.
The audit committee is told that the governance response is on track.
Yet when one non-executive director asks which three control weaknesses could most seriously distort the next set of accounts, nobody answers. The programme manager can describe the documentation status. The finance director can describe the timetable. The auditors can describe the testing approach. No one can convert that machinery into a judgement the board can use.
This is the emerging danger in the present wave of corporate governance reform. Organisations are responding to demands for executive certification, stronger audit committees and more explicit internal control by constructing elaborate compliance programmes. Many of those programmes will satisfy external inspection. Fewer will improve governance.
The difference is not administrative. It is the difference between proving that a process exists and helping a board understand whether the enterprise is under control.
Compliance Has Become the Product
The pattern is already visible. A serious governance concern is translated into a programme. The programme decomposes the concern into workstreams, templates, control descriptions and evidence requirements. Progress is then measured by the completion of those artefacts.
This translation is necessary up to a point. Large organisations cannot test thousands of activities through instinct and conversation. They need common definitions, repeatable evidence and a disciplined record of what has been examined. Without such structure, assurance becomes anecdote.
But the structure creates its own incentive. Once the programme is judged by the number of controls documented, documentation becomes the product. Teams learn to optimise for what can be counted:
- controls identified;
- owners assigned;
- narratives completed;
- tests passed;
- exceptions closed.
Each measure appears sensible. Together they can conceal the central question: does the board now understand the risks and the quality of management’s response better than it did before?
In one composite programme, 24 workstreams produced 312 control descriptions across finance, operations and information systems. By the second quarter, 286 had passed an initial test. The headline result was therefore reassuring. But 47 of the passed controls depended on the same monthly reconciliation, performed by a team of two after data had been extracted from four different systems. The concentration was invisible because each control had been assessed separately. The programme proved the presence of many controls while missing the fragility of the mechanism they shared.
That is governance theatre: not false evidence, but evidence arranged so that activity looks like assurance.
A control structure built to survive inspection can still fail the people expected to govern through it.
The Auditor Is Not the Audience
The most revealing test of a governance programme is to ask who its real audience is.
If the audience is the auditor, the programme naturally emphasises traceability, consistency and proof. It asks whether a control is defined, whether it operated, whether evidence exists and whether an exception was remediated. Those are legitimate questions. External assurance cannot function without them.
If the audience is the board, the questions are different:
- Where is management judgement carrying more weight than the formal control?
- Which failures could combine rather than occur in isolation?
- Where does the organisation depend on one person, one spreadsheet or one late manual adjustment?
- Which exceptions were closed administratively but remain risky in substance?
- What has management chosen not to fix, and why is that choice acceptable?
An auditor needs a defensible basis for an opinion. A board needs a basis for directing, challenging and, where necessary, refusing management’s judgement. The two purposes overlap, but they are not identical.
When the auditor becomes the programme’s principal audience, the board usually receives the residue: a traffic-light summary, a completion percentage and a list of overdue actions. Detail has been compressed before directors have decided which detail matters. The result is paradoxical. The organisation has never possessed more control information, yet the board has little more usable insight.
The Case for Standardisation — and Its Limit
The strongest defence of the present approach is that governance reform must begin with standardisation. Organisations cannot elevate every control issue into a board debate. Directors are not there to inspect reconciliations or review access lists. Management must first create order, and auditors must be able to test that order. Only then can the board rely on a coherent system rather than scattered assurances.
That defence is right about the need for a baseline. It is wrong if the baseline becomes the destination.
Standardisation is valuable because it makes comparison possible. It should expose variation, concentration and exception. But when the process rewards completion, standardisation often suppresses precisely those signals. A control that is unusual is forced into a common template. A risk that crosses functions is split between owners. An unresolved judgement is converted into an action with a due date. The programme gains order by removing the texture that directors need in order to challenge.
The answer is not less discipline. It is a second discipline: one that converts compliance evidence into governance meaning.
From Control Inventory to Board Judgement
A substantive governance response should produce two different views from the same body of work.
The first is the inspection view. It contains the control descriptions, evidence, tests, exceptions and remediation records required for rigorous assurance. It is detailed, systematic and necessarily extensive.
The second is the judgement view. It selects the small number of patterns that materially alter the board’s understanding of the enterprise. It should reveal:
- Concentration — several controls depending on the same person, system, supplier or manual process.
- Override — points where management can bypass the normal process, even legitimately, and how that discretion is supervised.
- Recurrence — exceptions repeatedly closed and reopened under different descriptions.
- Interdependence — risks that appear modest alone but become serious when combined.
- Accepted exposure — weaknesses management has deliberately chosen to tolerate, with the reason made explicit.
This second view cannot be generated by adding up passed controls. It requires interpretation. Someone must look across workstreams, challenge the classification of issues and explain why the pattern matters to decisions now before the board.
That responsibility cannot be delegated entirely to the programme office. Programme teams are designed to drive completion. Nor can it be handed entirely to external auditors, whose independence and formal remit impose necessary boundaries. Executive management must own the interpretation, and non-executive directors must test it.
A useful board discussion would therefore begin not with the percentage complete, but with three judgements:
- What has the work revealed that management did not previously understand?
- Which exposures remain because they are difficult, expensive or disruptive to remove?
- What decision does the board need to make differently as a result?
If a governance programme cannot answer those questions, its apparent maturity should be treated with caution.
The Test of Substance
The current reforms are forcing organisations to do work that many should have done earlier: define responsibilities, document controls, strengthen audit committees and make senior executives more explicit about the reliability of financial reporting. That is progress.
But regulation can compel evidence more readily than it can compel judgement. The danger is that organisations will meet a profound failure of governance with an industrial response to paperwork. They will construct structures that are complete, testable and professionally administered, then assume that these qualities amount to control.
The real test is simpler and more demanding. Can directors see where the enterprise is fragile? Can they understand where assurance depends on judgement rather than routine? Can they identify what management has accepted, deferred or failed to connect? Can they use the information to challenge a decision before the next failure makes the weakness obvious?
Governance is not strengthened when the file is complete. It is strengthened when the board can see, question and act on what the file reveals.