Governance Theatre: Why Compliance Structures Satisfy Auditors but Fail Boards
A board can be surrounded by evidence and still be starved of truth.
The Meeting That Passed
At 8:12 on a Tuesday evening, an audit committee reaches the final item in a thick board pack. The finance director points to a schedule of 146 controls. One hundred and thirty-nine are marked complete, five are awaiting evidence, and two have been referred to the internal audit team. The committee notes the progress. The minutes record that the control programme has been reviewed. Everyone leaves with the agreeable sense that governance has occurred.
Yet the question that matters has not been asked. A new revenue arrangement, negotiated at quarter-end, depends upon assumptions that the sales director cannot explain and the financial controller has challenged in writing. It appears nowhere among the 146 controls because it is not a failed procedure. It is a difficult judgement.
This is the central danger in the present governance response. In the wake of spectacular failures of financial reporting, boards and management teams are rightly rebuilding confidence. The Sarbanes-Oxley Act has made executive certification, audit committee responsibility and internal control impossible to treat as secondary matters. But the very urgency of the response creates a temptation: to construct compliance structures that are visible, countable and auditable, then mistake those structures for effective governance.
A board can be surrounded by evidence and still be starved of truth.
Why Theatre Is So Persuasive
Governance theatre is not usually cynical. It is more often the rational product of several pressures acting together.
Investors want proof that the weaknesses exposed over the past two years are being addressed. External auditors require a dependable account of who performs which control and where the evidence resides. Directors, newly conscious of their personal responsibilities, want assurance that no material gap has been overlooked. Management wants a programme that can be planned, staffed and reported.
Formal structure answers each demand. Charters can be approved. Independence can be declared. Control descriptions can be catalogued. Certification can be obtained. Exception counts can be reduced from one month to the next. These things are necessary, and that necessity is precisely what makes the theatre difficult to detect.
The trouble begins when the artefact becomes a substitute for the conversation it was meant to support. A committee charter may define access to management, yet the chairman may still allow the finance director to answer every question. A whistleblower procedure may exist, yet reports may be routed through the same line management whose conduct is in question. A control matrix may assign an owner, yet that owner may have neither the authority nor the understanding to challenge the transaction.
The mechanism is simple. What is easy to evidence receives attention; what depends upon judgement is displaced. Over time, the organisation optimises for the inspection of governance rather than for governance itself.
Compliance is the floor of governance, not its operating purpose. The test is not whether the required structure exists, but whether it changes what is questioned, decided and stopped.
The Map Begins to Replace the Territory
Consider a composite public company preparing for more demanding internal-control scrutiny. It establishes a central compliance office of eight people. Over twelve weeks, the team interviews process owners, produces 312 control descriptions and asks each owner to sign that the description is accurate.
The work uncovers genuine weaknesses. Bank reconciliations are late in two units. Access to the general ledger is too broad. The consolidation team relies on undocumented adjustments. Remediation is appropriate.
But the reporting rhythm soon changes the work. Every Friday, business units must submit percentages for documentation completed, controls tested and actions closed. The central office spends Monday challenging the figures and Tuesday preparing a presentation. A unit with 94 per cent documentation complete is described as behind plan; another at 100 per cent is described as secure.
In the second unit, however, the managing director can override credit limits, authorise unusual sales terms and press the local controller to recognise revenue before acceptance. None of those actions appears as an open control deficiency. The prescribed approvals are present on paper. The weakness lies in the power surrounding them.
The board receives twenty-two pages on completion rates and half a page on significant judgements. The numbers are accurate. The assurance is false.
This is how theatre acquires momentum:
- Visibility attracts governance attention. Counts and milestones travel cleanly through a hierarchy; uncertainty does not.
- Responsibility migrates to specialists. The compliance office becomes the apparent owner of controls that can only be owned by line management.
- Testing narrows the field of concern. Once the programme defines the control population, matters outside it struggle to appear important.
- Completion becomes success. The organisation celebrates documented procedures even where behaviour remains unchanged.
The effect is not merely administrative waste. It changes what reaches directors. A board that asks mainly whether the programme is on schedule will receive scheduling information. A board that asks where management judgement could distort the accounts will receive a different kind of truth.
The Strong Case for Formalism
There is a serious objection to this argument. Informal governance, after all, has failed badly. Appeals to character, experience and a trusted relationship with the chief executive proved inadequate. If directors now insist upon documented controls, independent audit committees, explicit certification and a trail of evidence, they are not indulging bureaucracy. They are repairing a system in which too much depended upon personal assurance.
That objection is right. The answer cannot be a return to the gentlemanly boardroom in which a confident explanation substitutes for verification. Nor should every demand for evidence be dismissed as box-ticking. A control that leaves no evidence may not have been performed; a committee without a clear mandate may not act when pressure arrives.
Formalism provides memory, consistency and accountability. It makes responsibilities less dependent upon personalities. It enables challenge by someone who was not present when a decision was taken. It also gives regulators and shareholders a basis on which to distinguish assertion from action.
But formalism is a scaffold. It becomes dangerous when it is treated as the building.
A sound control structure can show that an approval was obtained. It cannot, by itself, show whether the approver understood the commercial substance, had access to dissenting information, or felt free to say no. An independent director may satisfy every definition of independence and still be intellectually dependent upon management’s account of events. Certification may concentrate the mind, but a signature cannot improve information that has been filtered on its way upward.
The strongest case for compliance therefore leads not to less formality, but to a more demanding test of it: what behaviour does this structure make possible, and what behaviour does it constrain?
Where Responsibility Quietly Disappears
The pattern that recurs is a transfer of moral responsibility into procedural ownership.
The board asks the audit committee. The audit committee asks the external auditor. The external auditor explains the scope of its work and refers operational controls to management. Management asks the compliance office. The compliance office asks the named control owner. Each hand-off is defensible. Collectively, they can leave the original question unanswered.
This diffusion is most acute when the matter involves judgement rather than breach. If a reconciliation was not performed, ownership can be established. If a provision rests upon an optimistic assumption supported by incomplete evidence, responsibility is harder to locate. The issue crosses accounting, commercial judgement, incentives and leadership conduct. It belongs to everyone, which often means that no one holds it long enough to decide.
A functioning board interrupts this chain. It does not try to perform management’s work or the auditor’s work. It identifies the questions that cannot safely be delegated:
- Where could a reasonable accounting judgement be influenced by the need to meet a forecast?
- Which senior executives can override ordinary controls, and how would the committee learn that they had done so?
- What concerns were raised below executive level, and what happened to the people who raised them?
- Which assurance rests on management representation rather than independent evidence?
- What is absent from the report because no established category exists for it?
These questions are not additions to a compliance programme. They are the means by which the board governs the programme.
From Assurance Packs to Governing Conversations
The practical distinction is visible in the design of the board’s work.
| Theatrical assurance | Governing substance |
|---|---|
| Reports how many controls are documented | Explains which judgements could materially alter the accounts |
| Names a control owner | Tests whether the owner has authority to resist pressure |
| Records that a challenge occurred | Shows how the challenge changed or confirmed the decision |
| Treats exceptions as defects to close | Distinguishes clerical defects from signals of conduct or incentive |
| Uses the auditor as a source of comfort | Uses the auditor as one source of independent challenge |
| Measures programme completion | Measures whether information reaches the board unfiltered |
The shift need not produce a larger board pack. It often produces a smaller one.
In one composite sequence, a committee replaces a thirty-page monthly control report with a six-page assurance memorandum. The first page states the three judgements most capable of moving reported earnings. The second records disagreements among finance, commercial management and the auditors. Two pages describe control failures, but separate routine exceptions from failures that indicate management override. The final pages list decisions required and matters to revisit.
The number of reported controls falls from 287 to 41 key controls. This does not mean that the others disappear from management’s system. It means the board stops pretending that it can govern hundreds of controls by reading their status. Internal audit and management retain the detailed schedules; directors concentrate on the points where control, incentive and judgement meet.
At the next meeting, a disputed revenue treatment occupies forty minutes. The committee asks the commercial director, not only the finance director, to explain the underlying bargain. It requests the written objection raised by the divisional controller. The treatment is changed before the accounts are finalised. Nothing dramatic occurs. No investigation follows. The value lies in a decision altered while it can still be altered.
That is the quiet substance of governance. Its strongest evidence is not a completed form but a consequential change in action.
“The purpose of assurance is not to make uncertainty disappear. It is to make uncertainty discussable before it becomes damage.”
The Board’s Irreducible Work
We should be wary of romanticising judgement. Judgement can shelter prejudice, loyalty and self-interest. The answer is disciplined judgement: informed by evidence, exposed to dissent, recorded clearly and revisited when assumptions change.
For boards, that requires three linked disciplines.
- Protect the route by which unwelcome information travels. Access to the audit committee matters only if employees, internal auditors and financial controllers can use it without passing through the authority they may need to question.
- Connect controls to incentives. A technically sound process may fail when remuneration, market expectations or personal standing reward a particular answer. Control evaluation that ignores incentive examines the lock and overlooks the person holding the key.
- Record the substance of challenge. Minutes need not become transcripts, but they should reveal the issue, the competing interpretations, the evidence requested and the decision reached. A minute stating that a matter was discussed proves attendance, not governance.
These disciplines also clarify the proper place of specialists. Lawyers, auditors and compliance staff can design, test and advise. They cannot carry the board’s judgement for it. When directors ask a specialist whether the organisation is compliant, they may receive a careful answer to a narrow question. Directors must still decide whether the organisation is being governed well.
What Will Count as Reform
The present reform effort will be judged too generously if success means that companies possess more committees, longer charters and better indexed control files. Those are visible signs of response, not proof of renewal.
The deeper test is whether a difficult fact can move from the edge of the organisation to the centre of a board discussion without being softened into a status category. It is whether an executive’s confidence can be separated from the evidence supporting it. It is whether a director can hold open an uncomfortable question after every adviser has explained why it falls just outside the adviser’s remit.
Governance theatre persists because it is reassuring to all parties. Management can demonstrate activity. Directors can demonstrate oversight. Auditors can inspect a defined system. Regulators can point to formal obligations. No one needs to admit that effective governance is less tidy: it requires judgement under uncertainty, conflict among credible people and the willingness to stop a profitable course of action before failure makes the decision obvious.
The post-Sarbanes-Oxley settlement has an opportunity to strengthen corporate life precisely because it insists upon greater responsibility and evidence. But its promise will be lost if organisations respond by manufacturing assurance faster than boards can exercise judgement.
Structures matter. Controls matter. Independence matters. Yet none of them governs. People govern when they use those structures to surface what is inconvenient, test what is uncertain and change what would otherwise have happened.
That is the line between compliance that satisfies inspection and governance that deserves confidence.