2 Organizational Governance

Governance purpose and structures

Organizational governance is the system by which an organization is directed, monitored, and held accountable. It defines who has authority to make decisions, how objectives and policies are established, how performance and risk are overseen, and how leaders answer to owners and other stakeholders. Effective governance clarifies responsibilities while allowing management to run daily operations.

Governance structures vary according to an organization’s type, size, ownership, industry, and applicable law. A corporation may have shareholders, a board of directors, and executives; a nonprofit may have members or trustees and a governing board; and a public agency may have elected officials, an oversight body, and administrators.

Some companies use a Unitary board, where executive and non-executive directors sit together. Others use a two-tier structure, separating a supervisory board from a management board.

Roles and oversight

Responsibilities across the organization

Owners or members exercise rights established by law and governing documents. These can include electing directors or approving specified fundamental changes.

The Governing body, such as a board or trustees, sets direction, oversees management, approves major decisions, monitors performance and risk, and answers to the organization’s owners or stakeholders. Board committees provide focused oversight: for example, an audit committee may oversee financial reporting, internal controls, and audit, while a risk committee may oversee significant risks. Committees support the governing body but do not automatically take over its ultimate responsibility.

Senior management develops and executes plans within authority delegated by the governing body, allocates resources, manages operations and risk, and reports results and significant issues. Employees and operational leaders carry out work, follow relevant policies, operate controls, and raise concerns or report incidents.

Risk, compliance, and other specialist functions advise and support management, monitor or challenge practices, and report material concerns through appropriate channels. Internal audit provides independent, objective assurance and advice on governance, risk management, and controls. To preserve its independence, internal audit should not assume management’s responsibility for the activities it audits.

Clarifying risk responsibilities

The Three Lines Model is one way to describe how responsibilities relate: operational management owns and manages risks; specialist functions support and monitor risk management; and internal audit provides independent assurance. The model is adaptable rather than a mandatory organizational chart.

Decision-making and delegated authority

Good governance distinguishes oversight from management. The governing body sets or approves the organization’s direction and boundaries, while management makes operational decisions within delegated authority. A board may reserve decisions such as approving strategy, major investments, executive appointments, or significant transactions, while delegating routine purchasing or staffing decisions to managers.

A clear decision process typically:

1. Identifies the decision-maker and the authority under which the decision is made.

2. Defines who must be consulted and what evidence is needed, including financial, legal, operational, and risk information.

3. Considers alternatives, conflicts of interest, and effects on relevant stakeholders.

4. Records the decision, rationale, conditions, and assigned responsibilities when the matter is material.

5. Monitors implementation and outcomes, escalating significant deviations or new risks.

Delegation does not mean abandoning oversight. The governing body should receive timely, reliable information and revisit major decisions when circumstances change.

Policies and governance documents

Policies translate organizational principles and requirements into consistent expectations. They can address ethics, conflicts of interest, financial authority, information security, records, procurement, and reporting concerns. Effective policies state their purpose, scope, responsibilities, required actions, exceptions, and consequences for noncompliance. They should be accessible, communicated, and reviewed periodically and when material changes occur.

Governance documents establish how authority works in practice. Examples include articles or bylaws, board and committee charters, codes of conduct, delegations of authority, approval limits, and reporting protocols. Their requirements should be consistent with applicable law and regulation.

A policy is useful only when people understand it, controls support it, and leaders respond appropriately to violations.

Accountability mechanisms

Accountability means that people must explain their decisions and performance and that appropriate follow-up occurs. Organizations use several complementary mechanisms:

• Clear responsibility and authority: role descriptions, reporting lines, approval limits, and documented delegations.

• Oversight and reporting: regular reports on strategy, financial performance, significant risks, compliance, and control issues.

• Checks and assurance: management monitoring, compliance reviews, external audits where applicable, and independent internal audit.

• Records and transparency: minutes, decision logs, disclosures, and reporting that enable review and traceability.

• Ethics and conduct processes: conflict declarations, protected channels for raising concerns, investigations, and consistent consequences.

• Performance and remediation: evaluation of leaders and governance practices, corrective-action plans, and confirmation that identified problems have been addressed.

For example, if a company delegates supplier selection to a purchasing team, governance arrangements can define spending limits, require conflict disclosures, set competitive-bidding rules, and require managers to report exceptions. Compliance monitoring and audits can test whether these safeguards operate as intended. The board oversees significant patterns or failures without choosing every supplier itself.

Clear decision rights, well-designed policies, reliable reporting, and consistent follow-up help an organization act responsibly and achieve its objectives.