Sharp. Not sentimental.
Same Sector. Same Challenge. One Organisation Decided in Three Weeks. The Other Is Still Consulting.
Two mid-size financial services firms faced the same regulatory guidance update requiring enhanced third-party risk governance. Same sector. Comparable size. Similar governance frameworks on paper.
One firm responded within three weeks. The board had made a specific decision on the governance model change, the taxonomy had been updated to reflect the new requirement, and evidence of the decision was on file. The regulator received a clear, documented response.
The other firm was still in the consultation process six months later. The governance framework review was underway. The taxonomy update was pending the framework decision. The board had been briefed but had not been presented with a decision to make.
The difference wasn’t team quality or organisational size. It was governance architecture. One organisation had built a model that could absorb a regulatory change and produce a decision. The other had built a model that could absorb a regulatory change and produce a review process.
Honest. Not accusatory.
Governance Maturity Isn’t About Framework Sophistication. It’s About Whether the Framework Produces Decisions.
The most common governance maturity error is treating sophistication as a proxy for effectiveness. A complex framework, a detailed taxonomy, a comprehensive committee structure: these are inputs to good governance. They are not evidence of it.
The evidence of good governance is output: decisions made, at the right level, on the right information, with the right accountability, within the timeframe the situation requires. Everything else, the frameworks, the taxonomies, the committees, exists to produce that output.
An organisation at a low maturity level can make good decisions through individual effort and institutional memory. An organisation at a high maturity level makes good decisions because the architecture makes them reliable. The difference shows when the situation changes: a regulatory update, an acquisition, a crisis.
Simple. Not simplistic.
The Four Maturity Stages of Integrated Governance: Where Does Your Organisation Sit?
Four stages describe how organisations develop from fragmented governance activity to integrated decision capability. Most organisations sit clearly in one stage. A few have elements of two.
| STAGE | WHAT IT LOOKS LIKE | WHAT LIMITS IT | HOW TO RECOGNISE IT |
|---|---|---|---|
| 1. Fragmented | Risk management happens in functional silos. Each function manages its own risks, in its own language, with its own reporting. The board sees summaries rather than an integrated view. | No shared taxonomy. No cross-functional escalation. No connected reporting. | The board risk report is a compilation of functional updates, not an integrated risk picture. |
| 2. Developing | A shared taxonomy exists. Governance frameworks are documented. Committees are active. But the connections between layers are implicit rather than designed. | Taxonomy doesn’t feed decision rights. Architecture isn’t embedded in infrastructure. The model works when the right people are in the room. | Governance works well in normal conditions and slows significantly under pressure or leadership change. |
| 3. Connected | Taxonomy, architecture, and infrastructure are designed to connect. Decision rights are explicit. Reporting is built around decision needs. Evidence is generated, not reconstructed. | Integration is designed but not yet tested under stress. Resilience is assumed rather than demonstrated. | The organisation can respond to governance events quickly but hasn’t experienced a high-pressure test of the full chain. |
| 4. Decisive | The full integration chain functions under normal and stressed conditions. Decisions are made reliably, at the right level, with the right evidence, within the required timeframe. Governance is a strategic capability, not a compliance function. | Continuous improvement. The constraint is usually keeping pace with organisational and risk environment change. | The organisation produces decisions faster than its governance framework suggests should be possible. Because the framework was built for decisions, not for reviews. |
Most organisations presenting a mature governance framework to a regulator or board are at stage two. The framework is sound. The connections aren’t. The regulatory update tests the connections, not the framework.
Practical. Not obvious.
Place Your Organisation on the Maturity Scale. Then Name the Constraint.
Read the four stage descriptions above. Place your organisation honestly.
The specific constraint is the starting point. Governance maturity doesn’t advance through general improvement programmes. It advances through specific architectural decisions that close specific gaps.
The organisation that responded in three weeks had made those decisions, one at a time, over several years. The one still consulting had not.
Open. Not pushy.
The Decision Architecture Diagnostic
20 questions that map your governance maturity across five dimensions. The results typically place an organisation between stages two and three on the maturity scale, and surface the specific connections that need to be built to move forward.
Access here →Book a 45-Minute Decision Architecture Conversation
If the placement exercise produced a specific constraint, bring it. A diagnostic session maps the architectural decision required to close that gap and what the next stage looks like in your specific governance context.
Book a diagnostic session →That’s The Decision Layer for this week.
The maturity scale is only useful if the placement is honest. The temptation is to place at stage three because the framework documentation suggests it. The constraint exercise is the honest check.
Forward this to a board governance committee or a CRO preparing for a governance review. The constraint question is the one worth starting with.