A bank can have policies, committees, charters, reporting structures, independent control functions and documented approval processes.
It can meet regulatory requirements.
But does that automatically mean it is well governed?
Not necessarily.
Compliance establishes essential standards and boundaries.
Governance determines effectively leadership operates within them.
And the difference between the two often becomes visible not in the framework, but in the decisions.
THE SIGNAL - Strong Frameworks Do Not Guarantee Strong Governance
Banking governance has become increasingly structured.
Boards operate through defined mandates. Committees have formal responsibilities. Risk appetite frameworks establish boundaries. Control functions provide independent oversight. Policies define authorities and escalation requirements.
These structures are fundamental.
But structure alone cannot tell us whether governance is working effectively.
A board may receive all required reports yet spend insufficient time challenging their implications.
A committee may meet according to schedule yet repeatedly discuss the same issues without resolution.
A policy may clearly define escalation while organizational behaviour discourages people from escalating concerns.
A risk appetite framework may be approved while major decisions are still made largely outside its influence.
Everything may appear correct on paper.
The question is whether it works in practice.
THE BLIND SPOT — When Governance Becomes a Checklist
- Compliance can be verified.
- Was the policy approved?
- Did the committee meet?
- Was the report submitted?
- Was the limit monitored?
- Was the required disclosure made?
Governance is harder to assess because many of its most important qualities are behavioural.
- Was the right question asked?
- Was management genuinely challenged?
- Did directors receive the information early enough to influence the decision?
- Was an uncomfortable issue escalated quickly?
- Did independent control functions have sufficient authority?
- Did leadership act when warning signs emerged?
- A checklist can confirm that a governance process exists.
It cannot always tell us whether that process has influence.
THE LEADERSHIP QUESTION - Is Governance Changing Behaviour?
For boards and senior management, one of the most useful tests of governance is therefore relatively simple:
What changes because this governance framework exists?
Does risk oversight alter strategic decisions?
Does challenge improve proposals before approval?
Does escalation happen earlier?
Do lessons from incidents change future behaviour?
Do committee discussions lead to clear ownership and action?
Do control functions influence decisions when their view differs from the business?
If governance rarely changes an outcome, leadership should ask whether the institution has built an effective governance system. or primarily an effective governance process.
MY LENS - Governance Lives in Behaviour, Not Documents
Across my years in risk management, one distinction has remained important:
Compliance can demonstrate that the required structure exists. Governance demonstrates whether that structure has influence.
Both matter.
This is not an argument for less regulation, fewer policies or lighter controls.
It is an argument for looking beyond them.
Strong governance becomes visible when a board challenges assumptions before approving a strategy.
It appears when a CRO can raise a difficult concern without hesitation.
It appears when management escalates a problem before the numbers force escalation.
And it appears when lessons from failure are translated into changed behaviour rather than another policy.
That is when governance moves from documentation to culture.
FROM INSIGHT TO IMPACT - Five Tests of Governance Effectiveness
1. Test influence, not only existence
Do not ask only whether the committee, policy or framework exists. Ask what decisions it has materially influenced.
2. Examine recurring issues
If the same issue appears repeatedly in board or committee papers, ask whether governance is producing action or simply producing reporting.
3. Look at escalation behaviour
Strong governance should make early escalation easier—not something people avoid until evidence becomes undeniable.
4. Protect independent challenge
Risk, compliance and internal audit add greatest value when they can challenge constructively and independently, including when their conclusions are inconvenient.
5. Follow decisions to outcomes
Board oversight should not stop at approval. Significant decisions should be revisited to determine whether assumptions remained valid and intended outcomes were achieved.
THE BOARDROOM QUESTION
At the next governance discussion, I would ask:
“If we removed the policies, committee names and reporting templates from view, what evidence would show us that this institution is genuinely well governed?”
The answer should be visible in behaviour.
- In how decisions are challenged.
- In how quickly concerns are escalated.
- In whether accountability is clear.
- And in whether leadership is prepared to change direction when the evidence changes.
Because the strongest governance frameworks are not those that simply satisfy requirements.
They are the ones that influence what people actually do.
Compliance creates the foundation.
Governance must turn that foundation into better decisions, stronger accountability and sustainable institutional behaviour.
Dr. Nasreen Al Qaseer
Risk Management Expert
THE RISK LEADER’S LENS
Leading with Insight. Governing with Impact.
#CorporateGovernance #Compliance #BoardEffectiveness #RiskCulture #RiskManagement #Accountability #Banking #RiskLeadership #TheRiskLeadersLens