What the framework actually is
Strip away the vocabulary and corporate governance answers three questions. Who has the authority to decide — and where that authority ends. Who verifies that decisions are executed and risks are controlled. And who is accountable to owners, regulators and society for the outcome. A governance framework is simply the written, working answer to those three questions: not a binder produced for a listing or a tender, but the mechanism the company actually runs on. The test is practical — when a decision above a manager's limit appears, does everyone know where it goes next, and is there a record that it went there?
The seven components
| Component | What it fixes | Typical artefact |
|---|---|---|
| Ownership and board structure | Whose interests rule and who directs | Charter, board composition, independence rules |
| Board committees | Depth on audit, risk, remuneration, nomination | Committee charters and annual plans |
| Delegation of authority | Where each decision is taken | DoA matrix with monetary limits |
| Policy house | Rules of conduct for recurring decisions | Code of conduct, core policies, review cycle |
| Risk management and internal control | How risk is identified, owned and treated | Risk register, appetite statement, KRIs |
| Assurance | Independent confirmation that controls work | Three lines model, internal audit plan |
| Reporting and disclosure | What the board and the market learn, and when | Board pack, reporting calendar, disclosures |
The components are not optional modules; they lock together. A delegation matrix without assurance is trust without verification. Committees without a reporting calendar meet without consequence. A policy of accountability without a delegation matrix names no one.
Governance and resilience: the connection boards miss
Most frameworks cover financial control thoroughly and operational disruption barely. Yet the same three questions apply: who decides to invoke continuity plans, who verifies the plans hold, who answers when the service is down for a week. In mature frameworks the board sets an appetite for disruption, assigns ownership of continuity to a named executive, and reviews exercise evidence the way it reviews audit findings. How that oversight works in practice is set out in the board's role in resilience and in operational resilience board reporting; the regulatory push in this region is described in our CBUAE operational resilience guide.
Building or repairing a framework: the working sequence
- Map decisions before writing documents. List the twenty decisions that matter most and record where each is actually taken today. The gap between practice and paper is the real agenda.
- Fix the delegation matrix first. It is the spine; committees and policies hang off it.
- Give every risk an owner with a name. A register owned by «the risk function» is owned by no one.
- Set the reporting calendar before perfecting the reports. A mediocre report that arrives every quarter beats a perfect one that arrives once.
- Add assurance last, but add it. Whatever is never independently checked will quietly stop working — governance decays silently.
Frequently asked questions
What is a corporate governance framework?
The set of structures, policies and information flows through which a company is directed and controlled: board and committees, delegation of authority, policies, risk oversight, assurance and reporting. It defines who decides, who checks and who answers.
Is one framework right for every company?
No. The components are constant, their weight is not: a family business needs the delegation matrix and succession first, a bank needs risk appetite and assurance depth, a state-linked company needs disclosure discipline. Proportionality is a design principle, not an excuse.
How does governance relate to operational resilience?
Resilience is a governance outcome. The board sets the appetite for disruption, assigns ownership of continuity and reviews evidence that plans hold — the same direct-verify-account loop applied to disruption risk.
One live picture of resilience for the board and the audit committee: a single index, the cost of a downtime day, recovery targets against reality — fed by your own numbers.
Explore the dashboard →