Corporate Governance and Compliance

Corporate governance is the system by which companies are directed and controlled — the structures, processes, and duties through which shareholders, boards, management, and other stakeholders interact. It defines who makes decisions, who oversees whom, and to whom decision-makers are accountable. Good governance is not bureaucracy; it is the architecture that aligns corporate power with shareholder and stakeholder interest, and it is increasingly regulated as failures (Enron, Satyam, Wirecard) drive legal reform.

Compliance is the operational counterpart — the systems that ensure the company meets its legal and regulatory obligations. Governance sets the framework; compliance implements it. The two are inseparable: governance without compliance is aspiration, and compliance without governance is unaccountable process. The late 2020s have added two dimensions: ESG governance (sustainability in the boardroom) and AI governance (board oversight of AI risk), each extending the board's duties.

This page covers board duties, the regulatory frameworks (SOX, Companies Act), ESG governance (CSRD, ISSB), risk management, and the emerging governance of AI.

Directors owe fiduciary duties to the company — the duty of care (informed, diligent decisions), the duty of loyalty (acting in the company's interest, not their own), and in many jurisdictions the duty of oversight (monitoring the company's affairs and ensuring lawful conduct). These duties are the core of governance: they define what directors must do and the standard against which they are judged. Breach can mean personal liability and, in serious cases, regulatory action.

The duty of oversight has evolved significantly. Historically, directors could rely on management's reports absent red flags (the business judgment rule). Recent cases — especially the Caremark line in the US — have established that directors must implement oversight systems and monitor them, and that failure to oversee mission-critical risks (compliance, cyber, safety) can be a breach of duty, even without a specific red flag. The shift is from passive oversight to active monitoring: directors must ensure systems exist and must attend to them.

The practical implication is that boards must structure their oversight — committees (audit, risk, compensation, nominating), regular reporting on key risks, escalation paths, and documented attention. A board that cannot show it oversaw a critical risk is exposed if the risk materialises. The documentation is part of the duty: showing oversight is as important as doing it, because the showing is what demonstrates the duty was met.

The Sarbanes-Oxley Act (SOX, 2002, US) was the post-Enron reform establishing financial governance and controls for US public companies. It requires internal controls over financial reporting (Section 404), executive certification of financial statements (Section 302), audit committee independence, and whistleblower protections. SOX made financial controls a board responsibility and made failures personally consequential for executives. India's Companies Act 2013, strengthened after Satyam, parallels SOX with auditor independence, audit committees, and director duties.

SOX's Section 404 — management's assessment and auditor's attestation of internal controls over financial reporting — is the most operationally demanding provision. It requires documenting and testing controls across the financial reporting process, an annual assessment, and an external audit. The cost is real (SOX compliance costs are significant for large companies), but the benefit — reliable financial reporting and reduced fraud risk — is the foundation of investor trust. The companies that treat 404 as a checkbox miss the point; those that build it as a financial-control programme capture the reliability.

The audit committee is the governance focal point. SOX requires an independent audit committee with financial expertise, responsible for the external auditor and the financial reporting. The committee is where the board's financial oversight concentrates, and its effectiveness is a leading indicator of governance quality. The companies with strong audit committees catch financial issues early; those with weak ones discover them in restatements and enforcement actions.

ESG governance — board oversight of environmental, social, and governance matters — has moved from voluntary to mandatory. The EU's Corporate Sustainability Reporting Directive (CSRD, phased from 2024) requires large companies to report on sustainability matters under European Sustainability Reporting Standards, with assurance. The IFRS Sustainability Disclosure Standards (ISSB, S1 and S2, effective 2024) bring sustainability reporting into the financial-reporting framework. The effect is to make sustainability a board-level governance and disclosure matter, not a marketing one.

The governance implication is that boards must oversee sustainability as they oversee financial reporting — with the same rigour, committees, and accountability. CSRD requires disclosure of governance arrangements for sustainability; ISSB requires disclosure of how governance oversees sustainability-related risks. The board that treats sustainability as a communications matter fails these requirements; the board that treats it as a governance matter meets them. The disclosure makes the governance visible and comparable.

The risk is greenwashing — disclosure that overstates sustainability performance. Regulators are increasingly focused on greenwashing, with enforcement and litigation against companies whose disclosure does not match their performance. The board's duty is not to report favourably but to report accurately, and accurate reporting requires the underlying performance. Governance that produces honest sustainability reporting is the same governance that produces honest financial reporting: oversight, controls, and accountability.

Risk oversight is a core board duty and is increasingly structured. Risk committees (or audit committees with risk responsibility) oversee the company's risk framework, risk appetite, and significant risks. Management owns risk management; the board owns oversight — the distinction matters, because the board's role is to ensure management manages risk, not to manage it. The line is policed by reporting: management reports on risks and risk management; the board assesses and directs.

The risks requiring board oversight have expanded. Financial and operational risk were always within scope; cyber risk, compliance risk, and now AI risk have joined. Each requires board-level attention — not because the board manages them, but because the board must ensure they are managed. The board that ignores cyber risk faces Caremark-style oversight claims; the board that ignores AI risk is building the same exposure for the next generation of cases.

Risk appetite is the governance tool that connects oversight to management. A documented risk appetite — what risks the company will and will not take, and in what measure — gives management a framework and gives the board a basis for oversight. Without risk appetite, oversight is reactive (responding to incidents); with it, oversight is structured (assessing management against the appetite). The documented risk appetite is one of the most valuable governance artefacts a board can produce.

AI is becoming a board-level governance matter, as AI risk (bias, error, privacy, security, reputational) rises and as regulation (EU AI Act, sectoral rules) imposes governance duties. Boards are increasingly expected to oversee AI use — to know where AI is deployed, what risks it creates, and how they are managed — much as they oversee cyber risk. The Caremark logic extends: a board that fails to oversee a critical AI risk may face oversight claims when the risk materialises.

AI governance requires board education (directors must understand AI enough to oversee it), AI inventory (what AI is deployed and where), risk assessment (what could go wrong), and oversight mechanisms (committees, reporting, escalation). The companies that build this governance early — as AI is being deployed — manage the risk as it emerges; those that wait until AI is pervasive face a larger, harder governance gap. The early investment compounds.

The regulatory dimension is explicit. The EU AI Act requires governance for high-risk AI systems; sectoral regulators (financial, healthcare) are issuing AI governance expectations. The board's role is to ensure the company meets these requirements, not to leave them to the CTO. AI governance is a board duty in the making, and the boards that recognise it early — and build the structures to discharge it — will be positioned as the regulation and the risks mature.

Good corporate governance is visible in its structures and practices: an independent, competent board with the right committees; documented oversight of financial, risk, sustainability, and now AI matters; a risk appetite that guides management; controls and compliance systems that are documented and tested; disclosure that matches performance (financial and sustainability); and accountability that makes failures consequential. Each is a component; together they constitute governance.

The culture matters as much as the structures. A board culture of independence, diligence, and candour — where directors challenge management, ask hard questions, and document their attention — discharges the duties; a culture of deference and box-ticking does not. The structures support the culture, but the culture is what makes the structures work. The boards that invest in culture (director training, evaluations, open discussion) govern better than those that invest only in structures.

The ultimate measure is outcomes: reliable financial reporting, well-managed risk, lawful and ethical conduct, and long-term value creation. Governance is not an end in itself; it is the architecture for these outcomes. The companies that build governance for the outcomes — not for compliance alone — produce both the outcomes and the compliance. The companies that build governance for compliance alone produce neither, because they miss that governance's purpose is the company's integrity and performance, not the governance checklist.