The Framework Nobody Owned
A mid-sized water utility with 2,400 staff has a board-approved governance framework document dated four years ago. It lists committees, delegated authorities and a code of conduct, but no owner is named and no review cycle is stated. Since then the utility has acquired a regional supplier, added a digital services division, and appointed four new directors. The internal audit plan for the coming year cites "governance framework effectiveness" as a review area, and the audit committee chair has asked the company secretary whether the framework is still fit for purpose. The CEO argues the framework is fine because no regulator has raised concerns, and because the last three annual reports describe governance as "robust." The company secretary is uneasy: the delegated authority thresholds in the framework still reference the pre-acquisition structure, and two new subsidiaries are not mentioned at all.
1. Assess whether the existing framework can reasonably be described as fit for purpose, and identify the governance gaps the company secretary should escalate.
Read the worked answer
The framework cannot be described as fit for purpose on the evidence given. Fit for purpose is not the absence of regulator criticism; it is whether the framework still describes and controls how the organisation actually governs itself.
Three concrete gaps stand out:
- Structural misalignment. Delegated authority thresholds refer to the pre-acquisition structure. After an acquisition and the creation of a digital division, authority limits that do not map to the current operating model either block legitimate decisions or, more likely, are quietly bypassed. Either outcome is a control failure.
- Scope gaps. Two subsidiaries are not mentioned. Unlisted entities are where governance frameworks most often fail, because group-level policies are assumed to apply without being formally adopted.
- No ownership or review cycle. A framework with no named owner and no scheduled review decays by default. The four new directors inherited a document they had no role in approving and no obligation to revisit.
The CEO's argument is a category error: external silence is not evidence of internal effectiveness. The annual report language is a disclosure assertion, not a test result.
Escalation should go to the audit committee, framed as a scope and currency issue rather than a criticism of individuals. The company secretary should recommend a named owner (typically the company secretary or general counsel), a defined review cycle with a trigger-based clause for acquisitions and structural change, and a mapping exercise to confirm which group policies the subsidiaries have formally adopted.
2. Recommend how the framework should be refreshed, including sequencing and who should approve the changes.
Read the worked answer
A full rewrite before the audit review would be rushed and would likely produce a document that is again out of date within a year. A staged approach is better.
Stage one - establish the facts (before the audit fieldwork). Map the current legal entity and divisional structure against the framework. Identify every delegated authority threshold that no longer matches an existing role, and confirm in writing which policies each subsidiary has adopted. This is a factual exercise and can be done quickly by the company secretary with finance and legal input.
Stage two - assign ownership and review mechanics. Name a framework owner with explicit responsibility for currency, and build in a review cycle (for example annual confirmation plus a mandatory refresh trigger on acquisition, divestment, or material restructure). This is the change most likely to prevent recurrence and should not wait for the full rewrite.
Stage three - substantive revision. Update delegated authorities, extend scope to all subsidiaries, and align committee terms of reference with the current board composition.
Approval. The board should approve the revised framework, not management, because delegated authority is a board reserve. The audit committee should oversee the process and receive the gap analysis; management should draft. Sequencing matters: doing stage two first gives the audit committee a defensible answer on ownership even if the substantive rewrite runs into the next financial year.