Kestrel Mutual: one group framework or locally adapted governance?
Kestrel Mutual is a customer-owned insurance group with 2.1 million members, a group board and three regulated subsidiaries in life, general insurance and asset management. Two years ago the group board adopted a 46-page governance framework written by an external consultancy. Each subsidiary was allowed to adapt it locally. A supervisory review has now found that 9 of 22 subsidiary board committees have no written terms of reference, that subsidiary boards report performance to the group chief executive rather than to the group board, and that three different definitions of 'risk appetite' are in use. Internal audit also found that the group board receives subsidiary board minutes six weeks late. The group chair wants the company secretary to 'standardise everything into one framework and issue it as a group policy'. The company secretary is unsure whether the problem is the framework design or how it has been implemented, and whether local adaptation should be eliminated. The next board meeting is in five weeks.
1. Diagnose whether Kestrel's difficulties are mainly a framework design failure or an implementation failure. What evidence would you use, and what does ISO 37000 imply about how much local adaptation is acceptable?
Read the worked answer
Classification. The symptoms point mainly to implementation and operability, not to a missing design. A 46-page externally written framework can be a design artefact, but missing committee terms of reference, reporting to the group CEO instead of the group board, three risk-appetite definitions and six-week-late minutes are failures of embedding, decision rights and monitoring. ISO 37000 treats the governance framework as the way principles are operationalised across the organisation; it must be tailored to the organisation's size, complexity and legal form, and it must make accountabilities clear. Uniformity is not the test; clarity and consistent application of mandatory minimums are.
Evidence to gather. Map each framework element to actual practice: committee mandates, delegation of authority, subsidiary board reserved matters, risk-appetite statements, board-pack timeliness, minutes and action tracking. Interview subsidiary chairs and committee members; test whether they can state their mandate and escalation route. Review the original design for over-complexity and unclear ownership.
Local adaptation. Local adaptation is acceptable where it reflects legal, regulatory or business differences, provided the group sets non-negotiable minimum standards and subsidiary adaptations are documented, approved and reviewed. The problem is undocumented divergence, not adaptation itself. Recommend a single group governance policy containing mandatory standards, a governance map showing where subsidiaries differ and why, and annual attestation by subsidiary chairs. That preserves proportionality while restoring group oversight.
2. The chair proposes issuing the framework as a group policy with no local variation. Assess the benefits and risks of that approach and recommend a decision.
Read the worked answer
Benefits of a single group policy. It would create consistent expectations, simplify assurance, reduce interpretative drift and make it harder for subsidiaries to ignore group standards. It also gives the group board a clear basis for attestation and regulatory evidence.
Risks. A single, non-negotiable framework can conflict with legal-entity directors' duties, local regulatory requirements, different risk profiles and the practical reality of three regulated businesses. It can also produce formal compliance without ownership, and it may push subsidiary boards into a box-ticking posture. The 46-page document suggests the design may already be over-engineered; making it mandatory everywhere could amplify that weakness.
Recommendation. Do not issue the framework as a pure group policy with no variation. Issue a shorter group governance standard with mandatory core requirements: committee terms of reference, subsidiary board reporting lines to the group board, a single group risk-appetite taxonomy, escalation rules and minimum board-pack content. Permit local application only through an approved governance map that explains differences and demonstrates equivalence. Require each subsidiary board to adopt the standard within 60 days, with exceptions approved by the group board and reviewed annually. Fix the reporting line first: subsidiary boards should report to the group board or a group board committee, with the group CEO accountable through that line, not above it.
3. Design a review and assurance cycle that would prevent recurrence, including who should own it and what the group board should see.
Read the worked answer
Ownership. The group company secretary should own the governance framework review process, supported by a governance committee or the nomination committee. Internal audit should provide independent assurance, and subsidiary chairs should attest annually. The group board retains approval of mandatory standards and any exceptions.
Cycle. Use a three-tier cycle: quarterly monitoring of a governance dashboard; an annual framework review covering regulatory changes, subsidiary exceptions and committee effectiveness; and an independent effectiveness review every two to three years, proportionate to the group's size. Each subsidiary should complete an annual governance self-assessment against the group standard, supported by evidence such as committee mandates, minutes, decision logs and escalation records.
What the board should see. A one-page dashboard showing exceptions, overdue actions, late minutes, committee terms-of-reference status, risk-appetite definition alignment, regulatory findings and attestation results. The board should also receive a small number of qualitative indicators: whether subsidiary directors can explain their mandate, whether escalation works in practice, and whether group committees are receiving decisions at the right level. Escalation triggers should include any subsidiary with an unresolved exception for more than 60 days or any material regulatory finding. The board should approve the annual review report and a remediation plan with named owners and dates, and should minute its conclusions so that the assurance trail is visible to the supervisor.