ISO 37000 Corporate Governance Manager cheat sheet

ISO 37000 applies to all organizations regardless of type, size, legal form, or sector; it provides principles and guidance, not requirements, so certification is not possible.

Normative references: none. ISO 37000 is self-contained; informative references include ISO 26000 (social responsibility) and ISO 31000 (risk management).

Key term 'governance': the system by which an organization is directed, controlled, and held to account; it encompasses the governing body's roles, relationships, and accountability.

Key term 'governing body': the person(s) or group with ultimate authority and responsibility for the organization's governance, such as a board of directors or trustees.

Key term 'stakeholder': any individual or group that can affect, be affected by, or perceive itself to be affected by the organization's decisions or activities.

Key term 'value generation': the creation of sustainable value for the organization and its stakeholders, including economic, social, and environmental dimensions.

Key term 'purpose': the organization's reason for existence, expressed as the enduring outcome it seeks to achieve for its stakeholders.

ISO 37000 uses 'should' for guidance and 'may' for permission; it is not a management system standard and does not prescribe specific governance structures.

Principle: the governing body should ensure the organization has a clear purpose that aligns with societal expectations and is understood by stakeholders.

Principle: strategy should be derived from purpose and set direction for value generation, risk-taking, and resource allocation.

Principle: value generation should be sustainable, balancing short-term and long-term interests and avoiding value extraction at the expense of stakeholders or the environment.

Decision rule: if a proposed strategy conflicts with the stated purpose, the governing body must revisit either the purpose or the strategy; misalignment is a governance failure.

The governing body should approve the strategy and oversee its implementation, ensuring that performance measures reflect purpose and values.

Value generation includes tangible and intangible outcomes; the governing body should define what value means for the organization and how it will be measured.

The governing body should ensure that innovation and risk-taking are encouraged within boundaries set by purpose, values, and risk appetite.

Principle: the governing body should ensure that the organization's culture and incentives are aligned with its purpose and strategy.

ISO 37000 identifies three governance outcomes: ethical culture, effective performance, and legitimate and trusted engagement with stakeholders.

Governing body role: set direction (purpose, strategy, values), provide oversight (performance, risk, compliance), and ensure accountability (to stakeholders and for the organization's conduct).

The governing body is accountable for the organization's governance and should discharge its role with integrity, competence, and independence of mind.

Decision rule: the governing body must act in the best interests of the organization as a whole, not as a representative of a particular constituency.

The governing body should establish committees (e.g., audit, risk, remuneration) with clear mandates and reporting lines to support its oversight.

The governing body should ensure that the organization's governance arrangements are documented, communicated, and understood throughout the organization.

The governing body should evaluate its own performance and that of its members, and address any gaps in skills, diversity, or independence.

The governing body should ensure that the organization's legal and regulatory obligations are met and that it operates within the spirit, not just the letter, of the law.

A governance framework comprises the structures, processes, policies, and relationships that enable the governing body to direct and oversee the organization.

Design principle: the framework should be proportionate to the organization's size, complexity, risk profile, and sector, and should be tailored to its context.

Implementation steps: assess current governance, design the framework, allocate resources, communicate, train, embed, and monitor.

The framework should define clear roles, responsibilities, and decision rights, including delegation of authority and escalation paths.

The governing body should ensure that the framework is documented and that policies are accessible, current, and consistently applied.

Decision rule: if a governance gap is identified, the governing body should determine whether it is a design flaw or an implementation failure and address the root cause.

The framework should include mechanisms for stakeholder engagement, ethical conduct, risk management, and performance monitoring.

The governing body should periodically review the framework's design and implementation to ensure it remains fit for purpose.

The governing body should identify stakeholders, understand their interests and expectations, and determine which are most relevant to the organization's purpose and strategy.

Engagement should be ongoing, inclusive, and transparent, and should inform decision-making rather than be a one-off exercise.

The governing body should ensure that stakeholder concerns are escalated and addressed, and that feedback loops exist.

Accountability means being answerable for decisions and actions; the governing body should provide an account of its stewardship to stakeholders.

Decision rule: when stakeholder interests conflict, the governing body should make a reasoned judgment based on the organization's purpose and values, and explain the rationale.

The governing body should ensure that grievance mechanisms and whistleblowing channels are available, trusted, and free from retaliation.

The governing body should consider the needs of vulnerable or marginalized stakeholders who may lack a voice.

Stakeholder engagement should be proportionate to the impact of the organization's activities and should be documented.

The governing body should set the tone at the top by modeling ethical behavior and establishing a code of conduct that applies to all members and employees.

Ethical culture is a governance outcome; it requires consistent values, incentives, and accountability mechanisms.

The governing body should ensure that ethical risks are identified, assessed, and managed, and that ethical breaches are addressed promptly and fairly.

Decision rule: if a proposed action is legal but ethically questionable, the governing body should apply a values-based test and consider stakeholder impact before proceeding.

The governing body should ensure that performance incentives and remuneration are aligned with ethical behavior and long-term value creation.

The governing body should promote transparency and openness, and protect those who raise concerns in good faith.

The governing body should ensure that ethics training and awareness programs are in place and effective.

The governing body should review the organization's culture periodically and take corrective action when misalignment with values is detected.

The governing body should establish a risk management framework, including risk appetite and tolerance, and ensure it is integrated into decision-making.

Oversight includes monitoring performance against strategy, risk exposure, compliance, and internal control effectiveness.

Decision rule: decisions should be made with due care, on an informed basis, in good faith, and in the best interests of the organization.

The governing body should ensure that it receives timely, accurate, and relevant information to support oversight and decision-making.

The governing body should define its own information needs and ensure that management provides appropriate reporting.

The governing body should oversee the organization's internal control and audit functions, ensuring independence and adequate resources.

The governing body should consider risk in the context of opportunity, and avoid excessive risk aversion that stifles innovation.

The governing body should ensure that crisis and contingency plans are in place and tested.

The governing body should establish a monitoring and review cycle for governance, including performance indicators, audits, and self-assessments.

Review should cover the governance framework's design, implementation, and outcomes, and should be based on reliable data.

Decision rule: if monitoring reveals a governance deficiency, the governing body should ensure corrective action is taken and its effectiveness is verified.

The governing body should conduct regular evaluations of its own performance, composition, and effectiveness, and act on the findings.

Continual improvement should be embedded in governance processes, using feedback from stakeholders, audits, and performance reviews.

The governing body should ensure that lessons learned from incidents and near-misses are captured and used to improve governance.

The governing body should review the organization's governance arrangements at least annually, or more frequently if circumstances change.

The governing body should ensure that monitoring and review findings are reported to stakeholders as appropriate.

The governing body should ensure that governance reporting is accurate, timely, balanced, and accessible to stakeholders.

Reporting should cover governance structures, processes, performance, risk, and ethical conduct, and should explain how the organization has fulfilled its purpose.

Decision rule: if a material governance issue arises, the governing body should disclose it in a timely manner, even if it is not legally required, to maintain trust.

The governing body should ensure that external reporting is consistent with internal reporting and that it is not misleading.

The governing body should ensure that the organization's reporting meets legal and regulatory requirements and follows recognized frameworks where applicable.

Transparency means being open about decisions, including the rationale for decisions and the trade-offs considered.

The governing body should ensure that stakeholders have access to information about the organization's governance and performance.

The governing body should review the organization's reporting practices periodically to ensure they remain relevant and effective.