The founder-led fintech that wants an ISO 37000 certificate
NovaPay is an eight-year-old payments firm with 1,200 staff, operations in 40 countries and a Series D valuation of USD 2.3 billion. Its nine-person board is chaired by the founder, who is also CEO. Four directors are former executives who reported to the founder; two represent lead investors; two are independent. The board meets six times a year for two hours. Board packs of about 200 pages are circulated 24 hours before meetings, and the founder sets the agenda. The audit committee has met twice in 18 months. Last quarter the CEO approved a USD 6.5 million contract with a vendor owned by his brother under a delegated authority of USD 10 million; the transaction was recorded as a marketing services agreement. The financial regulator has now asked the company to demonstrate that its governance is effective, and the founder has proposed commissioning an ISO 37000 certification as the fastest way to satisfy the request. The general counsel has asked you, as an external adviser, for a written assessment.
1. The founder's proposal assumes ISO 37000 can be certified. Explain why that assumption is wrong and identify which ISO 37000 principles the current arrangements most clearly undermine. Support each principle with evidence from the facts.
Read the worked answer
ISO 37000:2021 is a guidance standard, not a management system standard with requirements and an accredited certification scheme. There is no independent 'ISO 37000 certification' a registrar can issue, so commissioning one would misrepresent assurance to the regulator and add legitimacy risk on top of the governance problem.
The facts most clearly undermine:
- Accountability: the founder chairs the board and is CEO, sets the agenda and is the interested party in a related-party contract. No one independent owns the decision.
- Oversight: 200-page packs 24 hours ahead, two-hour meetings and an audit committee that has met twice in 18 months give directors no realistic capacity to challenge.
- Ethical behaviour and conflicts of interest: a USD 6.5 million contract with the CEO's brother was approved under delegated authority without disclosure or disinterested approval.
- Data and decisions: the board receives management-curated information and the transaction was recorded in a way that obscures its nature.
- Risk governance: a USD 10 million unilateral delegation is a risk appetite decision the board never consciously made.
The regulator is asking for evidence of effective governance, which requires documented decisions, independent challenge and remediation, not a badge.
2. Distinguish the governance decisions from management decisions in this scenario. Which specific matters should the governing body decide, and which should be delegated?
Read the worked answer
Governance is about direction, oversight and accountability; management is about execution. The board should own: purpose and strategy, risk appetite and delegation limits, appointment and removal of the CEO, the related-party transaction policy and any material related-party transaction, audit committee composition and internal audit independence, and the information standards it needs to challenge management.
The USD 6.5 million contract should have been a board decision even though it fell within the CEO's delegated authority. Delegation limits are thresholds, not waivers of the conflict-of-interest rule; a transaction with a director's close family member requires disclosure, independent review and approval by disinterested directors. Management may negotiate and execute the contract, but it cannot validate the conflict.
Equally, the board should not approve every vendor contract. It should set a tiered delegation matrix by value, risk and related-party status, with conditions, reporting and annual review. The test is whether the board has retained the decisions that shape risk, values and accountability, and delegated the rest with enough transparency to know when to intervene.
3. Recommend a 90-day sequence of actions. Explain why the order matters.
Read the worked answer
Days 1-14 - contain the integrity problem. Disclose the related-party contract to the board, freeze further related-party dealings, appoint a lead independent director, and commission an independent review of the transaction with reporting to the audit committee. Suspend the CEO's authority over that vendor. This comes first because any new structure would be built on contaminated information.
Days 15-45 - rebuild the architecture. Separate the chair and CEO roles, adopt a board charter with reserved matters, reconstitute the audit committee with an independent chair and a defined meeting calendar, adopt a related-party policy with disclosure and recusal, and set board information standards (papers five business days ahead, decisions and rationale minuted).
Days 46-90 - create evidence. Run a facilitated board effectiveness review, agree a risk appetite statement, publish the revised delegation matrix, train directors on conflicts and insider dealing, and meet the regulator with a remediation plan and evidence of decisions taken.
The order matters because independence and conflict control must precede structural redesign, and structure must precede measurement. Asking the board to evaluate itself before it has independent information would simply manufacture false assurance.