ISO 37000 Lead CG Manager cheat sheet

ISO 37000 defines governance as the system by which an organization is directed and controlled; it focuses on purpose, direction, and oversight.

The standard is principle-based, not prescriptive: it sets outcomes, not a one-size-fits-all structure.

Seven principles: purpose, value generation, strategy, oversight, accountability, stakeholder engagement, and ethical behavior.

Purpose principle: governance ensures the organization's purpose is clearly defined, articulated, and aligned with societal expectations.

Value generation principle: governance directs the creation of sustainable value, considering economic, social, and environmental dimensions.

Strategy principle: governance ensures strategy and resource allocation are aligned with purpose and values.

Oversight principle: governing body provides oversight of management and ensures effective control systems.

Accountability principle: clear allocation of responsibilities and answerability for decisions and outcomes.

Stakeholder engagement principle: governance identifies and engages with stakeholders to understand expectations and impacts.

Ethical behavior principle: governance promotes integrity, fairness, and ethical conduct throughout the organization.

Governance framework comprises the governing body, management, and the policies, processes, and structures that enable direction and control.

Governing body structure: composition, size, diversity, independence, and roles (e.g., chair, committees) should be defined to fit the organization's context.

Decision-making should be documented, transparent, and traceable to purpose and strategy.

Delegation of authority: governing body delegates to management but retains ultimate accountability.

Committees (audit, risk, remuneration, nomination) support the governing body by focusing on specialized oversight.

Governance framework must be dynamic, adapting to changes in the organization's size, complexity, and external environment.

Clear documentation of roles, responsibilities, and decision rights is essential for effective governance.

The governing body ensures that the governance framework is communicated and understood throughout the organization.

Oversight includes monitoring performance against strategy, ensuring compliance, and overseeing risk management.

Accountability mechanisms include reporting lines, performance evaluations, and consequences for non-compliance.

Stakeholder engagement practices: identify stakeholders, understand their expectations, and integrate feedback into governance.

Ethical culture is reinforced through codes of conduct, training, and whistleblowing mechanisms.

Risk governance: the governing body ensures effective risk management and internal control systems.

Transparency and disclosure: governance requires timely and accurate reporting to stakeholders.

The governing body oversees the organization's approach to sustainability and societal impact.

Grievance mechanisms and whistleblower protection are key accountability practices.

Governance performance evaluation includes assessing the governing body's effectiveness, composition, and decision-making.

Regular reviews of the governance framework ensure it remains fit for purpose.

Reporting should be transparent, accurate, and provide a balanced view of governance performance.

Continual improvement: governance should learn from outcomes, feedback, and changes in the external environment.

Key performance indicators (KPIs) for governance can include stakeholder satisfaction, compliance rates, and ethical incident metrics.

Internal audit and external assurance can provide independent evaluation of governance effectiveness.

The governing body should periodically assess its own performance and that of its committees.

Improvement actions should be documented, implemented, and monitored for effectiveness.