PayNova: Board Governance and Independence Before IPO
PayNova is a fast-growing payments fintech with 2.3 million merchant customers. Its nine-person board has two independent directors; the founder-CEO chairs board meetings and sits on the risk committee. The risk committee meets quarterly for 45 minutes and receives a 60-page pack two days before. The CRO reports to the CFO, who also owns commercial budgeting. Internal audit is outsourced to a consultancy that is simultaneously advising PayNova on a cloud migration. The regulator's recent review found that board minutes did not show challenge on risk appetite, that the CRO had no direct access to the board, and that the audit committee had not assessed internal audit independence. PayNova plans an IPO in 18 months. The chair says governance is 'a box-ticking exercise' and the priority is growth. The CRO has drafted a remediation plan but fears it will be diluted.
1. Evaluate the governance weaknesses and explain how each could impair risk decisions, not just compliance.
Read the worked answer
The board has the wrong composition and cadence for a systemically important payments firm. Two independents out of nine, with the founder-CEO chairing and sitting on the risk committee, weakens challenge. A 45-minute quarterly risk committee with a 60-page pack two days before is not enough time to test appetite or escalate. The CRO reporting to the CFO creates a conflict: the CFO controls budgets and commercial targets, so risk can be softened. Internal audit being outsourced to a consultancy that also advises on cloud migration impairs independence; the audit committee cannot rely on assurance if the same firm is implementing change. These are not box-ticking issues: they can delay escalation of outages, fraud or compliance failures, and they undermine IPO readiness. Board minutes showing no challenge on risk appetite are evidence of a governance culture problem, not just documentation.
2. Recommend board and committee changes, including independence, CRO reporting line, and internal audit. What sequencing is realistic before IPO?
Read the worked answer
Before IPO, the board should appoint at least three more independent directors, separate the chair and CEO roles, and ensure the risk committee has an independent chair. The CRO should report functionally to the board risk committee and administratively to the CEO or CFO, with direct access and a private session at each meeting. The risk committee should meet at least monthly during remediation and receive a shorter, decision-focused pack five days ahead. Internal audit should be separated from consulting: either use a different firm for cloud advice or replace the outsourced auditor. The audit committee should assess independence annually and approve the audit plan. Sequencing: first fix independence and CRO access, then committee cadence and pack quality, then internal audit separation. The IPO timetable creates urgency, but regulator remediation should come first.
3. How should the CRO escalate if remediation is diluted? Include board dynamics and regulator expectations.
Read the worked answer
The CRO should escalate in writing, factually and without personality: set out the regulatory findings, the remediation plan, the resources needed, and the consequences of dilution. Use the board risk committee as the primary route, then the audit committee for internal audit independence, then the full board. If the chair blocks discussion, the CRO should seek a private session with independent directors and document the request. The regulator expects the CRO to have access and standing; the CRO can also use the whistleblowing channel if governance is obstructed. The CRO should avoid ultimatums and instead present options with risk trade-offs: full remediation, phased remediation, or delay with acceptance of regulatory and IPO risk. Board dynamics matter: the founder may listen if the CRO frames governance as an IPO valuation issue, not a compliance cost. The CRO should keep a decision log.