Why Most Technology Governance Frameworks Fail in Practice

The Design Is Rarely the Problem

Walk into any large financial institution and you will find a technology governance framework. It will have a committee structure, escalation paths, decision rights, and reporting lines. It will have been reviewed by consultants, approved by the board, and documented in a policy manual that runs to dozens of pages.

It will also, in most cases, not be working as intended.

The failure is almost never in the design. The frameworks themselves are often technically sound — they reflect genuine thinking about corporate governance advisory principles, accountability structures, and risk oversight. The problem is that a governance framework is not a machine. It does not run itself. It depends entirely on the behaviour of the people operating within it, and behaviour is shaped by incentives, culture, and institutional history — none of which appear in the framework document.

The Four Patterns of Governance Failure

In two decades of working across financial institutions on enterprise governance and transformation governance, the same failure patterns recur with remarkable consistency.

Pattern One

Technology governance committees are convened, papers are presented, and discussion takes place — but actual decisions are deferred, delegated, or never formally made. The committee becomes a reporting forum rather than a decision-making body. Accountability diffuses. No one is clearly responsible for outcomes.

This pattern is particularly common where the committee membership is too large, where the terms of reference are vague about what constitutes a decision, or where the culture discourages direct challenge to executive positions.

Pattern Two

In many institutions, the formal governance process exists alongside an informal one. The real decisions are made in bilateral conversations between executives, in pre-meetings before the committee convenes, or in channels that bypass the governance structure entirely. The formal process then ratifies what has already been decided.

This is not necessarily malicious. It often reflects the fact that the formal process is too slow, too bureaucratic, or too disconnected from operational reality to be useful. But the consequence is that the governance framework provides the appearance of oversight without the substance.

Pattern Three

Every governance framework has escalation mechanisms — ways for concerns to be raised, risks to be flagged, and problems to be surfaced to the appropriate level. In practice, these mechanisms are rarely used. The culture of most financial institutions makes escalation feel risky. People who raise concerns are seen as obstacles. Problems are managed locally rather than escalated, until they become crises.

Governance risk and compliance advisory that focuses only on the formal escalation structure misses this entirely. The question is not whether the escalation path exists — it is whether the organisational culture makes it safe and normal to use it.

Pattern Four

Technology governance depends on good information reaching the right people at the right time. In practice, the information that reaches boards and executive committees is heavily filtered, aggregated, and shaped by the people who produce it. Status reports show green when programmes are amber. Risk registers understate the severity of known issues. The board sees a picture that is systematically more optimistic than reality.

This is not always deliberate. It reflects the incentive structures that determine what people report and how. Fixing it requires changing those incentives — not redesigning the reporting template.

What Effective Transformation Governance Actually Requires

Effective transformation governance is not primarily a structural question. It is a behavioural one. The structural elements — committee design, decision rights, reporting lines — matter, but they are necessary rather than sufficient conditions.

What distinguishes institutions where governance actually works is a set of behavioural norms that are actively maintained by senior leadership. Decisions are made explicitly and recorded. Accountability is personal and visible. Escalation is treated as a sign of good judgement rather than a failure of management. Reporting reflects reality rather than managing upward expectations.

These norms do not emerge from a governance framework document. They are established by the behaviour of the most senior people in the institution — and they are fragile. A single leader who consistently bypasses the governance process, or who responds badly to unwelcome information, can undermine norms that took years to build.

This is why board advisory services that focus exclusively on framework design tend to produce limited results. The framework is the easy part. The hard part is the institutional behaviour — and that requires a different kind of engagement.

The Role of Independent Assessment

One of the most valuable contributions an independent advisor can make in this context is an honest assessment of the gap between the governance framework as designed and the governance process as it actually operates. This requires access to the real conversations — not just the committee papers — and a willingness to report what is actually happening rather than what the institution wants to hear.

Most internal assessments cannot do this. The people conducting them are part of the system they are assessing, and they face the same incentive structures that produce the problems in the first place. External advisors who are commercially dependent on the institution face a different version of the same constraint.

Genuinely independent corporate governance advisory — unconflicted, situation-led, and willing to deliver an honest assessment — is rare. But it is the only kind that reliably produces the information boards and executive committees need to make governance work as intended.