Who decides whether an organization should enter a new project? Who implements that decision? Who reviews the results and asks why delivery has fallen behind? Clear answers help people work consistently and reduce conflicting decisions. These questions are a useful starting point for understanding governance.
Governance begins with a clear purpose, authority and the information decision-makers need.
This article explains how governance differs from management, introduces its principles and shows how they become practical actions. ISO 37000 provides guidance that organizations can use in ways suited to their size and work.
What organizational governance means
Governance establishes who can make important decisions, the limits of that authority and how results are reviewed. It includes directing the organization, overseeing its performance and conduct, and holding decision-makers accountable.
These responsibilities sit with the governing body, such as a board of directors or trustees, depending on the organization’s legal form and arrangements. An owner may fulfil this role in a small business within their authority. The structure does not have to be identical in every organization.
Stakeholders include employees, customers, owners and others who influence or are affected by the organization. Governance considers their relevant interests while making decision authority clear.
How does ISO 37000 help an organization?
ISO 37000:2021 provides guidance for governing bodies and governing groups. It applies to organizations of any type, size, location, structure or purpose. ISO confirmed the 2021 edition in 2026, so it remains current.
The standard is guidance, not a management-system requirements standard. It does not itself create a conventional ISO certification scheme. An organization may assess its governance maturity or obtain independent assurance, but it should not describe ISO 37000 as if it were a certifiable requirements standard.
What is the difference between governance and management?
Governance
Sets purpose and direction, identifies decisions requiring its approval, delegates defined authority, reviews results and holds management accountable. For example, it approves entry into a new market and the project’s financial limits.
Management
Turns the approved direction into a work plan, allocates resources and tasks, manages delivery and everyday risks, and reports results and problems to the governing body.
Support and independent assurance
Risk, compliance, legal and finance functions contribute information, advice and monitoring. Internal audit provides independent and objective assurance on the effectiveness of governance, risk management and control. These functions do not replace the authorized decision-maker.
ISO 37000
3 outcomes of good governance
ISO 37000 organizes good governance around 3 connected outcomes. None is sufficient alone.
The 11 governance principles
The principles connect the organization’s purpose with decision-making and review of its effects. The explanations below use practical examples and are not a verbatim reproduction of the standard.
Purpose
Keep the organization’s reason for existence at the centre of governance.
Practical example: Before approving a project, ask how it serves the organization’s purpose.
Value generation
Define the value the organization intends to create, protect and sustain for stakeholders.
Practical example: Identify the intended benefit and its recipients, such as a more reliable customer service that remains sustainable for the organization.
Strategy
Set direction and make choices that connect purpose, resources, risks and desired outcomes.
Practical example: Compare expansion options and decide what to pursue, what to defer and which resources are needed.
Oversight
Monitor performance, conduct, controls and the continuing suitability of direction.
Practical example: Compare project results with the plan and ask for explanations and corrective action when delivery falls behind.
Accountability
Make authority, delegation, reporting and consequences explicit.
Practical example: Name who approves, who implements and who reports progress, including when the report is due.
Stakeholder engagement
Identify affected and influential stakeholders and use relevant insight in decisions.
Practical example: Listen to employees and customers affected by a service change and explain how relevant feedback influenced the decision.
Leadership
Model the values, judgement and behaviour expected throughout the organization.
Practical example: Follow conflict-of-interest rules even when a senior decision-maker is involved.
Data and decisions
Base decisions on credible information, transparent criteria and appropriate challenge.
Practical example: Check the sources of cost and demand figures, and record assumptions and missing information.
Risk governance
Integrate uncertainty, opportunity and risk into direction, decisions and oversight.
Practical example: Before committing, consider threats to success, opportunities and acceptable risk limits.
Social responsibility
Consider societal expectations, human impacts and the organization’s wider responsibilities.
Practical example: Consider effects on safety, society and the environment when comparing alternatives.
Viability and performance over time
Protect the organization’s capacity to fulfil its purpose and perform over the long term.
Practical example: Test whether today’s gains undermine future capability, such as reducing costs by neglecting maintenance.
Who is accountable for governance?
Accountability means explaining decisions and results, answering for shortcomings and following through on corrective action. Delegation gives a person or body defined authority within stated limits.
The governing body can delegate some authority but remains accountable for governance. Management answers for delivery and the information it provides. Delegation should therefore specify what may be approved, the limits of authority and when a matter must return to the governing body.
From principles to operating practice
Clarify purpose and responsibilities
Explain why the organization exists, who governs it and the boundaries of their authority.
Define decision authority
Identify decisions reserved for the governing body, decisions delegated to management and matters that must be escalated.
Prepare decision information
Agree reports, sources and timing. Clearly present options, costs, risks and uncertain information.
Consider risks and affected stakeholders
Examine opportunities, possible impacts and relevant stakeholder views before major decisions.
Connect values with behaviour
Explain expected conduct, reporting routes and fair handling of conflicts of interest.
Review and improve
Review decision quality, follow-through and results. Assign each improvement an owner and a completion date.
Evidence that governance is working
Start with an important decision and trace how it was prepared, approved and implemented. Did the authorised person or body decide? Was sufficient information available? Did the governing body review the result? These questions distinguish established rules from their actual application.
Governance documents explain purpose, authority and committee responsibilities. Decision papers show alternatives, cost, risks and assumptions; minutes record the reasons for the choice and any dissenting view. A reviewer can then understand the decision without relying on participants’ memories.
Next examine conflict-of-interest declarations, performance reports and corrective-action records. Check what happened after a problem was found: who addressed it, when, and how the result was verified. Also consider whether incentives and actual behaviour match stated values.
The governing body needs periodic evaluation of its own effectiveness. It can examine information quality, discussion and decision follow-up, then assign improvements, owners and dates. Meeting counts alone do not establish governance quality.
Use a disciplined record for significant decisions
A decision log preserves why a decision was made, who approved it and how its result will be followed up. For significant decisions, record the purpose, authority and alternatives considered. Include risks, assumptions, affected stakeholders’ interests, missing information and any dissenting view.
After approval, name the implementation owner, budget or other limits, acceptance conditions and review date. Also specify what requires renewed escalation, such as exceeding approved cost or discovering a new risk.
The log need not capture every word spoken at a meeting; its detail should reflect the decision’s impact. At review, compare events with expectations and record lessons and required action. The outcome may be continued implementation, a revised decision, or changes to authority and controls.
Illustrative example: procurement and a conflict of interest
A conflict of interest arises when a personal interest could affect how someone performs their duty. Suppose an organization is buying a system and a board member owns a stake in a bidding supplier. This is a hypothetical example, not an actual case.
The member discloses the relationship. Access to information and participation in discussion and voting are managed under applicable rules and the conflict-of-interest policy. The organization records the steps taken to protect the decision’s integrity.
Management prepares a comparison covering the actual need, total cost, information security and user support. The authorized body approves a choice after reviewing evidence, alternatives and risks; a personal connection or a low price alone is insufficient.
The decision record states the reasons, budget limits, implementation owner, acceptance conditions and review date. After deployment, service quality, costs and results are compared with earlier assumptions. Governance is visible in the documented decision and its follow-up.
Common governance failures
- Treating governance as document production rather than decision and accountability discipline.
- Confusing the governing body’s oversight with management’s operational role.
- Delegating authority without defining limits, information duties or escalation triggers.
- Using dashboards that report activity but hide uncertainty, assumptions or adverse signals.
- Discussing risk only after strategy and major decisions have already been set.
- Engaging stakeholders symbolically without showing how relevant insight influenced decisions.
- Equating legal compliance with good governance; compliance is necessary but not sufficient.
- Claiming certification to ISO 37000 without accurately describing the assessment or assurance basis.
Conclusion
Start by clarifying 3 things: who decides, which information supports the decision and how results are followed up. Define authority, manage conflicts of interest and document important decisions in proportion to their impact. Effective governance is visible in decision quality, conduct and follow-through, not the number of documents or committees.
Frequently asked questions
Is ISO 37000 mandatory?
No. It is international guidance. Applicable laws, regulations, ownership requirements or sector rules may impose separate governance obligations.
Can an organization be ISO 37000 certified?
ISO 37000 is a guidance standard and does not set certifiable management-system requirements. Independent assessments may exist, but their scope and basis should be described accurately.
Does ISO 37000 apply only to companies?
No. ISO states that it applies to all organizations regardless of type, size, location, structure or purpose.
What is the difference between governance and compliance?
Governance directs and oversees the organization as a whole. Compliance focuses on meeting applicable obligations and internal commitments; it is one input to governance.
How can governance maturity be assessed?
Governance maturity concerns how firmly governance practices are established and consistently applied, beyond the existence of documents. ISO 37004:2023 provides guidance and a model for assessing this maturity using the principles of ISO 37000.