When Governance Makes You Brittle

Every governance layer in your organisation was added for a reason. A sign-off process because something went wrong once. An approval chain because a decision got made without the right people in the room. A compliance check because a regulator raised a concern. Each one, individually, made sense at the time.

The trouble is that governance accumulates. And while each individual layer might be perfectly rational, the cumulative effect is something nobody designed and nobody intended: an organisation that's extremely good at preventing the wrong things from happening and extremely slow at allowing the right things to happen.

This is the brittleness problem.

The innovation governance conversation is missing the point

There's a growing body of advice about how to govern innovation: frameworks, RACI charts, board committees, approval matrices. Much of it is about building better governance for innovation itself - clearer processes, dedicated budgets, protected spaces where experimentation is permitted.

That's useful work, and there's a wider question alongside it: what is our governance doing to how the whole organisation works? Because an organisation's governance doesn't just affect innovation projects. It shapes how decisions get made, how quickly the organisation can respond to what's emerging, and whether people at every level feel they have permission to act on what they see.

So governance is more than a management tool. It shapes how well the whole organisation can adapt.

How governance creates fragility

Fragility usually starts with something sensible - a risk materialises, a mistake is made, a regulator asks questions. The organisation responds by adding a control. A new approval step, a new reporting requirement, a new compliance process. The control works. The specific risk is managed. The organisation moves on.

But the control stays. And the next time something goes wrong, another control is added on top of it. Over years, the governance architecture grows through accretion - layer upon layer of perfectly rational responses to specific problems, none of which were designed to work together and none of which get retired when the original risk changes.

The result is an organisation that's tightly controlled and structurally fragile. Three things tend to happen:

Decision-making slows to a crawl. When every decision of consequence requires multiple sign-offs across multiple layers, the organisation loses its ability to respond at the speed the environment demands. This isn't about reckless speed. It's about the difference between an organisation that can adjust course in weeks and one that takes months to approve a change everyone already agrees on.

Local intelligence gets filtered out. The people closest to customers, to delivery, to the frontline - they notice shifts first. A change in what people are asking for. A process that used to work and doesn't any more. A competitor doing something differently. But in a heavily governed environment, that intelligence has to travel up a chain before it can influence anything. By the time it reaches a decision-maker, it's been summarised, averaged, and stripped of the specificity that made it useful.

Risk appetite quietly disappears. Not because leaders become timid, but because the governance architecture makes anything new feel disproportionately difficult. When proposing an experiment requires the same approval process as committing to a major investment, people stop proposing experiments. The system doesn't reject ideas outright - it exhausts them. And the organisation gradually converges on repeating what it already knows, which feels safe until the environment shifts and the old approaches stop working.

A systematic review of organisational resilience published in the International Journal of Health Policy and Management identified several factors that shape it, among them other routes for getting things done (it calls them collateral pathways) and social networks. Some of the things that make organisations resilient are the same things rigid governance tends to squeeze.

The control paradox

Governance designed for control often produces the opposite of what it intended.

Tight controls are supposed to reduce risk. But an organisation that can't adapt quickly to changing circumstances is carrying a different kind of risk - the risk of being too slow, too rigid, too locked into yesterday's assumptions. The governance reduces operational risk while increasing strategic risk. And because strategic risk is slower to materialise, it's harder to see until it's too late.

This isn't an argument against governance. Organisations need clear decision rights, accountability, and oversight. The question is whether your governance is designed to strengthen the organisation's capacity to adapt or to minimise the chance of anything going wrong. Those sound similar. They produce very different organisations.

An organisation governed for adaptation has clear boundaries within which people can act, rapid feedback loops so mistakes are caught early, and governance that flexes as the context changes. An organisation governed for control has detailed procedures for every contingency, long approval chains to prevent errors, and governance that tightens every time something goes wrong.

The first organisation makes small mistakes and learns quickly. The second organisation makes fewer mistakes and learns slowly - until the environment shifts and the accumulated rigidity becomes the biggest risk of all.

What governance looks like when it strengthens the system

The organisations that seem to get this right don't have less governance. They have differently designed governance. A few things distinguish them.

They govern for outcomes, not activities. Rather than prescribing how work should be done and requiring sign-off at each stage, leaders agree clear boundaries around what matters - risk tolerance, quality standards, ethical lines - and each team decides how to work within them. The organisational design question shifts from "who needs to approve this?" to "what does this person need to know in order to make a good decision?" Picture a repairs team and a customer service team working to the same spending and safety limits. Repairs plans its own week of jobs, and customer service decides for itself when a goodwill payment is fair. Neither waits for sign-off on routine work, and both check in before going past the shared limits.

They build governance that can flex. Not every decision carries the same weight. Organisations that recognise this create tiered governance - lightweight processes for reversible, low-stakes decisions and more rigorous oversight for irreversible, high-stakes ones. This sounds obvious, but many governance set-ups apply the same weight of process whatever's at stake. An experiment that costs a thousand pounds shouldn't require the same approval path as a programme that costs a million.

They retire governance as actively as they create it. Every governance layer should have an expiry condition - not a date, but a test. Is the risk this was designed to manage still present? Has the context changed? Is this process still proportionate? Organisations that build review into their governance avoid the accretion problem. Those that don't end up carrying the accumulated weight of every historical problem they've ever encountered.

They treat operational effectiveness as an enabler of adaptability, not a constraint on it. The most operationally effective organisations aren't the most tightly controlled. They're the ones where processes are clear enough that people can follow them without thinking and flexible enough that people can deviate from them when the situation demands it. Clear, simple processes give people the stability to adapt. Over-engineered ones make it hard to change anything.

The connection to organisational health

Governance isn't usually discussed as a factor in organisational development. It sits in a different conversation - risk, compliance, oversight. But look at an organisation as a whole, the way the EMERGENT framework does, and governance turns up everywhere. It shapes how strategy gets carried out. It affects whether culture is lived or merely stated. It decides whether people have room to bring their best thinking, or are kept to narrowly defined tasks.

The organisations we work with that are handling change effectively tend to have governance that operates like a skeleton - providing structure and support while allowing the organism to move. The organisations struggling with change tend to have governance that operates like an exoskeleton - protecting from the outside but constraining everything within.

The difference is less about how much governance there is than what it was built for: to control people, or to help them look after the organisation.

The question worth asking

Most governance reviews ask: are we compliant? Are our risks managed? Are our controls effective? Those are necessary questions. But they're not sufficient.

The question that changes the conversation is: what is our governance doing to our ability to adapt? Not just to innovate - to adapt. To sense what's changing, respond at the speed the situation requires, and learn from what happens.

Governance has two jobs: keeping the organisation safe, and leaving it free to adapt. Most reviews only check the first.