Beyond compliance, the real test

Good governance and effective assurance enable sound decisions

Governance is typically expressed through its visible organisational architecture — boards and committees, policies and delegations, meetings and minutes. These are all necessary, but they are not, by themselves, sufficient.

 

The real test of governance lies in the quality of an institution’s decisions — in how well risks are understood, how effectively assumptions are challenged, how clearly responsibilities are assigned, and whether there is sufficient independent challenge to know when things are not working as intended.

 

At its core, good governance is about sound judgement, clear accountability, and ensuring that assumptions and decisions are questioned when risks or emerging evidence call for it.

 

Business of risk and judgement: This distinction is particularly important in banking and non-banking financial companies, or NBFCs. Financial intermediation is, by its very nature, a business of risk and judgement: Institutions mobilise resources, lend after assessing borrowers’ repayment capacity, manage liquidity, respond to movements in financial markets, and operate through increasingly complex technologies and business models. These risks do not exist in isolation; developments in one area can quickly influence others.

 

Decisions, therefore, need to be taken with an understanding not only of individual risks, but also of how they may interact. Regulation sets the prudential boundaries and safeguards, but commercial decisions are for banks and NBFCs themselves to make. This calls for sound judgement.

 

Compliance is the floor: Compliance with regulation is essential, but good governance must go further. A decision may be permissible within the rules and yet warrant closer consideration from the standpoint of prudence, concentration, customer outcomes or the institution’s own risk appetite.

 

Governance, therefore, requires institutions to ask not only, “Can we do this?” but also, “Should we do this, and are we equipped to manage the consequences?”

 

Board oversight: How such judgement is exercised depends, in turn, on the quality of decision-making and oversight within the institution.

 

The board and senior management have distinct but complementary responsibilities in this process. The board sets direction and risk appetite, while management translates these into business decisions.

 

An effective board does not run the institution, but it must understand the business well enough to question assumptions, probe emerging risks and seek timely escalation of concerns.

 

Effective oversight, in turn, requires reliable information and independent assurance on whether risks are being managed well and controls are working as intended.

 

Assurance: Assurance functions, namely, risk management, compliance, and internal audit, provide an independent perspective in different ways. Their roles are distinct, but their common purpose is to help the institution identify vulnerabilities, test assumptions and assess whether risks are being managed within the intended framework. Their value lies not merely in identifying deviations after the event, but in providing timely and credible challenge before concerns become problems.

 

Effective assurance requires both independence and professional competence. Towards this, assurance functions need to be adequately staffed with skilled, experienced personnel, equipped to understand an increasingly complex business and its risks. They must also have sufficient stature within the organisation to communicate their views objectively, including where these differ from those of the business. This, in turn, requires a board and senior management that value independent challenge and act on concerns where warranted.

 

Independent challenge should not, however, be equated with obstruction. Assurance functions are not meant to eliminate risk or second-guess every commercial decision. Their role is to ensure that key assumptions are tested, material risks are understood, and concerns are articulated in time. The objective is not risk avoidance, but informed risk-taking.

 

Keeping pace with change: The nature of oversight and assurance must also evolve as financial intermediation evolves. New technologies, greater reliance on third parties, increasingly sophisticated models, and changing business practices are altering both the nature of risks and how they interact.

 

Boards must remain sufficiently informed to ask the right questions, while assurance functions need the skills, tools and methods to assess these emerging risks effectively.

 

From hindsight to foresight: Effective oversight and assurance should also be forward-looking. They should not be confined to assessing whether controls have worked in the past but should help the institution anticipate how risks may evolve in the future as business strategies, market conditions and operating environments change. This requires looking ahead, questioning assumptions and considering where vulnerabilities may emerge before they become evident in reported outcomes.

 

Equally important is the ability to connect the dots. Repeated exceptions, breaches of internal limits, recurring customer complaints or audit observations may each appear manageable in isolation but together may point to a deeper weakness. The value lies in recognising these patterns early and addressing their underlying root causes, rather than merely resolving individual observations.

 

Responsibility rests within: External supervision provides an important layer of oversight, but it cannot substitute for governance and assurance within the institution.

 

Supervisors can identify vulnerabilities, challenge practices and require corrective action, but the primary responsibility for understanding and managing risks must remain with the board and senior management. The most effective safeguards are the ones embedded in the institution’s own decision-making processes.

 

This emphasis on substantive oversight is reflected in the RBI’s recent rationalisation of matters required to be placed before bank boards, aimed at enabling more focused and qualitative engagement on strategy and risk governance.

 

Navigating risk: Aviation offers a useful analogy. Flying necessarily involves risk. Good flying is about understanding the aircraft, reading the conditions, maintaining appropriate margins and being prepared to change course when circumstances demand it.

 

Governance and assurance serve a similar purpose in financial institutions. They enable better judgement, provide timely challenge and help institutions recognise when assumptions no longer hold. In the end, strong governance is not about avoiding risk; it is about being better equipped to take the right risks, in the right way.

 

---

The author is Deputy Governor, Reserve Bank of India. The views expressed here are personal