Turning Governance into Consistent Execution

From Governance Decisions to Day-to-Day Execution

A governance framework defines how an organization should be directed, controlled and held accountable. A Delegation of Authority establishes who has the authority to make decisions. But another question remains:

Once a decision has been made, how does the organization ensure it is executed consistently?

This is where policies, procedures, SOPs and process governance become critical. Organizations can have strong governance structures and clearly defined authorities, yet still experience operational inconsistency if employees do not have clear guidance on what is expected, how activities should be performed, where controls apply and who is responsible for execution. Effective governance therefore needs to move beyond the Boardroom and become embedded in everyday business processes.

Policy, Procedure, SOP and Process – What Is the Difference?

What Is a Delegation of Authority Framework?

These terms are frequently used interchangeably, but each serves a different purpose.

These elements should not exist independently. Together, they create a chain from governance expectation to operational execution.

How Governance Flows into Execution

An effective framework creates a clear connection:

The objective is not to push every decision upward. It is to ensure that decisions are made at the lowest appropriate level, while significant matters receive appropriate oversight.

What Should a DOA Typically Cover?

An effective DOA extends across the organization.

When these layers are aligned, governance becomes part of everyday operations rather than remaining a collection of documents.

Why Policies and SOPs Often Fail

Organizations frequently invest significant time in developing policies and SOPs, yet employees continue to follow informal practices.

Why?

Because documentation alone does not change how an organization operates.

Common reasons include:

• Policies developed without sufficient involvement from the people performing the process.
• SOPs describing an ideal process rather than actual operations.
• Documents not updated after changes in systems, structures or responsibilities.
• Different policies containing conflicting approval requirements.
• SOPs not aligned with the Delegation of Authority.
• Controls documented but not embedded within the actual process.
• Employees relying on historical practices rather than approved procedures.
• Multiple versions of the same procedure circulating across departments.
• No clearly identified process owner responsible for keeping documentation current.

The result is often a significant gap between "what the organization says it does" and "what actually happens."

The Role of Process Governance

Process governance provides the discipline required to keep policies, procedures and operational practices aligned over time. It establishes clear ownership for each critical business process and ensures that changes are appropriately evaluated, approved, implemented and monitored.

A practical process governance framework should address:

1. Process Ownership

   Every critical process should have an identified owner accountable for its effectiveness.

2. Documentation Ownership

   Policies and SOPs should have designated owners, approval authorities and review cycles.

3. Control Integration

   Key controls should be embedded within the process rather than treated as separate compliance activities.

4. Change Management

   Changes in systems, regulations, organizational structures or business models should trigger appropriate review of affected processes and documentation.

5. Performance Monitoring

   Organizations should monitor whether processes are delivering the intended outcomes through KPIs, exceptions, incidents and control performance.

6. Continuous Improvement

Processes should evolve as risks, technologies and business requirements change.

Process governance provides the discipline required to keep policies, procedures and operational practices aligned over time. It establishes clear ownership for each critical business process and ensures that changes are appropriately evaluated, approved, implemented and monitored.

When Should Policies and SOPs Be Reviewed?

A fixed annual review is useful but it should not be the only trigger. Policies and procedures should also be reconsidered when there is:

• Business Growth or Restructuring
  Roles, responsibilities and approval requirements may change.
• New Technology or Automation
  Manual procedures and controls may no longer reflect actual workflows.
• Regulatory Change
  Existing policies may no longer meet applicable requirements.
• Repeated Audit Findings
  The documented process may not adequately address the underlying risk.
• Fraud or Control Failure
  An incident may reveal weaknesses in existing procedures or controls.
• Changes to the DOA
  Related policies, SOPs and system workflows may also require amendment.

This makes policy governance a continuous process rather than a periodic documentation exercise.

Real Case Snapshot – When the SOP and Reality Told Different Stories

Background

A diversified private-sector organization had developed comprehensive policies and SOPs across procurement, finance and operations. The documents had been approved several years earlier and were available to employees through the organization's internal portal. Management therefore believed that key processes were standardized and adequately controlled.

However, recurring internal audit observations suggested otherwise. Different business units were following different practices for vendor onboarding, purchase approvals and invoice processing. The organization had extensive documentation but limited consistency

What Was Happening?

A process governance review compared documented procedures with actual working practices through walkthroughs with employees. Several differences emerged.

• The procurement SOP required vendor due diligence and approval before a vendor could be used. In practice, urgent vendors were sometimes engaged first and regularized later.
• The finance procedure specified certain approval levels that were no longer aligned with the organization's revised management structure.
• Some business units had developed their own spreadsheets and approval practices because the formal procedure was considered too cumbersome.
• System workflows had also changed following an ERP enhancement, but the related SOPs had never been updated.

The review ultimately revealed three different versions of the same process:

The process described in the policy

versus

The process configured in the system

versus

The process actually followed by employees.

This created inconsistent controls, unclear accountability and increased operational risk.

How Was It Addressed?

Rather than simply rewriting the SOPs, management undertook an end-to-end process governance exercise.

The organization:

• Conducted walkthroughs to understand how processes actually operated.
• Mapped key processes from initiation through completion.
• Identified differences between policies, SOPs, system workflows and actual practices.
• Reviewed process risks and existing controls.
• Removed redundant activities and approval layers.
• Aligned approval requirements with the approved DOA.
• Updated policies and SOPs to reflect redesigned processes.
• Assigned formal owners to each key process and policy.
• Established periodic review requirements and change triggers.
• Aligned relevant system workflows with the approved process.

The objective was not simply to produce better documents. It was to ensure that documentation, systems, controls and actual execution described the same process.

Outcome

Following implementation:

• Business units began following a common process.
• Policy and SOP inconsistencies were substantially reduced.
• Employees had clearer guidance on responsibilities and approval requirements.
• Manual workarounds decreased.
• Controls became more consistently embedded within operational activities.
• Process changes were subject to defined ownership and review.
• Management gained better visibility over process performance and exceptions.
• Repeat audit observations relating to outdated procedures reduced.

Most importantly, policies and SOPs became living governance tools rather than static documents stored on an internal portal.

Key Lessons

Policies and SOPs are essential components of governance, but their value comes from how effectively they influence behaviour and execution. A perfectly written policy provides little protection if employees follow a different process. Similarly, an SOP can quickly become irrelevant when systems, responsibilities or business requirements change.

Effective process governance therefore requires organizations to continuously connect policy, authority, process, controls, systems and accountability. The objective should not be to create more documentation. It should be to create one consistent way of working that employees understand, management can oversee and the organization can continuously improve.

Good governance ultimately becomes visible not in the quality of the policy manual but in the consistency of everyday decisions and actions.

Governance Insight

A policy tells people what the organization expects. A process demonstrates whether those expectations are actually being followed.

The strongest governance frameworks ensure that policy, people, processes, systems and controls remain aligned as the organization evolves.