Regulated Industry Governance Best Practice: A Practical Guide

Regulated Industry Governance Best Practice

If you searched for this, you are probably not looking for a definition of the three lines of defence. You want to know what separates governance that holds up under regulatory scrutiny from governance that looks fine on paper and collapses the moment a supervisor asks a hard question. This guide covers that gap.

Start with the decision, not the committee structure

Most governance frameworks are built around committees. That is backwards. Regulators care about specific decisions: how they were made, who challenged them, what evidence was weighed, and whether the outcome was reasonable given what was known at the time.

Before you touch your terms of reference, list the twenty or so decisions your business actually makes that carry regulatory risk. Product approvals, pricing changes, outsourcing arrangements, capital and liquidity calls, remediation trigger points, senior appointments. For each, ask: where does the real decision get made, who has the authority to say no, and what would we show a regulator if they asked for the file tomorrow.

If the answer is "it goes to ExCo" or "it's in the minutes," you have a problem. Good governance produces a decision record that a supervisor can read cold and understand the reasoning.

Board composition: the test regulators actually apply

The collective competence question is now sharper than it was five years ago. Regulators want to see that the board contains people who can credibly challenge management on the specific risks the business runs, not just generalists with impressive CVs.

What good looks like: at least two non-executives who have run a P&L in a regulated firm, someone with genuine technical depth in the dominant risk (credit, underwriting, market, conduct, technology), and a chair who has demonstrably pushed back on a CEO before. What weak looks like: a board where the independent voices come from adjacent industries and defer to management on anything technical.

The common failure is treating diversity of background as a substitute for domain expertise. You need both.

Management information: the two-page test

If your board pack runs to 400 pages, your MI is broken. The test is whether a non-executive can, in two pages per material risk, understand the current position, the trend, the tolerance, and what is being done about any breach.

What most firms get wrong: MI that reports activity rather than outcomes, thresholds that were set years ago and no longer bite, and a red-amber-green scheme where nothing is ever red because red triggers uncomfortable conversations. Fix the thresholds first. If nothing has been red for eighteen months, your tolerances are set too loose or your reporting is not honest.

The regulator relationship

Treat your relationship with the supervisor as a governance asset, not a communications exercise. Three practical rules.

First, no surprises. If something material is going wrong, the regulator hears it from you, in a form they can act on, before they hear it from anyone else. Second, be consistent. The story you tell the regulator, the board, and the market must reconcile. Discrepancies get noticed and are hard to recover from. Third, document your interactions. Every substantive conversation with a supervisor should generate a file note within 48 hours, shared with the relevant executive and the company secretary.

Where governance actually fails

Enforcement cases rarely turn on the absence of a policy. They turn on one of four things: a known risk that was not escalated, a decision taken without adequate challenge, a control that existed on paper but was not operating, or a cultural pattern where bad news did not travel upward. Test your firm against these four honestly. Ask internal audit to look for the second one specifically: decisions where the challenge in the minutes is thin or absent.

What to do this quarter

Pick one material decision your board took in the last six months. Reconstruct the file as if a regulator had asked for it. Look at what is there, what is missing, and whether the reasoning would hold up. That single exercise will tell you more about your governance than any external review.

If the file does not hold up, you know where to start.