From Box-Ticking to Measuring Results: How Corporate Governance Best Practices are Changing

…

Good governance connects board responsibilities to everyday workflows: who decides, what evidence supports the decision, how risks are reviewed, and where the record lives.

Implementing governance best practices requires more than policy. It requires structured processes, documented decisions, and reliable board infrastructure.

See how DiliTrust supports boards in practice.

Corporate governance best practices are the structures, processes, and controls that guide how a company is directed and overseen. They cover the relationship between the board, management, shareholders, employees, regulators, and other stakeholders.

In practice, good governance answers four questions: who has authority, what information supports a decision, how risks are challenged, and how the organization proves what happened later.

Governance area	What good practice looks like	Evidence to keep
Board accountability	Responsibilities are defined across the board, committees, and management	Charters, delegations, annual evaluations
Decision-making	Material decisions follow a documented approval route	Board papers, resolutions, votes, minutes
Risk oversight	Directors receive business-focused reporting and track remediation	Risk reports, action logs, testing results
Ethical conduct	Conflicts, conduct concerns, and protected disclosures have clear routes	Policies, disclosures, investigations, outcomes
Information governance	Sensitive records have controlled access, version history, and retention rules	Audit trails, permissions, retention schedules

A governance framework should fit the organization’s size, ownership model, sector, and jurisdictions. Every company still needs clear authority and reliable records.

The board oversees strategy, risk, leadership, performance, and conduct. Management runs the business. Committees take on focused work, then report back to the full board with enough context for directors to exercise judgment.

Review board and committee charters each year. Record delegated authorities, escalation thresholds, and decisions that require full-board approval. A responsibility map should show which committee owns each topic, when management must escalate an issue, and who tracks actions.

Directors can only govern with the information in front of them. Board packs should give them the facts, assumptions, risks, options, and proposed decision without forcing them to reconstruct the story from email threads.

A sound process sets a timetable for submissions, assigns a content owner, records approvals, and keeps the final version with the meeting record. It also gives directors a secure way to access materials before and after the meeting.

Use a consistent board pack structure: the decision required, the relevant business and legal context, key risks and controls, alternatives considered, and the proposed resolution with an action owner and due date.

Risk, compliance, and internal controls 

Risk reporting should help directors decide what needs attention. A long list of technical indicators does not show whether the organization can withstand a disruption, meet a regulatory duty, or protect a critical relationship.

Reports should connect each major risk to its business effect, control position, accepted exposure, and next action. The board should see overdue actions and unresolved exceptions.

The UK Corporate Governance Code 2024 applies from 1 January 2025, with Provision 29 on material internal controls applying from 1 January 2026. For EU financial entities, DORA has applied since 17 January 2025 and places responsibility for ICT risk and digital resilience with the management body. See DORA compliance guidance for the governance implications.

A board needs the independence, experience, time, and judgment to challenge management. A skills matrix should show where expertise is concentrated, which capabilities are missing, and how needs may change as the company grows or enters a new market.

Review the matrix alongside independence, tenure, conflicts, committee workload, chair succession, director development, and CEO succession. It should cover finance, technology, cyber risk, sustainability, and regulation.

The 2025 Spencer Stuart U.S. Board Index reported that 80% of S&P 500 boards disclosed a skills matrix in proxy statements, compared with 38% in 2020. Boards are expected to show how their composition supports the risks and strategy they oversee.

Stakeholder and sustainability oversight

Stakeholder oversight covers issues that affect trust, licence to operate, and long-term performance, including conduct, customer outcomes, sustainability claims, supply chains, and data use.

The board should know who owns each public statement, what source supports it, and which controls were applied. Whistleblowing and conduct procedures need confidentiality and clear escalation rules.

How to implement governance best practices

List recurring decisions, approval thresholds, escalation triggers, and gaps between written rules and actual practice.

Define the business case, options, risks, conflicts, legal considerations, and follow-up directors need for each decision.

Set deadlines for submissions, review, distribution, minutes, signatures, and action tracking. Include urgent decisions between meetings.

Store the report, questions, decision, vote, resolution, and action together. The answer to “how was this decision made?” should not depend on one person’s inbox.

Revisit it after an acquisition, leadership change, incident, regulatory update, or business model change. Test emergency access and decision routes.

Use these questions in the next board or committee review:

•  Are board and committee responsibilities current and easy to find?
•  Does each recurring decision have a clear owner and approval route?
•  Do board papers state the decision required, the risks, and the alternatives considered?
•  Are conflicts of interest declared, recorded, and managed?
•  Does the risk report show overdue actions, accepted exposure, and control failures?
•  Is the board skills matrix linked to strategy, risk, and succession?
•  Can the company retrieve board materials, minutes, votes, and actions quickly?
•  Are AI use cases, data access, human review, and accountability reported to the board?
•  Are sustainability statements supported by named owners and source evidence?
•  Has the board tested its process for an urgent decision or crisis meeting?

Common mistakes in corporate governance

Mistake	Why it matters	The fix
Treating governance as a policy exercise	The written framework does not change day-to-day decisions	Assign owners and build the controls into working processes
Sending board materials through ordinary email	Access, versions, and decision history become difficult to verify	Use a controlled board workspace with permissions and audit trails
Reporting activity instead of exposure	Directors see metrics but cannot judge business impact	Connect each risk to consequence, control, owner, and action
Keeping minutes separate from supporting papers	The final record lacks the context behind a decision	Store papers, minutes, votes, resolutions, and actions together
Reviewing succession only after a vacancy	The board has little time to assess candidates or skills gaps	Review planned and emergency succession on a regular cycle
Adding AI without governance rules	Sensitive data, inaccurate outputs, and unclear accountability create new exposure	Record use cases, access rules, human review, and incident routes

The UK’s Provision 29 declaration brings material internal control effectiveness into the board’s formal reporting responsibilities. Boards need evidence of the controls, testing, weaknesses, and remedial actions.

AI affects decision-making, data use, cyber risk, vendor oversight, employment, and disclosure. Boards should inventory material use cases, assign risk owners, and ask how outputs are checked before they influence a business or legal decision. See AI for Board Management.

Under the EU AI Act, prohibited practices began applying in February 2025. From 2 August 2026, the AI Office and Member State authorities are responsible for implementation, supervision, and enforcement. Duties vary by system and use case, so a current inventory matters.

Resilience and sustainability need connected records

DORA, NIS2, cyber disclosure rules, and sustainability reporting all place more weight on ownership, testing, escalation, and evidence. Across committees, the discipline is the same: a clear owner, a reliable source, a documented decision, and follow-up.

How DiliTrust supports board governance 

Board governance depends on the quality of the information directors receive and the record the organization keeps. Email chains and shared folders make it hard to confirm which version was approved or whether an action was completed.

DiliTrust’s Board Portal gives governance teams one controlled environment for agendas, board books, materials, minutes, votes, signatures, and follow-up actions. Permissions restrict sensitive information, while audit trails preserve access and decision history.

Lini, DiliTrust’s AI engine, can help teams search records, summarize materials, transcribe meetings, and prepare minutes. Human review remains part of the process. The wider DiliTrust Suite connects board governance with contracts, entities, matters, and confidential transaction records.

A policy earns its place when people can follow it under pressure. Give directors clear information, give committees clear responsibilities, and keep the evidence behind each decision together. Review the framework annually and test urgent decision routes.