Playbook
Putting Governance in Place
Governance is my day job, so this is the order I build it in for real clients: settle who owns risk and who checks it, pin decision rights to named people, take the same discipline down to task level, then give the whole structure a live risk register to manage.
Governance is the part of my work people expect to be boring, and I have made my peace with that. I build governance architecture at Beyond Amazing, and before that I spent twenty years growing a tax consultancy from a few thousand in turnover to a seven-figure turnover, which means I have lived the exact moment this playbook is written for: the business outgrows the founder's ability to see everything, and 'we all trust each other' quietly stops being a control environment. Most organisations respond by writing policies, and policies on their own are wallpaper. Structure is what holds when someone is having a bad quarter. This sequence builds the structure in the order I build it for clients. Three Lines of Defence settles who owns each risk, who oversees it and who checks independently, before anyone starts arguing about headcount. RAPID pins decision rights, because governance usually fails at the moment nobody can say who decides. RACI takes the same discipline down to task level, one accountable name per row. Then the risk matrix gives the whole apparatus something real to manage, because structure without content is an org chart with ambitions. Roles first, decisions second, tasks third, risks last. Get the order right and when a risk finally lands, there is already a named person whose job it was to catch it.
Governance
Three Lines of Defence
For separating the people who run the risks from the people who check them, and both from the people who assure the board. Leave it alone when the organisation is small enough that all three lines would be the same two people; keep the principle, drop the structure. Instead RACI, to keep doing and checking in separate hands when the three lines would be the same two people.
Start with roles, because in a growing organisation risk work is happening everywhere and nobody can say who owns which control and who checks it. The three lines are roles rather than departments. In a small business one person can hold a first-line and a second-line role at once, provided the hats are named and never worn simultaneously for the same control. When I map this with clients, the first draft nearly always shows the board taking comfort from assurance that is really management marking its own homework. Finding that out on paper is cheap.
Watch forTreating the model as an organisation chart to be staffed, then hiring three departments a business of your size does not need.
Governance
RAPID Decision Roles
For naming, for one big decision, who recommends, who must agree, who gives input, who decides and who carries it out, so one person owns the call. Leave it alone when decisions get made fine and the problem is their quality; this fixes who, not how well. Instead A Decision Matrix or a Pre-mortem; RAPID fixes who decides, not how well.
Risk ownership can be beautifully mapped while decisions still stall, get made twice at different levels, or unravel in delivery. RAPID exists for that gap. For each decision that matters, one named person holds the D, one recommends, a short list gives input, and only genuine legal or financial sign-offs earn an Agree. Count the roles when you are done. More than one D, or a long Agree list, means you have documented the ambiguity instead of removing it. Put the D where the information lives, which is often below the most senior person in the room.
Watch forGiving the D to a committee, or to two people jointly, restores exactly the ambiguity the tool exists to remove.
Org, people & execution
RACI Matrix
For settling who does the work, who is accountable, who is consulted and who is told, for every task that matters, with exactly one accountable name each. Leave it alone when the team is small and stable and everyone already knows; it adds admin, not information. Instead Nothing. A small, stable team that already knows who does what needs no chart.
Now take the same discipline down to the level where work actually gets dropped. Tasks fall into the gaps at handovers, and each side sincerely believes the dropped task belonged to the other. A RACI grid forces those arguments in week zero, on paper, rather than in month three, in an incident review. Hold the one rule that gives the tool its teeth: exactly one Accountable name per row. Every argument the chart provokes is the chart working, because the disagreement already existed and you have simply made it discussable.
Watch forConsultation inflation, C's handed out to avoid offence, until every task waits on five opinions and none of them can say what their input changes.
Risk
Risk Matrix
For putting every risk on a grid of how likely and how bad, so attention and money go to the ones that are both. Leave it alone when the decision turns on precise quantities, such as reserving or insurance; a grid cannot carry that weight. Instead Quantitative risk analysis by someone qualified; reserving, insurance and safety cases need numbers, not a grid.
The structure now needs something to manage. Put every identified risk on the likelihood and impact grid, give each one a response posture and an owner, and let the top-right corner set the agenda. The matrix is triage rather than measurement, and its real job here is to connect the machinery you have just built: each significant risk gets an owner in the first line, oversight in the second, and a place on the board's assurance map. A risk register with no names attached is just a list of worries.
Watch forA register reviewed annually and returning the same picture every time is recording effort rather than managing anything.
In the end
You should finish with four documents that reference each other: an allocation of risk roles across the three lines, a decision chart with named D's, a task grid with one accountable per row, and a live, owned risk register. Here is the caveat I give every client: the structure distributes the work on risk, and it guarantees nothing about how well that work is done. Governance on paper gets tested in calm weather. The real test arrives when the numbers are bad and the deadline is close. Book the first review before you sign off the design, because that is the moment most governance quietly dies.