Form 1: Proposal for a new field oftechnical activity
Circulation date:2016-05-13
Closing date for voting:2016-08-13
Proposer:

Reference number(to be given by Central Secretariat)

BSI

260

ISO/TS/P

A proposal for a new field of technical activity shall be submitted to the Central Secretariat, which
will assign it a reference number and process the proposal in accordance with the ISO/IEC
Directives (part 1, subclause 1.5). The proposer may be a member body of ISO, a technicalcommittee, subcommittee or project committee, the Technical Management Board or a General
Assembly committee, the Secretary-General, a body responsible for managing a certification system
operating under the auspices of ISO, or another international organization with national bodymembership. Guidelines for proposing and justifying a new field of technical activity are given in the
ISO/IEC Directives (part 1, Annex C).
The proposal (to be completed by the proposer)
Title of the proposed new committee (The title shall indicate clearly yet concisely the new
field of technical activity which the proposal is intended to cover.)

Organizational Governance

FORM 1 – Proposal f or a new f ield of technical activ ity
Version 01/2015

Scope statement of the proposed new committee (The scope shall precisely define thelimits of the field of activity. Scopes shall not repeat general aims and principles
governing the work of the organization but shall indicate the specific area concerned.)Standardization of organizational governance, including aspects of accountability, direction and control which may include principles of governance, anti-bribery, conflict of interest, due diligence, whistleblowing,
compliance, remuneration structures and external reporting, amongst others.
This proposal is for a new technical committee in the field of organizational governance. For the purposesof this proposal, governance may be defined as a "system by which the whole organization is directed,
controlled and held accountable to achieve its core purpose over the long term". The term “corporate
governance” is typically used for the governance of private and publicly-listed companies.
The TC would develop and maintain standards applicable for all organizations to improve the effective
delivery of governance. This proposal recognizes that, although interrelated, there is an importantdistinction between management and governance. The above definition of governance places it into acontext of accountability whereas management can be deemed to be "the act of bringing people together
to accomplish desired goals and objectives, using available resources in an efficient, effective and riskaware manner." While governance is linked to management, it is distinct from it because it deals with theaccountability of a whole organization to all of its stakeholders and helps ensure that the organization, as awhole, fulfils its full purpose. Thus, governance is a unique area that merits a dist inct portfolio of work,
separate but complementary to management standards.
The portfolio of work would be applicable to all types and sizes of organizations, whether large orsmall, public or private, listed or unlisted, not-for-profit or for-profit, etc.

Proposed initial programme of work (The proposed programme of work shall correspondto and clearly reflect the aims of the standardization activities and shall, therefore, show
the relationship between the subject proposed. Each item on the programme of work shallbe defined by both the subject aspect(s) to be standardized (for products, for example,
the items would be the types of products, characteristics, other requirements, data to besupplied, test methods, etc.). Supplementary justifica tion may be combined withparticular items in the programme of work. The proposed programme of work shall alsosuggest priorities and target dates.

See Annex A (attached)

Indication(s) of the preferred type or types of deliverable(s) to be produced under the
proposal (This may be combined with the "Proposed initial programme of work" if moreconvenient.)

All types of ISO deliverables are potential options depending on the specific proposal. It is consideredappropriate to consider requirements, guidance, PAS, technical specifications, and technical reports aspotential deliverables.

FORM 1 – Proposal f or a new f ield of technical activ ity
Version 01/2015

A listing of relevant existing documents at the international, regional and national levels.
(Any known relevant document (such as standards and regulations) shall be listed,regardless of their source and should be accompanied by an indication of theirsignificance.)

The TC work programme would complement existing standards, such as :ISO 19600: 2014 - Compliance management systems - Guidelines
ISO 37001 - Anti-bribery management systems - Requirements with guidance for use (due to publish
by Dec 2016)
ISO/IEC 38500:2015 - Information technology - Governance of IT for the organization
ISO 31000:2009 – Risk Management - Principles and guidelines
ISO /IEC 31010:2009 - Risk management - Risk assessment techniques
ISO Guide 73:2009 - Risk management - Terminology
ISO 26000:2010 - Guidance on social responsibility
ISO 9001:2015 - Quality Management Systems - Requirements
BS 13500:2013 - Code of Practice for delivering effective governance of organizations
PAS 1998:2008 -Whistleblowing arrangements: Code of practice
AS 8000:2003 - Corporate Governance: Good governance principles
OECD - Principles of Good Governance
There is existing national public policy, legislation and regulation related to governance good practice,including but not limited to:- APEC-OECD, 2005, Integrated Checklist on Regulatory Reform(http://www.oecd.org/regreform/34989455.pdf)- European Commission, 2001, European Governance: A White Paper, Brussels (http://eurlex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52001DC0428&qid=1461693776489&from=EN)- OECD, 2009, Indicators of Regulatory Management Systems, Regulatory Policy Committee(http://www.oecd.org/gov/regulatory-policy/44294427.pdf)- the OECD’s 2012 Recommendation of the Council on Regulatory Policy and Governance(http://www.oecd.org/gov/regulatory-policy/49990817.pdf) outlines best practices for public sector
governance.
- World Bank: International Finance Corporation (IFC), 2010, Better Regulation for Growth: Regulatory
Governance in Developing Countries (http://wwwwds.worldbank.org/external/default/WDSContentServer/WDSP/IB/2010/07/13/000334955_20100713050
729/Rendered/PDF/556450WP0Box0349461B0GovReg01PUBLIC1.pdf)- World Trade Organization, Committee on Technical Barriers to Trade, Compilation of sources on good
regulatory practice: Background Note by the Secretariat (G/TBT/W/341), 13 September 2011(http://www.wto.org/english/tratop_e/tbt_e/tbt_work_docs_e.htm)
The above list is not exhaustive. The suggested TC work programme is NOT intended to replace or negate
existing national policy, regulation and legislation but to support it. The range of international guidancecontained within the above list illustrates that while there are many significant documents that should beconsidered, there is a global need for internationally recognized ISO standards in governance in order topull together all relevant information. Through their openness and independence, ISO standards have thenecessary legitimacy and degree of market acceptance to be used as tools to support the implementationof regulation and public policy initiatives. They can support risk-based regulation by providing information
to help target government intervention where it is most needed.
This TC would not seek to influence the development of regulation, public policy or interpret international
treaties as specified in the ISO/IEC Directives, Part 1 – Consolidated ISO Supplement – Procedures specificto ISO – Annex SO.

FORM 1 – Proposal f or a new f ield of technical activ ity
Version 01/2015

A statement from the proposer as to how the proposed work may relate to or impact on
existing work, especially existing ISO and IEC deliverables. (The proposer should explain
how the work differs from apparently similar work, or explain how duplication and conflict
will be minimized. If seemingly similar or related work is already in the scope of othercommittees of the organization or in other organizations, the proposed scope shalldistinguish between the proposed work and the other work. The proposer shall indicate
whether his or her proposal could be dealt with by widening the scope of an existingcommittee or by establishing a new committee.)

Every effort would be made to ensure any new work is complementary and not in conflict or competingwith established ISO committees and their work portfolios. To do this, the new TC would need to liaise
with other TCs and consider relevant standards (see list of relevant existing documents) regarding how
governance is referenced in these standards - and to examine their inter-dependencies – while recognizingthat organizational governance is a distinct and very important area that requires its own, unique (butcomplementary) programme of work.
Organizational governance is very important to many technical committees such as risk management,
continuity, environment, sustainability, quality, and information security. Governance is an integral part oftheir activities. For example, governance is an essential aspect of risk management. It’s essential tointegrate the management of risk into the organization’s overall governance, strategy and planning,
management, reporting processes, policies, value and culture. Good risk management is seen as the basis
for providing effective governance within an organization. It is therefore important that there is a liaison
with ISO TC/262 – Risk management – because although the principles and terminology of risk
management and risk assessment techniques are well covered in ISO 31000, Guide 73 and ISO/IEC 31010,
there is a need for more detailed information on governance and risk management and how theyinterrelate.
Governance in the context of social responsibility is also very important and the ISO 26000 PPO SAG is an
important stakeholder group. ISO 26000 highlights that effective governance should be based onincorporating the principles of social responsibility into decision making and implementation. In thecontext of ISO 26000, organizational governance has the special characteristic of being both a “coresubject” on which organizations should act and a means of increasing the organization's ability to behave ina socially responsible manner. Consideration of this standard and liaison with the ISO PPO SAG will help
ensure the relationship and interdependence between social responsibility and governance is clear andcomplementary.
The new TC would need to establish liaisons and consider the relationship between governance andmanagement standards (such as quality management) recognizing that while governance is an integral partof management standards, there is an important distinction between “management” and “governance”.
For this proposal, management may be considered as the act of bringing people together to accomplish
goals and objectives, and using available resources in an efficient, effective and risk-aware manner whereas
governance deals with the accountability of a whole organization to all of its stakeholders and helps ensurethat the organization, as a whole, fulfils its full purpose.
Recognizing that relevant standards exist or are being developed for compliance and anti-bribery within
Project Committees, it is proposed that it would be beneficial to include the responsibility for maintaining
these standards into this permanent TC structure.

FORM 1 – Proposal f or a new f ield of technical activ ity
Version 01/2015

A listing of relevant countries where the subject of the proposal is important to theirnational commercial interests.

During the development of the proposal, BSI has engaged with a range of stakeholders who recognize theimportance of having effective governance to help enable the governing body to be accountable to all of
their stakeholders for everything undertaken by their organizations. Small organizations, where there
may only be a sole trader who owns, governs and manages their business, as well as large organizations,where governance is the responsibility of the board - all need to apply the principles of good governancefor sustainable success.
Recognizing the importance of organizational governance, SAC (China) has expressed an interest in the
proposed new TC and a potential twinning agreement will be explored if the new TC is approved. Likewise,
DSM (Malaysia) and SON (Nigeria) have also recognized the vital role good governance and whistleblowing
play and have expressed interest in potential twinning arrangements for those work items. In the course of
discussions with members of ISO PC/271 – Compliance and ISO PC/278 – Anti-bribery management
systems – experts from many other countries have expressed interest or a willingness to participate
including Austria, Canada, Brazil, South Korea, Germany, Malaysia, France, Argentina, Russia, Japan,
Australia, and Switzerland. (It is noted that this engagement is at expert level and full consultation withthose members has not yet taken place).
Governance is of great importance to all countries because of the “high correlation between the quality of
governance and per capita income. And statistical analysis has proven that good governance improves
economic performance rather than vice-versa. The concrete example is Singapore, which by transforming
into one of the least corrupt countries in the world, is fast becoming one of the world’s booming
economies". Please see:
http://europeandcis.undp.org/blog/2012/05/23/3-reasons-why-you-should-care-about-good-governanceAccording to the Organization for Economic Development (OECD), “The presence of an effective corporate
governance system, within an individual company and across an economy as a whole, helps to provide adegree of confidence that is necessary for the proper functioning of a market economy. As a result, thecost of capital is lower and firms are encouraged to use resources more efficiently, thereby underpinninggrowth.” Please see:
http://www.oecd.org/daf/ca/corporategovernanceprinciples/31557724.pdf
It is recognised that this is a complex area and it is likely that stakeholders will have specific suggestions on
the scope of the work. BSI propose to host the inaugural meeting of the new TC, in November, in London,in order to obtain and understand feedback, encourage membership, consider the scope, and obtain viewson the suggested work programme.

FORM 1 – Proposal f or a new f ield of technical activ ity
Version 01/2015

A listing of relevant external international organizations or internal parties (other ISO
and/or IEC committees) to be engaged as liaisons in the development of thedeliverable(s). (In order to avoid conflict with, or duplication of efforts of, other bodies, it
is important to indicate all points of possible conflict or overlap. The result of any
communication with other interested bodies shall also be included.)

There are many stakeholders and interested parties and we anticipate there will be further organizations
identified during the consultation phase. The following list is not intended to be exhaustive:
BASEL Institute on GovernanceWorld Bank
UN International Strategy for Disaster Reduction (UNISDR)
European Corporate Governance Institute (ECGI)
Organization for Economic Co-operation and Development (OECD)The Governance Institute (ICSA)International Chamber of Commerce (ICC)
World Intellectual Property Organization (WIPO)
Transparency International
International Forum on Business Ethical Conduct (IFBEC)
In addition to the above, liaison committees may include at least the following:
ISO TC/262 - Risk management
ISO TC/268 - Sustainable Development in Communities
ISO TC/292 - Security and Resilience
ISO PC/271 - Compliance Management
ISO 26000 - PPO SAG
ISO/IEC JTC 1SC 40 WG 1 - Governance of Information Technology
ISO PC/278 - Anti-bribery management systems
ISO/TC 176 Quality management and quality assurance

FORM 1 – Proposal f or a new f ield of technical activ ity
Version 01/2015

A simple and concise statement identifying and describing relevant affected stakeholder
categories (including small and medium sized enterprises) and how they will each benefit
from or be impacted by the proposed deliverable(s).

Appreciating the wide range of potential stakeholders and the number of relevant existing documents
already in existence, this new ISO TC will bring together relevant stakeholders in order to consolidate goodpractice and develop a portfolio of work that would provide clarity for delivering effective governance oforganizational performance.
Organizational governance is the most crucial factor in enabling an organization to achieve its goals and to
take responsibility for the impacts of its decisions and activities. The stated and potential activities are
relevant to all those involved in governance at all levels of an organization, from sole traders to multinational organizations. This includes:- an organization's stakeholders;- governing body members and officers;- senior executives who report directly to governing bodies;- other managers/supervisory personnel and their teams; and- governance advisers and regulators.
Good governance positions organizations for success - all organizations can benefit from this work
regardless of their size or sector. For example, in a small organization, there may be only a sole trader who
owns, governs and manages their business. Complex, formal arrangements are not necessary but applying
the principles of good governance is still important for sustainable success. In a large organization,
ownership may be dispersed between many shareholders with governance being the ultimate
responsibility of the board and management being delivered by executives via teams of employees. Whilst
the accountabilities and roles are different, each has a role to play in supporting the success of the whole.
The establishment of this TC would provide an opportunity for the consolidation of ISO's governancerelated work which would in turn provide benefits for participating experts and stakeholders e.g. ease ofidentifying the appropriate committee and minimizing the need to attend separate meetings.

An expression of commitment from the proposer to provide the committee secretariat if the
proposal succeeds.

BSI would provide the Secretariat and Chair of the new TC (CV of proposed TC Chair - Mr Howard
Shaw - is included for information as Annex B). BSI will discuss potential twinning arrangements at the
Secretariat level with SAC should the proposal be approved.
As previously indicated, interest has also been received in leadership or twinning agreements from DSM
and SON for the projects on organizational governance and whistleblowing, respectively.

FORM 1 – Proposal f or a new f ield of technical activ ity
Version 01/2015

Purpose and justification for the proposal. (The purpose and justification for the creation ofa new technical committee shall be made clear and the need for standardization in thisfieldshall be justified. Clause C.4.13.3 of Annex C of the ISO/IEC Directives, Part 1 contains amenu of suggestions or ideas for possible documentation to support and purpose andjustification of proposals. Proposers should consider these suggestions, but they are notlimited to them, nor are they required to comply strictly with them. What is most important isthat proposers develop and provide purpose and justification information that is most
relevant to their proposals and that makes a substantial business case for the market
relevance and the need for their proposals. Thorough, well -developed and robust purpose
and justification documentation will lead to more informed consideration of proposals andultimately their possible success in the ISO IEC system.)This proposal is for the establishment of a new ISO technical committee on Organizational Governance to be
responsible for developing and maintaining standards in the area of governance (including whistleblowing, , antibribery, due diligence, compliance, etc.). It would also strive to communicate and disseminate the committee'sdeliverables as widely as possible. Organizations of all types and sizes need to have good governance in place as it will
increase accountability, effectiveness, and fairness in organizations and help avoid major incidents. It will also help
position organizations for success by establishing accountability, direction and control.
The need for good governance is increasingly clear as society’s expectations of organizational behaviours andperformance, and thus “governance”, are rising. This is highlighted by a steady flow of major incidents and percei vedabuses of authority. Enron, Lehman Brothers, FIFA, and other high-profile incidents demonstrate just how essential
good governance is to organizations.
For this proposal, governance is tentatively defined as "the system by which the whole organization is directed,
controlled and held accountable to achieve its core purpose over the long term". This TC would consolidate theavailable guidance, recommendations, and requirements relating to organizational governance but it is not intended
to replace or negate existing guidance, regulations and legislation. Instead, it would develop and maintaininternationally recognized ISO standards that have the necessary degree of legitimacy and market acceptance to be
used as tools to support policy delivery.
The proposed guidance on organizational governance and whistleblowing could be based upon several well regarded
national documents that can be used as the basis for ISO standards (see list of existing documents). For example, BS
13500 - Organizational Governance – has been widely implemented (including translation into other languages such
as Mandarin). Case studies from BS 13500 illustrating how governance standards can benefit small as well as largeorganizations, can be found at: http://www.bsigroup.co.uk/en-GB/bs-13500-organizational-governance/casestudies/.
BSI PAS 1998 - Whistleblowing has also been valuable for organizations and there is a strong interest to use thisdocument as the basis for an ISO standard. BS 10501 on Anti-bribery has also been enormously successful globallyand was used in the development of ISO 37001 – ABMS- with guidance for use – which has already received
considerable attention.
In considering the data on the users of key British Standards in this area (BS 13500 on effective governance, BS 10500
on anti-bribery management systems and PAS 1998 on whistleblowing arrangements), BSI has noted significant
evidence of multinational interest. The international interest in this work has also been expressed by otherinternational stakeholders including experts engaged in PC/271 (Compliance management) and PC/278 (Anti-bribery).
This proposal includes the possibility of developing an International Standard on the fundamentals of good
governance as well as supporting existing documents and ISO groups doing valuable work in this area. There is aneed, and international support, for an ISO TC to bring together global stakeholders in organizational governance tocoordinate, develop and maintain a portfolio of ISO standards in this area.
In order to encourage membership and liaisons, consider the scope, TC structure and the work programme (including
preliminary work items on governance and whistleblowing) BSI suggest a meeting of the TC be held, in London,
November 2016.

FORM 1 – Proposal f or a new f ield of technical activ ity
Version 01/2015

Signature of the proposer
Amanda Richardson, BSI

Further information to assist with understanding the requirements for the items above can be foundin the Directives, Part 1, Annex C.

FORM 1 – Proposal f or a new f ield of technical activ ity
Version 01/2015

ANNEX A – Proposed initial programme of work
Proposed initial programme of work (The proposed programme of work shall correspond toand clearly reflect the aims of the standardization activities and shall, therefore, show the
relationship between the subject proposed. Each item on the programme of work shall bedefined by both the subject aspect(s) to be standardized (for products, for example, theitems would be the types of products, characteristics, other requirements, data to besupplied, test methods, etc.). Supplementary justification may be combined with particular
items in the programme of work. The proposed programme of work shall also suggest
priorities and target dates.

The proposed TC would help consolidate the large number of activities in this area and help ensure a
consistent approach to organizational governance, whistleblowing, anti-bribery and complianceactivities. The proposed programme of work (below) addresses key areas in need of standardization
as well as the inclusion of existing standards as a means of ensuring they are maintained andpromoted effectively.
New Work Item Proposal: Corporate Governance – Guidance
A general, high-level, guidance standard providing definitions, principles, and recommendations forthe delivery of effective governance for organizations. It would identify what governance needs toprovide for all organizations, such as:- a governance framework (including policy / standard- setting process, and auditing of governancecontrols);- accountability, (including stakeholder identification, governing body authority and accountability,
governing body composition, code of behaviour, and succession planning);- vision and strategic outcomes;- risk limits (including ethical / public interest commitments, planning and budgeting, procurement,
treatment of employees, etc)
This guidance would recognize that for many organizations, there may be additional sector-specificgovernance requirements, laws and regulations with which they need to comply.
A draft outline is included as Annex C which could serve as the basis for a new work item but there
are other standards that should also be considered, such as AS 8000 - Corporate Governance: Good
Governance Principles.
Should this work item be approved, a working group might be established, reporting to the TC, forwhich the Department of Standards Malaysia (DSM) have expressed an interest in a twinningagreement. Given the interest and documents suggested for consideration by several countries forthis possible guidance, it is suggested that this standard might be developed within 24 months.
New Work Item Proposal on Whistleblowing – GuidanceWhistleblowing serves as an important instrument of good governance. Whistleblowing is the
popular term used when someone who works in or for an organization raises a concern about apossible fraud, crime, danger or other serious risk that could threaten customers, colleagues,
shareholders, the public or the organization’s own reputation. The TC would develop good practice
regarding the introduction, revision, operation and review of effective whistleblowing arrangements.

Should this work be approved, a working group might be established, reporting to the TC, for which
Standards Organization of Nigeria (SON) have expressed an interest in a twinning as the work ties inwell with recent legislation in Nigeria. Topics covered by such a standard may include:- why organizations encourage whistleblowing;- key elements of effective arrangements and the risks of ineffective arrangements;- who should take the lead for arrangements and the role of management;- introducing and updating a policy and rolling out a scheme
The BSI publication, PAS 1998 'Whistleblowing arrangements - Code of Practice' is freely available at(https://shop.bsigroup.com/forms/PASs/PAS-1998) and is but one document that could serve as thebasis for this new work item – there are others. The number of downloads for this PAS(approximately 3,000), would support the need for guidance in this area. Noting the interest andoffers to provide expertise, it's suggested that a 24 month development schedule could be adopted.
Given the general desire to consolidate and rationalise the ISO portfolio where possible, theproposed TC could also assume responsibility for the systematic reviews of related standards thathave been developed in project committees, ISO PC/271 – Compliance and ISO PC/278 - Anti-bribery
management system.
ISO 19600 - Compliance management systems – Guidelines
Compliance is an essential aspect of good governance. This standard was published in 2014 by ISO
PC/271 and provides guidance for developing, implementing, evaluating, maintaining and improving
an effective compliance management system based on the principles of good governance,
proportionality, transparency and sustainability. Standards Australia (SA) provided the Chair andSecretariat for PC/271; however, the committee is now disbanded with no technical body currently
responsible maintenance of the standard. Given the important link between compliance andgovernance, the new TC could include responsibility for the maintenance of ISO 19600 and further
developments in the area of compliance. A working group might be established, reporting to theTC, comprising former members of ISO PC/271 as well as new stakeholders.
ISO 37001 - Anti-bribery management systems - Requirements with guidance for use is being
developed within ISO PC/278 – Anti-bribery management systems (BSI Chair and Secretariat) and isdue to publish December 2016. As a Project Committee, the group will be disbanded soon after
publication. The standard sets out requirements and provides guidance for a management systemdesigned to help an organization to prevent, detect and address bribery and comply with antibribery laws and voluntary commitments. ISO 37001 describes bribery as “the offering, promising,giving, accepting or soliciting of an undue advantage of any value (which could be financial or nonfinancial), directly or indirectly, and irrespective of location(s), in violation of applicable law, as an
inducement or reward for a person acting or refraining from acting in relation to the performance ofthat person's duties”. This is another key area of governance and the TC could also be responsiblefor its maintenance after publication. A working group might be established, reporting to the TC, tomaintain this standard comprising members of PC/278 and new stakeholders.
Should this proposal be accepted, the TC work programme and TC structure could be discussed at a
meeting, tentatively, in November 2016, in London.

Annex B
Howard Shaw – Director, Head of Anti-Bribery &Corruption Services, Mazars, LLP
Howard Shaw is a fraud and corruption risk management
specialist. He advises companies, NGOs and government
agencies on the management of dishonesty and, inparticular, corruption risk. He lectures internationally on
fraud and corruption risk management and on good
corporate investigation practice.
Howard is a Director and the Chair of the Institute of Counter Fraud Specialists (www.ICFS.org.uk).
He is also the Chair of the British Standards Institution (BSI) Anti-Bribery Committee and serves as UK Delegation
Leader to ISO PC/278 – Anti-bribery management systems - responsible for the development of ISO 37001 – Antibribery risk management systems – Requirements with guidance for use.
Howard has also enjoyed participating on the national committees involved in researching, developing andpromoting BS10500 - Anti Bribery Management System, BS 13500 – Code of practice for delivering effective
governance of organizations and BS 10501 - Procurement Fraud Risk Management.
Howard is also an active member of the Fraud Advisory Panel and Transparency International.

Annex C – Outline for possible international guidanceon Organizational GovernanceFor consideration only. This text is based on BS 13500 - guidance for good governance.
source but there are other sources that should be considered.

It is one possible

Table of Contents

For Use Only by ISO members considering the BSI new work item proposal for a TC - Organizational Governance

Establishing an effective governance framework
Principles that underpin an effective governance framework
GeneralGovernance Accountability
Governance Direction
Governance Control
Implementing governance accountability
GeneralIdentify, consult with and report to relevant stakeholders
Exhibit leadership
Determine the organization’s best long-term interests
Sustain clarity on organization’s purposes and values
Establish an effective governance culture
Establish governance competence and capacity
Recognize and respond appropriately to governance performance
Demonstrate sufficient transparency for accountability
Implementing governance direction
GeneralUnderstand and ensure the integrity of founding documentation
Understand the organization’s context
Establish and regularly review governance policies
Ensure governance policies set standards for all aspects of organizational performance
Establish governance role clarity
Uphold good delegation principles
Ensure that the ownership of policies is clear
Implementing governance control
GeneralSet out and embed governance controls
Ensure governance policies are monitored
Ensure appropriate response to monitoring results

Introduction
It is increasingly obvious that society’s expectations of organizational behaviours and performance, and thus
“governance”, are rising. This rise in expectations is partly in response to a steady flow of major incidents andperceived abuses of authority. However, the approach within this guidance is based on the evidence that good
governance positions organizations for success. Therefore, the scope of this guidance standard goes beyond
the avoidance or mitigation of problems.
There is a growing amount of sector level guidance on governance, but relatively little in the way of summarylevel definition of the fundamentals of good governance. This guidance seeks to address that deficiency. In
doing so it offers more detail on the important principles that lie behind much sector-specific guidance (forexample, by distinguishing different accountabilities to different stakeholders) and offers a baseline for allorganizations, including those for which sector-specific standards might not exist.
This guidance is intended to be used by those concerned with the governance of organizations to help ensurethat all the elements of a good governance framework are in place.
Defining “governance”
A key element of any standard is establishing terms and definitions, which is intended to help harmonize theuse of language in a particular subject or discipline.

This is particularly challenging in terms of governance, which is rapidly evolving, operates in all sectors andencompasses entire organizations of all descriptions.
Given the breadth of the scope of governance, the vocabulary used in this guidance has been designed to beas widely applicable and enduring as possible.
The first step in creating this document was to define “governance” in a manner applicable to all organizations
and explain how it differs from “management”. It was recognized that the words “governance” and“management” are sometimes treated as interchangeable, but that such usage does not aid the functional
clarity necessary for the delivery of effective governance.

For Use Only by ISO members considering the BSI new work item proposal for a TC - Organizational Governance

A widely used definition of governance in the corporate sector is: “the framework by which companies are
directed and controlled” (Cadbury Committee 1992).
A well-known variant from the not-for-profit sector is: “the frameworks and processes concerned with ensuring
the overall direction, effectiveness, supervision and accountability of an organisation” (Cornforth 2003).
At an international level, another widely known definition describes corporate governance as involving “a setof relationships between a company’s management, its board, its shareholders and other stakeholders” andproviding “the structure through which the objectives of the company are set and the means of attaining thoseobjectives and monitoring performance are determined” (OECD 2004).
For the purposes of this guide, a brief definition that places governance into a context of accountability may be
adopted:system by which the whole organization is directed, controlled and held accountable to achieve its core
purpose over the long term.
Management can be defined as the act of bringing people together to accomplish desired goals andobjectives, using available resources in an efficient, effective and risk-aware manner. Thus governance islinked to management, but is distinct from it because it deals with:a) the accountability of a whole organization to all its stakeholders; andb) ensuring that the organization as a whole fulfils its full purpose.
NOTE A simple way of describing the difference between management and governance is to say that management isabout “getting the work done”, whereas governance is about ensuring “that the right purpose is pursued in the right way
and that the organization continuously develops overall”.

This guide therefore identifies what governance, as distinct from management, needs to provide for allorganizations, appreciating that for many organizations there are additional sector-specific governancerequirements with which they need to comply.
Applicability
This guidance applies to the governance of all organizations. It is therefore applicable even to organizations inwhich the various ownership, governing and executive roles referred to in Clauses 4 and 5 can be performedby, or shared between, the same individuals.
In a small organization, there may be only a sole trader who owns, governs and manages their business. Complex, formal
arrangements are not necessary, but applying the principles of good governance is still important for sustainable success.
In a large organization, ownership may be dispersed between many shareholders, with governance being the ultimate
responsibility of the board and management being delivered by executives via teams of employees. Whilst theaccountabilities and roles are different, each has a role to play in supporting the success of the whole.

Who should read this guidance?
This guide is written from the standpoint that those who are accountable for the organization are ultimately
responsible for everything undertaken in that organization’s name. The people who fulfil this role comprise theorganization’s governing body (see Clause 2: “Terms and definitions” for more detail), and it is clearly in theirindividual and collective interests to ensure that effective governance is in place so that they can indeed beaccountable to all their stakeholders for everything undertaken by the organization.
Each individual governing body member is charged with ensuring that the organization is well governed, andgoverning bodies usually give their chairs special powers in this regard. However, the ultimate accountability

for ensuring effective governance rests with the governing body as a whole, operating by whatever decisionmaking rules it adopts, and cannot be delegated to the chair or any other officer or committee it appoints.
Similarly, depending on the size and scale of the organization, the governing body is likely to delegate theactual implementation of some aspects of governance to the executive (e.g. those accountable formanagement), who may in turn delegate to other team members. This, though, does not alter the governing
body’s accountability.

For Use Only by ISO members considering the BSI new work item proposal for a TC - Organizational Governance

The rationale for this guidance being written from the standpoint of the governing body is therefore twofold:
firstly, the governing body is ultimately accountable for governance and, secondly, given the wide range ofoptions for delegation, to do otherwise would be to add a level of complexity which would become difficult to
depict and understand.
There are many ways in which governance can be implemented in an organization, from one person doing
everything to many layers all having a part to play. Crucially, however, whoever is allocated a governance rolereports to the person who appointed them and, throughout however many layers of delegation might havebeen undertaken, the ultimate accountability for governance remains with the governing body.
Governing bodies need the understanding, support and scrutiny of their stakeholders and the more everyone
supports and appreciates the importance of good governance, the more achievable it becomes.
This international guidance is therefore intended to be read by all those involved in governance, at all levels inan organization. This includes all types of stakeholders, governing body members and officers, and senior
executives who report directly to governing bodies, as well as other managers and supervisory personnel andtheir teams, governance advisers and regulators.

For Use Only by ISO members considering the BSI new work item proposal for a TC - Organizational GovernanceThis standard gives recommendations and guidance for the effective delivery of governance. It is applicable toall organizations, whether large or small, public or private, listed or unlisted, not-for-profit or for-profit, and isintended to promote an integrated framework for effective governance that encompasses accountability,
direction and control.

Establishing a governance framework

For Use Only by ISO members considering the BSI new work item proposal for a TC - Organizational Governance

Governance exists to ensure that organizations fulfil their purposes successfully on behalf of those to whomthey are accountable. Delivering effective governance should therefore involve:a) clarifying the organization’s purpose and values in consultation with those on whose behalf it exists;b) identifying the risks involved in fulfilling the organization’s purpose in alignment with its values; andc) directing and controlling the organization in a manner that enables proper reporting.
Because governance is about the whole organization, those ultimately accountable for it should ensure thatthey encompass everything that the organization is and does.
The governing body should ensure that all aspects of governance are integrated into a single, holistic, open,
forward-looking, effective, efficient and empowering framework that starts and ends with accountability, and:a) encompasses accountability, direction and control;b) is consistently implemented throughout the organization; andc) includes everyone within the organization and its engagement with third parties.
3.3 The governing body should ensure that its governance is fully and accurately documented in founding
documentation and policies that integrate accountability, direction and control.
3.4 The governance system should be held in a central repository where documentation is provided to andfrom the accountability, direction and control components.
NOTE Keeping information in one place ensures that there is integration between the components and less risk of
duplication and wasted effort. The following documentation is referred to in this guidance and thus expected to beavailable.
a)Founding documentation of the organization (legal documents which establish the organization).

b)

Applicable regulatory documents (specific sector guidelines).

c)
Governing policies that establish role clarity and expectations of those involved, including what is to be
escalated and how.
d)

The organization’s controls and results of monitoring.

Principles that underpin effective governance
General
To be effective, the governance framework should encompass the principles of accountability, direction andcontrol set out in 4.2 to 4.4, and be implemented by the governing body and all its delegates in accordancewith Clause 5.

1

For Use Only by ISO members considering the BSI new work item proposal for a TC - Organizational Governance

Governance accountability•

The governing body should ensure that the organization is accountable to its shareholders orequivalent for the fulfilment of its overall long-term purpose and values, and to all its stakeholders forthe organization’s impact upon them.

•

The governing body should also determine what commitments to seek from particular groups ofstakeholders (for example, majority shareholders, employees and volunteers).

•

The governing body should exhibit leadership of the organization on behalf of its shareholders orequivalent, and create a culture of responsible treatment for all its stakeholders.

•

In order to determine the organization’s best long-term interests on behalf of its shareholders orequivalent, the governing body should understand the broad, long-term external and internal context
in which the organization is operating.

•

The organization’s purpose should be clear at all times and focused on the creation of value forshareholders or equivalent in terms of specified benefits (whether for shareholders or others), secured
in a manner that reflects appropriate values regarding prudence and ethics.

•

The governing body should recognize that organizational culture, whether deliberately created or not,is a crucial determinant of everyone’s behaviour. A good governance framework demands good
behaviour, but it cannot deliver good behaviour – only people can do that. Written policies can be
powerful, but can also be displaced by unwritten rules. Similarly, from the perspective of stakeholders,an organization with a good governance framework is more likely to be trustworthy, but only ifeveryone fulfils their respective accountabilities within it. Therefore, the governing body should
deliberately create an effective governance culture.

•

In order to underpin its accountability, the governing body should ensure the competence andcapacity of its members and its delegates to fulfil their governance accountabilities.

•

Accountability should include recognizing and responding appropriately to governance performance.

•

Openness creates trust, which is crucial to the flow of information required for accountability.
Openness also enhances the quality of decision-making and the relationships that are the core ofeffective governance. The governing body should therefore ensure sufficient openness to allow foraccountability.

Governance direction

2•

The governing body should ensure that its governance framework is underpinned by sound founding
documentation.

•

The governing body should translate the organization’s purpose and values, as developed on behalfof its shareholders or equivalent, into clearly established and regularly reviewed expectations that
direct itself and those to whom it delegates.

•

In order to ensure that its expectations are appropriate, the governing body should thoroughly
understand the external and internal context within which its decisions need to be made.

•The governing body’s expectations should be stated in governance policies, and thereafter regularly
reviewed and updated as necessary, to ensure that they remain aligned with the organization’s
founding documentation and its changing context.

•

The governing body should ensure that its governance policies set appropriate standards for all
aspects of organizational performance.

•

The governing body should ensure that its policies clarify the roles of all involved in governing andoperating the organization in terms of their authorities, accountabilities, performance standards andreporting requirements.

NOTE
The governing body may choose to delegate many of the tasks involved in implementing governance andoperating the organization to others, but it is still ultimately accountable for their completion to its stakeholders.
The only aspects of governance that cannot be delegated by the governing body are its ultimate accountability to thosestakeholders who are its shareholders or equivalent. This accountability is for stating the expectations of the organization
on behalf of its shareholders or equivalent, and assuring that those expectations are being met.

For Use Only by ISO members considering the BSI new work item proposal for a TC - Organizational Governance

Where aspects of governance and operating the organization are delegated, the governing body’s role is to ensure
oversight and challenge to ensure that what is supposed to be achieved or done is actually being achieved or done.

•

The governing body should ensure that principles of good delegation are upheld. Delegates should
not be held accountable for things over which they have no authority or for expectations that have notbeen stated. Accountable people can delegate their authority to (and thereby give responsibilities to)others in order to get things done. However, it should be clear that these people remain accountable
for their delegate’s use of that authority.

•

The ownership of policies should be clear. Governance policies should belong to the governing bodyand not be open to change without the governing body’s agreement. Managers should be empowered
to create lower level policies within governing body policies.

Governance control•

The governing body should clearly establish and regularly review governance controls that arefounded on its expectations for the organization as stated in its governance policies.

•

The governing body’s controls should enable it to assure performance against, and respond todeviations from, its expectations such that risks to its stated direction can be managed.

•

The governing body should ensure that all its policies are monitored and assessed, and respond
appropriately to the results.

Implementing governance
Implementing governance accountability
GeneralTo ensure that the organization is accountable to all its stakeholders for fulfilment of its purpose and values,
the governing body should take the steps recommended in 5.1.2 to 5.1.9 (see Figure 2).
Identify, consult with and report to relevant stakeholders
The governing body should ensure that the organization is listening to and being accountable to the rightpeople for the right things in the right way by:a) understanding, agreeing and regularly reviewing which of its stakeholders are to be treated as the sourceof the organization’s purpose and values and to whom the governing body is therefore directly
accountable for the long-term direction and control of the organization, i.e.:
1)formal stakeholders: those to whom the governing body has a legal obligation to listen and report;
and2)

informal stakeholders: those to whom the governing body believes it has a moral obligation to listen
and report;b) sustaining an effective dialogue with, and reporting to, those stakeholders to whom the governing body
believes it is directly accountable [for relations with other stakeholders, see 5.2.4b)]; andc) determining what, if any, commitments to seek from particular groups of stakeholders (for example,
majority shareholders, employees and volunteers) to support the organization’s proper accountability to
them.

3

Exhibit leadership
The governing body and its delegates should exhibit leadership of the organization by:a) focusing on the best long-term interests of the organization on behalf of its shareholders or equivalent,and creating a culture of responsible treatment for all its other stakeholders;b) recognizing and clearly communicating its ultimate accountability for the organization; andc) being seen to place a priority on establishing a good governance culture and demonstrate theorganization’s values.

For Use Only by ISO members considering the BSI new work item proposal for a TC - Organizational Governance

Determine the organization’s best long-term interests
In order to determine the organization’s best long-term interests, the governing body should understand theorganizations long-term context in terms of:a) the results of its dialogue with those stakeholders to whom it regards itself as directly accountable as thesource of the organization’s purpose and values;b) the impact the organization has on all its stakeholders, including the public, taking particular account of
the vulnerabilities of those stakeholders and of the impacts of all stakeholders upon the organization;c) the organization’s current and likely future local, national and international, social, cultural, political,
financial, technological, economic, natural, competitive, contractual, legal and regulatory environment;d) the culture and ethics needed to support effective governance; ande) ensuring the resilience, and thus long-term sustainability, of the organization (unless the organization’s
formal stakeholders specify otherwise, for example when an organization is set up for a specific shortterm purpose, such as staging a single event).
Sustain clarity on organization’s purposes and values
The governing body should provide consistent and clear leadership with regard to the organization’s purpose
and values on behalf of those to whom it regards itself as directly accountable by:a) deciding upon and regularly reviewing the purposes in the form of a broad long-term vision for theorganization;b) deciding upon and regularly reviewing the strategic outcomes to deliver the organization’s vision, taking
account of the organization’s current and likely future context and the risks inherent in that context andin the potential modes of operation to achieve the desired outcomes; andc) maintaining focus on the primary strategic outcomes and addressing the main risks that apply to themrather than on the details involved in accomplishing them, so that strategic plans and goals flow fromthe selected strategic outcomes in a manner that encourages innovation and agility within appropriate
governance controls.
Establish an effective governance culture
The governing body should ensure that effective governance becomes embedded in the organization’s cultureby:a) ensuring that all those involved (stakeholders, governing body members, employees and volunteers) areaware of the importance of governance and how they contribute to its effectiveness;b) ensuring that all those involved (stakeholders, governing body members, employees and volunteers) areaware of, and are encouraged to use, channels by which they can raise governance concerns without
fear of reprisal; and4c) ensuring that members of the governing body and its delegates demonstrate commitment to effective
governance, by their actions not merely their words, in an atmosphere of openness and mutual support
Establish governance competence and capacity
The governing body should ensure governance competence and capacity by:a) ensuring that the governing body is composed of diverse, competent and diligent persons who
understand the principles of good governance and the strategic position of the organization sufficiently
to direct, control and be held accountable for its long-term success;

For Use Only by ISO members considering the BSI new work item proposal for a TC - Organizational Governanceb) ensuring that all those with governance authorities and accountabilities are competent to perform therequired tasks, e.g. by appropriate training of governing body members;c) assessing the maturity and adequacy of the organization’s current governance processes, competencies
and understanding, and, therefore, the approach to be adopted to engage stakeholders and implement
effective governance; andd) giving appropriate attention and resources to achieve effective governance
Recognize and respond appropriately to governance performance
In order to recognize and respond appropriately to governance performance, the governing body should:a) assess the actual performances of those with governance responsibilities, including members of thegoverning body itself, and take the necessary actions to address any issues;b) recognize and demonstrate the understanding that learning from failure and success is an inherent part oflong-term success, and provide additional training where unintended failures occur;c) acknowledge, celebrate and demonstrably reward governance good practice, warnings of potential
failures or abuses and the capture of learning that comes from dealing with problems; andd) recognize, acknowledge and impartially apply disciplinary or other grievance processes for instances ofdeliberate abuse, or lack of application, of the governance framework.
Demonstrate sufficient transparency for accountability
The governing body should ensure that decisions and activities that affect stakeholders, including the public,
are properly documented, visible and communicated in a clear, accurate, timely, honest, complete and open
manner.
The governing body and its executive should disclose as much information as is necessary to evidence properaccountability.
•

Openness should involve disclosure of:a) the organization’s processes, both of governance and accountability as a whole; andb) specific activities, decisions and impacts where these affect stakeholders or the general public.
•

Transparency should involve disclosure either to:a) one or more specific stakeholders where the information directly concerns matters that affect them; orb) the general public where the information concerns matters affecting the public interest.
•

The conflict of interest.

•

The decision on disclosure that the organization has reached.

5Implementing governance direction
GeneralIn order to direct the organization in an appropriate manner, the governing body should translate theorganization’s purpose and values into clearly established and regularly reviewed expectations that direct
itself and its delegates by taking the steps recommended in 5.2.2 to 5.2.8
Understand and ensure the integrity of founding documentation

For Use Only by ISO members considering the BSI new work item proposal for a TC - Organizational Governance

The governing body should ensure that all its expectations are set within a good understanding of theorganization’s founding documentation and that such documentation:a) defines and enables the organization’s full potential scope of operation to which governance is to be
applied;NOTE The organization’s scope of operation may be set out in its mission statement.

b) clarifies the governing body’s formal accountability to its stakeholders [see 5.1.2a)] in terms of bothconsultation and reporting;c) provides for appropriate formal stakeholder impartiality in the appointment, remuneration, roles andtermination of members of the governing body; andd) provides the basics needed to establish the appropriate composition of the governing body to reflect thediversity of perspectives of, and best interests of, all those stakeholders who are shareholders orequivalent to shareholders.
Understand the organization’s context
In order to ensure that its expectations are appropriate the governing body should thoroughly understand theexternal and internal context within which its decisions need to be made. Understanding the organization’scontext should involve considering:a) the results of the governing body’s consideration of the organization’s long-term best
determined in accordance with 5.1.4;

interestsasb) the results of the organization’s dialogue with its formal and informal stakeholders as determined inaccordance with 5.1.2;c) the capabilities and parameters that influence how the organization tries to achieve its objectives andmanages the risks to those objectives; andd) the culture and ethics needed to support effective governance.
Establish and regularly review governance policies
In order to provide direction, the governing body should comprehensively state, and thereafter regularly review
and update as necessary, its governance policies to ensure that they remain aligned with the organization’s
founding documentation and its changing context. Governance policies should state:a) the identity of, and governing body’s relationship with, those stakeholders to whom the governing body
believes it is legally or morally directly accountableb) the identity of any other internal or external stakeholders (such as customers, employees, regulators,
suppliers and local communities) and the nature of the organization’s accountabilities and relationships
with them;c) the organization’s purpose in terms of the vision and strategic outcomes it exists to produce;d) the limits on the risks that the governing body is willing for the organization to take in producing thestrategic outcomes;

6e) the arrangements in the event of unexpected crises in relation to communications, continuity andrecovery;f) the process by which the governing body governs its own work, including that of its officers andcommittees, to ensure it carries out its responsibilities within the governance framework and guards
against biases, abuses and unmanaged conflicts of interest;g) the process by which the governing body governs the work of its direct delegate(s) to ensure theaccountability of everyone in the organization for establishing sufficient operational controls to deliver
governance policies (see 5.3);

For Use Only by ISO members considering the BSI new work item proposal for a TC - Organizational Governanceh) the arrangements for designing, implementing, monitoring, reviewing and continually improving
governance controls throughout the organization;i) the arrangements for the proper safekeeping, updating and distribution of all governance documentation,
including evidence of the implementation of the operation of its controls and correspondence withstakeholders and any other interested parties.
Ensure governance policies set standards for all aspects of organizational performance
The governing body should ensure that its governance policies provide direction in a manner that enables
control and therefore accountability. Therefore, the governing body should ensure that its governance policies
set standards for accomplishment relating to:a) the organization’s purpose and strategic outcomes;b) the desired manner of achievement and all areas of related risk; andc) the adequacy of its governance performance, including its succession planning.
Establish governance role clarity
The governing body should ensure that it has a single framework of direction and control within which theauthorities, accountabilities, performance standards and reporting requirements of all involved in governingand operating the organization are clearly defined by:a) ensuring that the governing body, its officers, committees, executive and other delegates have clearly
documented authorities, accountabilities, rules of conduct and reporting requirements to be observed inmatters of governance (for example, in governing body policies, job descriptions or terms of reference
and codes of conduct); andb) ensuring that the executive, in its turn, has a clear framework for ensuring the authority and accountabilityof all its delegates in fulfilling the governing body policies.
Uphold good delegation principles
The governing body should ensure that principles of good delegation are upheld by:a) ensuring that its delegates are only held accountable for those matters over which they have been given
authority;b) stating its expectations of its delegates;c) remaining accountable for its delegates’ use of its authority by ensuring that all its expectations aremonitored;d) ensuring that its delegates are clear about how to escalate matters that exceed their authority; ande) ensuring that its delegates are clear about their ability to secure relevant support.

7Ensure that the ownership of policies is clear
Governance policies should belong to the governing body and not be open to change without the governing
body’s agreement. Managers should be empowered to create lower level policies within governing body
policies.

Implementing governance control
GeneralFor Use Only by ISO members considering the BSI new work item proposal for a TC - Organizational GovernanceIn order to assure itself that its expectations of itself and the organization are being fulfilled, the governing
body should ensure that control is clearly established and regularly reviewed, to protect and enhance theorganization’s long-term value by taking the steps recommended in 5.3.2 to 5.3.4 (see Figure 4).
Set out and embed governance controls
The governing body should clearly establish and regularly review governance controls founded on its
expectations for the organization as stated in its governance policies. The governing body’s controls should:a) enable it to assure performance against, and respond to deviations from, its expectations such that risks
to their fulfilment can be managed; andb) include: 1) the relevant governance policies and 2) the metrics or other performance indicators used to
track and report on the success or otherwise of the implementation of its policies by itself, its executive
and all involved.
Governance policies that clearly set out the governing body’s risk tolerance levels (such as a spending limit) can be
described as preventative controls. Regular monitoring against such polices can be described as detective controls.
Regular assessment and follow-up of deviations from policies could be described as mitigation controls.

The governing body should use its policies and policy monitoring to ensure that its controls are embedded in
all key organizational processes, including business planning and budgeting, job descriptions, reporting andevaluations.
Ensure governance policies are monitored
The governing body should monitor and assess the implementation of its policies in a manner that is
proportionate to the organization’s nature, size and complexity, and:a) includes appropriate degrees of independent review;b) takes account of the need for timeliness in reporting unplanned or unexpected events; andc) provides documented evidence of implementation.
Ensure appropriate response to monitoring results
In order to ensure that it responds appropriately to the results of performance monitoring, the governing bodyshould:a) respond to any deviations from standards in a manner that corrects or minimizes the current and future
impact of any deviations, including sustaining a crisis management capability and appropriate continuity
plans, and subsequently confirming that effective recovery and remedial actions have been taken;b) regularly review the suitability and quality of its controls and the adequacy of its arrangements forobjective and impartial assurance from internal and/or external auditors;c) follow the recommendations of 5.1.8 on recognizing and responding to governance performance; andd) use the results to report to formal stakeholders.

8