For much of the last two decades, the direction of travel on corporate governance appeared relatively clear. Governments and international organisations were asking more of businesses, while investors were paying greater attention to how companies were run. Anti-corruption compliance programmes became more established, and expectations around responsible business conduct continued to expand. The direction of travel is no longer obvious.

Geopolitical fragmentation and concerns about regulatory burden are changing the conversation. In some parts of the world, there has been a total retreat from the ESG agenda. This has reopened questions about what should be required of businesses and what they might choose to do voluntarily.

Would businesses still choose good governance if nobody required it? Some undoubtedly would. Others might not. The answer depends, at least in part, on what businesses believe governance is for.

If businesses invest in governance and compliance structures primarily because somebody requires them to, then reduced regulation weakens the incentive to make that investment. If, though, stronger governance helps organisations make better decisions, its value looks different.

This question is particularly interesting for small and medium-sized enterprises (SMEs), which mostly face fewer formal governance requirements than larger or listed companies. It was also at the centre of a recent webinar delivered by the Basel Institute on Governance for the Malaysian Institute of Management (MIM) as part of its anti-corruption certification programme.

Focusing particularly on SMEs, the session explored what governance and compliance mean in practice and how internationally recognised principles can be applied without creating unnecessary bureaucracy. It also looked at the relationship with organisational culture and at what happens when an integrity challenge is bigger than any one company. The discussion provided the starting point for many of the reflections in this article.

At its heart, governance is about how power is exercised within an organisation. Every organisation needs people with the authority to make decisions. That authority brings power, and power brings risk. When power is too concentrated or insufficiently challenged, it can lead to poor decisions or abuse.

Governance is therefore concerned with ensuring that power is exercised responsibly. That means putting the right structures:

• being clear about where authority sits;
• ensuring that important decisions can be challenged;
• and holding decision-makers accountable for how that authority is used.

Famous corporate scandals illustrate what is at stake when effective governance structures are absent or fail. Enron, Theranos, Wirecard and FTX were high-value companies operating in different sectors and circumstances, but each demonstrates how serious problems can develop when concentrated power is not adequately constrained, or when existing safeguards fail to ensure that concerns are heard and acted upon. In the most extreme cases like these, the consequences can be the destruction of the business itself.

The same underlying risk exists in smaller businesses where authority usually sits in few hands. Good governance for SMEs does not require the structures of a listed company, but it does require meaningful ways to question decisions and raise concerns.

Governance provides the framework for how power is exercised, but that power is exercised within boundaries. Organisations operate within requirements and commitments that shape what they can and should do and this is where compliance comes in.

Compliance is about understanding those requirements and ensuring they are followed. Some come from laws and regulations; others from internal policies or commitments the organisation itself has chosen to make. Governance and compliance are therefore closely connected: governance shapes how decisions are made, while compliance helps define the boundaries within which those decisions are taken.

But structures and requirements only take us so far. There is also the question of how people actually behave within them. That is where culture becomes important.

A company can have a carefully drafted conflict of interest policy, but it will achieve relatively little if an employee believes that questioning a senior leader’s interests will have negative consequences for their own job. An approval process can look robust on paper but become meaningless if everyone knows it is routinely bypassed when an important deal is at stake. The reverse is also true. Well-intentioned people can still make poor decisions when nobody is quite sure where responsibility lies.

Governance, compliance and culture therefore work together: the structures around how decisions are made, the requirements within which they are made, and what actually happens in practice.

There is a lot of international guidance on building good governance, compliance and a culture of business integrity. The OECD, United Nations, ISO, the World Bank and other financial institutions approach these questions from different perspectives, yet many of the underlying ideas are remarkably consistent.

Leadership comes first, often described as the “tone from the top”: senior leaders need to demonstrate through their decisions and behaviour that good governance and integrity matter rather than simply saying they do. Organisations are expected to understand their risks rather than simply reacting when problems occur, and to put in place controls that respond to those risks. Information needs to reach the right people, while employees need to feel able to raise concerns. And none of these arrangements should be static: organisations need to monitor how well they are working and improve them as circumstances change.

Taken together, this points to something close to a common model of good governance at the level of principles. Strong leadership and accountability, understanding and managing risk, appropriate controls, effective reporting and information flows, and continuous monitoring and improvement appear again and again across international frameworks.

That is helpful because governance can easily feel complicated, particularly for smaller businesses faced with an enormous range of standards and guidance. And although a multinational bank will need different arrangements from a family-owned company with 20 employees, both can work from the same basic principles.

What those principles look like in practice should be proportionate to the organisation and the risks it faces. For SMEs in particular, better governance should therefore not simply mean more governance or compliance structures.

For an SMEs looking to strengthen its governance, the starting point is not necessarily a particular policy or control. It is a collaborative conversation about how the organisation wants to operate.

That means considering some fundamental questions:

• What are the organisation’s values and expectations of its employees?
• How should important decisions be made, and where does authority sit?
• What are its main risks?
• Where might conflicts of interest arise, and what should happen when someone has a concern?

The aim is to reach a shared understanding and then document those decisions clearly. At the Basel Institute, an approach we recommend is a Code of Ethics at the top of the organisational policy framework, setting out overarching values and expectations, with more detailed policies beneath it on areas such as conflicts of interest, anti-bribery and speaking up. Practical tools can sit alongside these: a Delegation of Authority matrix, for example, clarifies who has authority to make important decisions.

Risk should inform the framework throughout. An SME does not need an elaborate risk management system, but its policies and controls should reflect the risks the business actually faces.

And the process does not end when documents are approved. They need to be communicated and supported by training. As the organisation grows and its risks change, the arrangements need to be reviewed and adapted.

Good governance is therefore not a collection of documents or controls. It is an ongoing process of agreeing how the organisation should operate, putting that agreement into practice and making sure it continues to work.

But not every governance and integrity challenge can be addressed within the organisation itself. Consider an SME competing for public contracts in a market where bribery is common. It can refuse to pay bribes, but acting alone may simply mean losing business while everyone else undertakes business as usual. The same problem arises when companies try to eliminate facilitation payments in environments where such demands have become embedded in the way business is done.

These are collective problems, and they require collective solutions. This is where Collective Action comes in: businesses working with each other and with governments, civil society and other stakeholders to address shared integrity challenges and help create a more level playing field.

The Basel Institute’s B20 Collective Action Hub brings together practical guidance and research from around the world for organisations interested in this approach. And through this resource we see that the importance of good governance does not stop at the boundaries of an individual organisation.

Indeed, our own research on the conditions affecting Collective Action shows that successful collaboration is not simply about getting the right organisations around the table. Attention also needs to be paid to how the initiative itself is governed: how trust is built, how power and resources are distributed, and whether participants have a genuine shared understanding of what they are trying to achieve.

This brings us back to the question with which we started. Regulation and enforcement establish minimum expectations and help create a level playing field. But they are not the only reason for a business to invest in strong governance and compliance structures.

Academic research provides some support for the wider business case. Studies of organisations facing economic downturns and other crises suggest that governance can contribute to resilience, including by improving how information reaches decision-makers and how organisations respond under pressure1. This is consistent with the G20/OECD Principles of Corporate Governance, which explicitly recognise sustainability and resilience as objectives of effective governance.

Good governance can also strengthen confidence in an organisation. Customers, suppliers and others need to trust the businesses they deal with. Transparency and accountability provide a basis for that trust – something the G20/OECD Principles also recognise in linking effective corporate governance with market confidence and integrity.

So, would businesses still choose good governance if nobody required it?

There are strong reasons why they should, and those reasons feel particularly compelling now. Geopolitical fragmentation is creating new risks for businesses, with assumptions about where and how it is safe to operate changing quickly. In this environment, investing in good governance is not simply a compliance decision or a business cost. Whether an SME or a multinational, it is part of building an organisation that can navigate uncertainty with confidence.

This work has been made possible with the support of our donors. The Siemens Integrity Initiative has been an early and constant supporter of the Basel Institute’s work on business integrity through Collective Action.

1 See for example Joseph Lampel, Ajay Bhalla, Pushkar P. Jha, Does governance confer organisational resilience? Evidence from UK employee owned businesses, European Management Journal, Volume 32, Issue 1, 2014, Pages 66-72, ISSN 0263-2373, https://doi.org/10.1016/j.emj.2013.06.009

• Explore Basel Institute’s Business Integrity work

  Discover our advisory services, tools and research on anti-corruption compliance and governance.

• Visit the B20 Collective Action Hub

  Practical guidance and research for businesses tackling shared integrity challenges together.