Why Most Governance Programs Fail: The Missing Layer

Governance programmes rarely fail because policy is missing. They fail because the layer between policy and behaviour is missing. This note records why that layer is so often missing and what is needed to build it.

The pattern

In almost every organisation preparing for an audit or disciplinary procedure, we see the same pattern. There are documents. There are registers. There is a governance manual. There is an internal control framework. And yet, when a regulator presents a concrete case or a disciplinary panel demands reconstruction, the evidentiary chain does not close.

The problem does not lie in the presence of policy. It lies in the absence of evidence that policy is followed at the moment it matters.

The five layers

In practice, governance has five layers. The first four are addressed in most programmes. The fifth is almost always missing.

1. Read. An honest diagnosis of how governance actually works today, measured against what is written on paper. This is the layer that makes the gap between document and practice visible.
2. Structure. Statutes, regulations, mandates, roles. The blueprint. This layer receives attention in almost every programme and is rarely the problem.
3. System. The working processes, tooling, and reporting structures that must carry the structure in practice. Here the gap begins: a structure without a working system is decorative.
4. Culture. Reporting willingness, psychological safety, example behaviour. This layer is often mentioned but rarely measured.
5. Integrity. The independent test of whether the whole holds up under actual external pressure. This layer is entirely missing in most programmes.

The missing layer

What organisations rarely build is an explicit mechanism that tests whether the first four layers, taken together, actually work. Not by internal audit. Not by the compliance function itself. But by an external test that simulates what happens when a real regulator or disciplinary panel calls.

This fifth layer is called Integrity because it tests whether governance is actually integer: whole, coherent, demonstrable. What breaks under this test is actionable. What stays in production without this test breaks eventually in public.

What works

Five ingredients make governance genuinely testable:

• Evidence over document: every control must be demonstrable with logs, timestamps, or witness accounts, not with a policy paper.
• External testing without cross-selling: someone with no interest in a positive outcome.
• Case simulation instead of sample audit: present a concrete incident and follow the chain of evidence.
• Culture measurement beyond awareness surveys: measure reporting willingness and psychological safety.
• Feedback into structure: every weakness found must lead to policy or control adjustment, not to an exception clause.

Governance only works once it holds up at the moment it is tested. The rest is documentation.

Rion Rijker, founder Rijker Advisory. April 2026.