Why good regulatory governance must be demonstrated, not merely declared
Consider a regulatory institution with an enviable compliance record. Its enabling legislation contains robust independence provisions. Its annual report is filed on time. Its external audit is clean. It has a conflict-of-interest policy, a risk management framework, and a signed memorandum of understanding with each of its peer regulators. By many conventional measures, its governance arrangements appear sound.
Now consider what happens when those arrangements are tested and a systemically significant institution under the regulator's oversight fails - due to a key regulatory decision being challenged as politically influenced, or a regulated entity exploiting a cross-sector blind spot that an information-sharing agreement intended to close. The governance policies still exist. The annual reports were still submitted. The audit opinion has not changed. But a more important governance question has emerged: Did the governance arrangements actually work when they were needed?
The scenario is hypothetical, but the governance problem is not. Regulatory failures can expose a gap between the existence of governance arrangements and their effectiveness when tested in practice. This is why compliance and accountability, although closely related, should not be confused.
Compliance can tell us whether governance requirements have been met. Accountability asks those entrusted with authority to explain and justify how that authority has been exercised - and to demonstrate it with evidence.
Both are necessary for effective governance, but neither defines it alone. Effective governance also depends on integrity, ethical judgement and the quality of decision-making through which authority is exercised in practice. What accountability provides is the mechanism that makes those qualities visible and open to scrutiny - without which questions of governance effectiveness cannot even begin to be answered.
What Compliance Tells You - and What It Cannot
Compliance is indispensable to good governance. Regulatory institutions derive their powers from legislation and must operate within clearly defined legal and institutional frameworks. Policies, delegations, reporting obligations, control processes and audit arrangements establish the conditions within which sound governance can occur. But the existence of those arrangements does not, by itself, establish their effectiveness.
An arrangement can be in place and not function as intended. A rule can exist and not be applied consistently. A commitment can be made and not fulfilled when tested. The gap between having governance and demonstrating that it works is precisely where accountability begins.
This shift from structure to outcome is increasingly reflected in contemporary governance thinking. The OECD's governance principles for regulators, ISO 37000:2021 and the King V™ Code on Corporate Governance for South Africa 2025 all orient governance accountability around demonstrable outcomes - not merely the adoption of appropriate frameworks. The question is shifting from: What governance arrangements do you have? - to: What evidence demonstrates that those arrangements are working?
Compliance documents the input. Accountability evidences the output.
Testing Governance Under Pressure
The distinction between compliance and accountability becomes consequential where governance depends not merely on the existence of a rule or structure, but on behaviour, judgement and the exercise of discretion. Consider the following governance domains which illustrate where this distinction typically arises:
i. Independence
Legislation affirming a regulator's independence tells us something important about institutional design. But independence matters most when exercising it becomes difficult - when enforcement affects a politically connected entity, a powerful industry participant challenges an uncomfortable regulatory decision, or external stakeholders seek to influence an outcome.
In those circumstances, the accountability question goes beyond simply whether statutory protection exists. It asks: Can the institution explain how the decision was reached? Can it demonstrate that relevant considerations were weighed appropriately? Is the reasoning traceable? And is there evidence that its independence held when it was tested?
Independence written into law is important. Independence demonstrated under pressure is what creates trust.
ii. Conflicts of interest
A conflict-of-interest policy establishes the rules. Governance is tested when those rules encounter an actual conflict involving a consequential decision.
Accountability asks: Was the conflict identified before the decision? Was it declared? Was the affected person excluded appropriately from deliberation? Is the reasoning traceable? Was the treatment consistent with comparable situations?
A policy can establish what should happen. Accountability requires the institution to demonstrate what actually happened. Discernibly, integrity is not established by the existence of an integrity mechanism - it becomes credible through the way difficult situations are addressed.
iii. Transparency
Publication does not necessarily equal transparency. A regulator may publish an annual report, enforcement statistics and regulatory decisions while revealing relatively little about how significant discretionary powers were exercised.
The accountability question is not simply whether required information was published. It is whether legitimate stakeholders can understand the basis upon which significant decisions were made and form a reasonable view as to whether authority was exercised consistently, fairly and within mandate.
A decision can be visible while the governance behind it remains opaque. Understandably, transparency only becomes meaningful when it enables scrutiny, not merely disclosure.
iv. Cross-regulatory cooperation
Many contemporary regulatory risks no longer fit neatly within a single institutional mandate. Digital financial services, cross-border transactions and increasingly interconnected markets require regulators to exchange information and coordinate their responses.
An MoU is an important starting point, but accountability asks different questions. When an emerging risk crossed institutional boundaries, was it identified jointly? Was relevant information shared timeously and securely? Were responsibilities understood? Did institutions act on intelligence received from one another?
The MoU's operation under real conditions is what makes cooperation capable of being relied upon.
The same distinction can arise in risk governance, ethics, technology governance, delegation, oversight, performance and many other governance domains. Wherever authority is exercised, the accountability question follows: Can the institution explain and demonstrate how it governed?
Governance Is a Continuum - Not a Compliance Threshold
Compliance naturally tends towards a threshold: a requirement has either been met or it has not. Governance effectiveness is rarely so binary.
Two institutions may have almost identical governance structures while demonstrating vastly different capabilities in practice. Two governing bodies may both receive comprehensive risk reports - one notes and accepts them, the other interrogates emerging patterns, challenges assumptions and changes strategic decisions as a result. Both can demonstrate that risk reporting exists, but they are not demonstrating the same quality of governance.
The concept of governance maturity captures this distinction. Governance develops along a continuum: arrangements may initially exist largely in form, become increasingly embedded and consistently applied, and ultimately reach a point where their effectiveness can be evidenced, evaluated and improved over time. ISO 37004:2023 formalises this thinking - its core insight is that having governance and demonstrating effective governance are distinct stages of institutional capability.
It is at the point of demonstrated, evidence-based accountability that governance can genuinely be said to be working - not merely present. That is the destination that compliance alone cannot reach.
Making Governance Demonstrable
This leads to a deceptively simple test for any regulatory institution:
If your governance were independently examined tomorrow - not your compliance record, but your governance - what evidence would you produce?
Could you show that significant decisions are traceable to documented reasoning? Could you demonstrate that independence held when it was tested? Would conflict-of-interest records show conflicts managed at the point of decision, not reconstructed afterwards? And could you show that governance today is more effective than it was three years ago?
These questions are not intended to imply that governance is absent where the evidence is incomplete. One of the more important challenges facing institutions may be precisely the opposite: they may be practising sound governance that they cannot adequately demonstrate. The practice may be good, but the evidence trail may not be.
In an individual institution, an incomplete evidence trail limits the governing body's ability to assess whether governance is working consistently. In a regulatory ecosystem, the implications extend further - peer regulators, government, Parliament, regulated entities, development partners and the public may all need to place reliance on the integrity of an institution's governance. Governance that cannot be demonstrated provides weaker assurance to those who depend upon it.
Evidence that is actively used -- to identify recurring patterns, emerging relationship risks, or inconsistencies in how structures operate -- allows an institution to ask the more demanding question: Are we governing better than we were before? That is where governance moves from periodic assurance to genuine institutional learning.
The SADC Imperative
For regulatory institutions across SADC, the stakes of this distinction are rising. Digitalisation, financial innovation, AI-enabled decision-making and growing cross-border interdependence are increasing the complexity of the environments regulators are expected to oversee. As that complexity grows, the limitations of relying predominantly on structural compliance become more pronounced.
The implications extend beyond institutional credibility. The integrity and effectiveness of a country's regulatory environment influence the confidence of citizens, markets, development partners and investors. A SADC regulatory landscape capable of demonstrating how governance works in practice presents a materially stronger proposition than one able to demonstrate only structural compliance.
Some SADC institutions may already be practising governance at a level their formal reporting does not fully reveal - in which case the challenge is to strengthen the evidence, not create more governance. For others, closer examination may expose arrangements that are sound in design but inconsistently applied in practice. In either circumstance, the shift required is the same: from asking whether governance arrangements are in place to demonstrating whether they are working.
Compliance Is the Floor
Compliance will always matter. A regulator that does not comply with its enabling legislation, reporting obligations and governance requirements has a fundamental problem. But compliance is the floor, not the destination.
A regulatory institution exercises authority that citizens, markets, and regulated entities are required to respect. That authority carries a corresponding obligation: not merely to comply with the rules governing the institution, but to demonstrate that its powers are exercised independently, transparently, consistently and effectively.
The question regulators should therefore be asking is no longer simply: Are we compliant? It is the harder question: What evidence do we have that our governance is working?
For institutions entrusted with public power, that is not an assessment methodology. It is the fundamental expression of accountability - and when institutions can answer it with confidence, accountability contributes to effective governance: governance that the system, and those who depend on it, can genuinely rely on.
END
Words: 1,730
For further information contact:
Jené Palmer (CGF: Director)) - Cell: +27 (0)82 903 6757 / E-mail: [email protected]
Terrance M. Booysen (CGF: Chief Executive Officer) - Cell: +27 (0)82 373 2249 / E-mail: [email protected]
CGF Research Institute (Pty) Ltd - Web: www.cgfresearch.co.za
About the Author: Jené Palmer is a Director of the CGF Research Institute. She specialises in corporate and regulatory governance, governing-body effectiveness, ethical leadership, and governance maturity assessment, and advises public, private, and non-profit institutions on strengthening governance.
Follow CGF on X: @CGFResearch
Click below to read more...
