#128 - Governing Governance!

22 Oct 26

I've seen documents with at least ten signatures on the front cover. It doesn't make them safer. It makes them slower, feeds egos and quietly turns the governance system into shelfware. In the gaps, people develop their own unwritten philosophies about how to deal with the rules. In safety-critical engineering, governance only protects you if people actually use it.

Trial Brief

Governance in a safety-critical engineering organisation has one job: to make sure everyday process is repeatable, documented and consistent. This ensures errors are less likely and the organisation doesn't drift into an unknown, or potentially unknown, state. Get the balance wrong in either direction and it stops doing that job. Too much, and it becomes dogmatic and constraining. Too little, and it becomes ignored and irrelevant.

Trial Execution

Good governance is appropriate to what the organisation is trying to achieve. It isn't a measure of how many procedures exist or how many people sign them. It's a measure of whether the activities that matter are covered, whether the people doing them can follow the process, and whether the organisation can show that they did.

That starts with coverage. Governance should span all of the organisation's activities, and where there are gaps, they need filling. But coverage cuts both ways. Governance that no longer reflects what the organisation does, or that duplicates other governance, should be removed or deleted. Every redundant document makes the useful ones harder to find and easier to ignore.

It also needs control. Governance should be closely controlled and reviewed periodically, at the agreed periodicity. The people who author, approve and authorise it should be clearly identified, with appropriate SQEP (Suitably Qualified and Experienced Person) status and delegated authority to do so, recorded in a Signatory Authorisation matrix.

Then there's the front cover. I've seen documents with at least ten signatures on them. In my experience, that does nothing but slow down review, play to egos and make the whole system unwieldy. Only three signatures are needed:

Authored by: This can be anyone. The author is the person who wrote it.

Approved by: The person with the appropriate engineering delegation, who verifies that the document is technically correct.

Authorised by. The person who releases the document into the organisation, and who reviews it objectively before doing so.

Trial Findings

When governance fails in a safety-critical organisation, it rarely fails because there was none. It fails because it became either impossible to follow or easy to ignore. When that happens, people don't stop making decisions, they fall back on an unwritten philosophy about how to treat the rules.

In my experience, three of these tend to emerge:

1. The Pragmatist: "Do it…unless the book says you can't." This is where momentum lives. Progress happens and decisions get made. But it relies heavily on judgement, and when judgement varies, so does consistency.

2. The Dogmatist: "You can't do it…unless it's in the book." This is where safety lives. Risk is controlled and compliance is clear. But over time, the book becomes the bottleneck and innovation quietly suffocates.

3. The Cowboy: "Do it…and ask for forgiveness later." This is where speed lives. Barriers disappear and things get done...until they don't. Eventually, risk catches up with you, and often at scale.

The problem isn't that any one of these exists. It's that most organisations drift between all three depending on pressure, personalities and how close the spotlight is. That's where governance starts to feel inconsistent, even unfair. The same action might be waved through by one person, blocked by another and ignored by a third.

The ten-signature front cover is a symptom of the same drift. It's what an organisation adds after a Cowboy moment, a reflex towards Dogmatism. Every additional signature, review stage and mandatory template feels justified in isolation. Added together, they make the system so heavy that people look for ways around it, which feeds the Cowboy. A document with ten signatures also dilutes accountability: when everybody has signed, who actually checked it? The three-signature model works because each role has a distinct purpose. The author is accountable for content, the approver for technical correctness, and the authoriser for the decision to release it. There's nowhere to hide.

Under-governance is quieter, and in its own way just as dangerous. Where there are gaps, people fill them with local practice and personal habit. Things get done differently depending on who is doing them, and the organisation loses the consistency that governance exists to provide. Inconsistency is how an organisation drifts into an unknown state without noticing.

The common failure underneath all of this is relevance. If governance doesn't reflect how work is actually done, if it is out of date, duplicated or unnecessarily heavy, people stop trusting it. Once they stop trusting it, it becomes shelfware: documents that exist to be pointed at during an audit, not to be used. That is a worse position than having less governance that people follow, because it gives the organisation false comfort.

A more mature approach

The answer isn't to pick one philosophy and enforce it everywhere. It's to be intentional about when each one applies.

• Be dogmatic where the risks are existential.
• Be pragmatic where judgement and experience matter.
• Create safe lanes for "innovation energy" in controlled environments, where people can move fast without putting the entire organisation at risk.

Done well, governance isn't a constraint. It's a confidence mechanism. Teams can move quickly because they understand the boundaries, constraints and risks involved.

Governance also earns its place in a second way. It lets the organisation demonstrate compliance with regulations, legislation and defined standards. That matters legally, for reputation and for assurance. When something goes wrong, the question is rarely whether a procedure existed. It's whether the organisation can show that the procedure was appropriate, current, authorised by someone with the authority to do so, and actually followed.

The Common Thread

Governance is there to make good practice repeatable and to reduce the chance of errors putting the organisation into an unknown or unsafe state. It does that when it is proportionate, covers everything that matters, removes what no longer serves a purpose, and is owned by people with the right authority. It also works best when the organisation is deliberate about where it applies the Dogmatist, the Pragmatist and the Cowboy, rather than letting pressure and personalities decide. When it becomes a ritual of signatures, it turns into shelfware. When it is clear about its boundaries, it lets people move quickly with confidence.

Trial Sign-off

One practical action

Pick one controlled document in your area and look at its front cover. Count the signatures and ask what each one is accountable for. Then ask which of the three philosophies the people around that document actually operate by. If you can't name a distinct purpose for every signature, or the answer changes depending on who you ask, you've found some governance to simplify or clarify.

One question for reflection

Where in your organisation are the Dogmatist, the Pragmatist and the Cowboy each operating today, and is that the result of a deliberate decision or of pressure and personalities?

Have a great week!

Steve

If you're interested in through-life Engineering Leadership development from first time Engineering leader/manager, through Head of Engineering up to Director, see the link here.

For short courses which target specific leadership issues, see this link.