Determining governance appropriateness

What the model asks

Greater maturity across the three aspects does not mean greater certainty that governance outcomes will be achieved. Raising maturity takes investment (for example in preparing and communicating documentation), which is not always justified and can weaken the stewardship of resources. The level applied should suit the organization and satisfy its governance needs, with suitable behaviour and principles applied effectively and efficiently. What is appropriate depends on the organization's context and on how much the practices contribute to protecting the value at stake and reaching the outcomes (the conditions and rationales in ISO 37000 give the details). The organizational factors should be settled together with relevant stakeholders: how far the organization has grown; its economic, environmental and social context; and, always, its size and turnover, its resources, how complex it is and which industry it is in.

What it means when one board controls another

Appropriateness is a decision for each governing body, not a group-wide target. A dormant entity and a regulated bank in the same group can both be appropriate at different levels. Record the decision per entity, with the purpose, risk and obligations that justify it.

Evidence an evaluator asks for

A maturity rating is a claim about how the group governs. The evidence is what proves it operated. Keep both, and keep them together.

• Appropriateness: Documented determination of the appropriate maturity level per dimension with stakeholder consultation and rationale

Where evaluations commonly find gaps

• Level 5 pursued everywhere regardless of cost or need

How this requirement enters the rating

This unit belongs to the evaluation and improvement sequence. Record the decision it produces, the owner and the date, and keep it with the ratings it explains.

It carries 1 evidence item and 1 common gap in the model. One item is enough only if it is the artefact that proves the practice operated, not a policy that says it should. The group application on this page is ours; the requirement and evidence are the model's, stated in our own words.

Requirements that sit beside it

• 6.4.2 Setting improvement targets
• 6.4.3 Implementing improvement initiatives
• 4.1 General: the purpose of evaluating governance maturity and its three aspects

The three aspects The six-point scale All 35 requirements

Note on the draft: The requirement, evidence and gaps on this page are read from ISO 37004:2023, which the draft states it builds on. The draft's own clause body is not public, so this page does not state it. The clause reference at the top is the draft's public contents heading that this requirement sits under.