Altestra

Insights

Governance for a forty-person company: what to borrow from the big frameworks, and what to leave on the shelf

· 9 min read

The governance frameworks were written for listed companies and large public bodies. A forty-person company needs about three of their ideas, written on a few pages, and the discipline to leave the rest where it is.

A company of forty people already has governance. Decisions are taken, money is spent, people are hired and dismissed, and risks are accepted or refused every week. The governance is in the founder’s head, in a Friday meeting that has no agenda, and in the habits of three or four people who have been there from the start. It works, until it doesn’t: when one of those people leaves, when a client or a bank asks how a decision was made, when the founder becomes the bottleneck for everything.

A forty-person company is not a small case. In Canada, according to Innovation, Science and Economic Development Canada, 98.2% of the country’s 1.10 million employer businesses are small, with 1 to 99 employees, and 95.6% have fewer than 50. Small businesses employ 5.8 million people, 46.6% of the private labor force. Most of the economy is run by companies for which the governance literature was not written.

At some point someone in such a company opens a governance framework, and the trouble starts.

What the frameworks are for

The best-known frameworks were written for a particular kind of organization, and most of them say so.

The G20/OECD Principles of Corporate Governance, revised in 2023, state plainly: “The Principles focus on publicly traded companies, both financial and non-financial.” They allow that “some of the Principles may be more appropriate for larger companies than for smaller ones.” The national corporate governance codes address the same listed companies with dispersed shareholders. Even the United Kingdom’s code for private companies, the Wates Principles, serves a reporting duty that applies to companies with more than 2,000 employees, or a turnover above £200 million and a balance sheet above £2 billion. The employee threshold alone is fifty times the size of the company in this article.

COBIT addresses the governance of information and technology in enterprises large enough to have a board, an executive and an audit function as separate bodies, and ISACA, which publishes it, is candid about the fit: “experience and research have shown there is no such thing as a one-size-fits-all governance system for enterprise I&T,” and “Any COBIT 2019 implementation will, thus, require tailoring before it can be fit-for-purpose,” as one of its own experts wrote in 2019. ISACA later published a guide for enterprises of up to 250 employees, which says much about how far the full framework sits from them.

ISO 37000 describes the governance of organizations in general terms, and the committee behind it says it “is applicable to all organizations regardless of type, size, location, structure or purpose.” That is true of its principles. But its vocabulary assumes a governing body distinct from management, and in a forty-person company the two are the same people. The public-sector codes assume a legislature, an accounting officer and an audit institution.

None of this is wrong, and much of it is wise. But it is written for organizations where the people who own, the people who govern and the people who manage are different people, often hundreds of them. In a forty-person company the same five people own, govern and manage, and they do it before lunch.

We treat the frameworks as libraries, not laws. The question is never whether to adopt one. It is which three or four ideas to borrow, how to write them small enough to be kept, and what to leave on the shelf with a note saying when to fetch it.

Borrow: decision rights on one page

The single most useful idea in every framework is that it should be known, in advance, who decides what. It is also one of the oldest ideas in management. In the Book of Exodus, Moses is judging every dispute of his people himself, from morning to evening, until his father-in-law Jethro tells him: “this thing is too heavy for thee; thou art not able to perform it thyself alone.” The remedy is a delegation by the weight of the matter: “every great matter they shall bring unto thee, but every small matter they shall judge: so shall it be easier for thyself, and they shall bear the burden with thee.” Every founder who has become the bottleneck will recognize the conversation.

In a forty-person company this fits on one page. Down the side, the kinds of decisions that recur: hiring and dismissal, spending above a threshold, signing a contract, taking on a new client or dropping one, changing a price, starting or stopping a project. Across the top, who decides: the founder or managing director, the leadership team together, a department head, a manager. In each cell, one mark, and where useful a threshold: a manager spends up to this amount alone, the leadership team above it, the founder above that.

Writing the page takes an afternoon. The hard part is the conversation it forces, which is about what the founder is prepared to let go of. That conversation is the governance work; the page is only its record.

Borrow: one meeting with an agenda and a record

Every framework has a committee structure. A forty-person company needs one meeting, and it needs that meeting to be different from the Friday catch-up.

The leadership meeting has a standing agenda: decisions needed, decisions taken since last time, the few numbers that matter, and the risks anyone is worried about. It has a record, which is a decision log, not minutes. One line per decision: what was decided, by whom, when it will be reviewed. The log is the organization’s memory, and it is what lets a new manager, a bank or an auditor see how the company decides without anyone having to remember.

Once a quarter, the same meeting looks at the decision-rights page and the log together and asks what should change.

Borrow: a review date on everything

The frameworks talk about continuous improvement. The usable version of the idea is simpler: nothing is permanent by default. Every rule, threshold and meeting carries a date on which it will be kept, changed or retired. That one habit prevents the slow accumulation of rules nobody remembers agreeing to, which is how governance becomes something people route around.

Leave on the shelf: the committee structure

An audit committee, a risk committee, a nomination and remuneration committee, each with its own charter and cycle: in a company of forty these are the same five people wearing different hats in consecutive meetings. The separation of duties the committees exist to provide cannot be provided by the same people, so the structure adds meetings without adding independence. Even the Wates Principles, written for large private companies, say that “The size of a board should be guided by the scale and complexity of the company.”

The need is real and arrives later. The note on the shelf says: fetch when there is an external investor who wants a seat, when a regulator requires it, or when the company has grown to the point where owning, governing and managing are done by different people.

Leave on the shelf: the full policy set

A framework-led governance project tends to produce forty policies, because the framework lists forty topics. Nobody reads forty policies. The company needs three, each on a page: how spending is authorized, how conflicts of interest are declared and handled, and how a complaint or a whistle is heard. Perhaps a fourth on data, depending on the business. Everything else is a decision right or a habit, and belongs on the one page or in the log.

Leave on the shelf, for now: the assurance layers

Formal risk registers, internal audit, management assertions, independent assurance. These exist to let people who cannot see the work satisfy themselves that it is being done properly. In a forty-person company the people who need to know can walk across the room. A risk conversation on the standing agenda does the job.

The trigger to fetch these from the shelf is usually external: a regulated sector, public money, a large client’s supplier requirements, an acquisition. When one of those arrives, the company that has a decision log and a decision-rights page builds the assurance layer in weeks, because the practice already exists and only needs to be evidenced.

The test

A governance practice fits a forty-person company if a new manager can be taught the whole of it in an hour and can find every rule they need on a few pages. If it takes a training course, it was written for a different organization.

When the company grows

The shelf is not a rejection. It is a plan. Larry Greiner’s classic Harvard Business Review article of 1972, “Evolution and Revolution as Organizations Grow”, described growth as a series of phases, each ending in a period of turmoil, and in HBR’s own summary, “Managers therefore experience the irony of seeing a major solution in one period become a major problem in a later period.” The founder’s direct control that serves a company of forty well becomes its constraint at a hundred.

There is even a rough sense of where informal coordination runs out. Robin Dunbar of the University of Oxford and a colleague, in a 2003 study of personal social networks, found an average maximum network size of 153.5 people, “remarkably close to the group size of 150 predicted for humans on the basis of the size of their neocortex.” The research concerns social networks, not companies, and no one should treat it as a rule. But many founders notice the same thing somewhere around that size: they no longer know everyone, and what used to be settled in the corridor now needs to be written down.

A company that borrows three ideas at forty people, writes them small, and reviews them each quarter has the habits that the larger frameworks assume. At eighty people the thresholds move. At a hundred and fifty, the first committee may earn its place. At the first external investor, the assurance layer comes down from the shelf, already knowing where it fits.

That is the whole of our approach to governance at this size: measure where the company actually is, borrow what that level can carry, name what was left on the shelf, and put a review date on all of it. The frameworks were written by careful people. The care they ask for is in choosing from them, not in adopting them whole.

Sources

The service behind this piece

Read next

Recognize your organization in this? Tell us what is happening.

Talk to us