Say It. Record It. The New Cost of "Obvious" Governance
Every board has a version of this moment: someone raises a concern about a senior leader, the room nods, a few people say "yes, we should keep an eye on that" ... and nothing is written down. It felt obvious. Everyone in the room understood it. Surely that's enough.
It no longer is.
The Crime and Policing Act 2026 came fully into force at the end of June, and its corporate liability provision quietly rewrites the risk calculus for every board in the country. From now on, if a senior manager commits a criminal offence while acting within the real or apparent scope of their role, the organisation commits that offence too. This is not just in cases of fraud or bribery, but potentially across the full breadth of UK criminal law.
What makes this different from earlier reforms is what's missing. Under the Bribery Act, and under last year's failure-to-prevent-fraud offence, an organisation with genuinely good procedures had a defence. Prove you had reasonable controls, and you could avoid liability even if something went wrong.
That defence doesn't exist here.
Why documentation still matters, even without a legal shield
It would be easy to conclude that if good governance can't save you legally, it isn't worth the effort. I'd argue the opposite.
Boards that can show (through minutes, escalation records, and clearly mapped authority) that they took oversight seriously are the boards regulators and prosecutors treat differently. Documented culture shapes whether a case is pursued at all, how it's resolved, and what happens to an organisation's reputation afterwards. The Serious Fraud Office has been explicit that it looks past the existence of a policy to whether it actually shaped behaviour on the ground.
More importantly, documentation should never have been primarily a defence exercise. It should always have been how a board actually does its job. If oversight isn't discussed and recorded, it's very hard to argue it happened at all.
The pattern in every governance failure I've studied
Look across recent governance failures (corporate and charitable, high-profile and not) and a pattern repeats. It is rarely the absence of policy that causes the collapse. It is the absence of voiced challenge and recorded escalation.
Inquiries into major corporate collapses have described boards operating in an orderly, well-minuted fashion right up until failure: the paperwork existed, but the curiosity didn't. Non-executives who were meant to challenge instead deferred. In the charity sector, inquiries have repeatedly found trustees unable to demonstrate that oversight had taken place at all, sometimes because records were never created in the first place, and long-serving leadership structures where nobody felt able to ask the difficult question.
The common thread isn't a missing rulebook. It's a boardroom culture where the important thing was assumed rather than said, and left unwritten because it felt too obvious to need writing.
Treat oversight like the six principles it already resembles
There's a useful discipline here, borrowed from existing "reasonable procedures" frameworks: top-level commitment, proper risk assessment, proportionate controls, due diligence, real communication and training, and ongoing monitoring and review. Even where no formal defence applies, this remains the clearest architecture I know for building oversight that's visible rather than assumed.
The practical starting point for most boards is simple, if uncomfortable. Who, in substance rather than title, holds enough authority that their actions could bind the organisation? Where do concerns about that person's conduct actually go, and would anyone feel safe raising one? And when the board challenges something, does the record show it, or does it just show that a meeting happened?
Monkey first, pedestal later
Astro Teller, who leads Alphabet's moonshot lab X, has a saying his teams live by: monkey first. If you need a monkey to recite Shakespeare from a pedestal, don't start by building a beautiful pedestal. Start with the monkey (the hard, uncertain, uncomfortable part) because that's where the real risk and the real learning live. The pedestal you can always build later.
Boards do this in reverse far too often. We build immaculate pedestals: polished papers, tidy agendas, well-formatted minutes of the easy items. And we leave the monkey, the hard question about a dominant leader, an unchallenged decision, a concern nobody wanted to be the one to raise, for another day.
Under this new law, that ordering is no longer just poor practice. It's a governance and legal exposure boards can't afford to leave unspoken.
So here's the question worth taking into your next board meeting: when you last had a nagging concern about a senior leader's conduct or authority, did you say it out loud and is there a record that you did?
