When words cease to distinguish, they begin to conceal
There are three words I have learnt to distrust in a boardroom.
Governance.
Assurance.
Risk.
Not because they are wrong. Quite the opposite. Each describes something important. The trouble is that we have used them so often, and for so many different things, that they now mean almost everything to everyone, and very little to anyone.
That should bother us.
Words are not decorations placed around thought. They are part of the machinery of thought itself. They frame what we notice, what we ignore, what we permit ourselves to conclude. Use the wrong word for long enough and eventually we stop seeing the distinction the word was supposed to preserve.
In the boardroom, that is no small matter.
A director may be told that governance is strong, assurance is substantial and risk is within appetite.
It sounds reassuring.
It may also mean almost nothing.
Governance
I have spent much of my professional life around Boards, and I still find myself asking what people mean when they use the word governance.
Information governance. Clinical governance. Data governance. Project governance. Technology governance. AI governance. Governance functions. Governance systems. Governance controls. Governance frameworks. Governance professionals.
One begins to wonder whether there is anything left that is not governance.
This is not merely untidy language. It obscures agency.
To govern is a verb.
People govern.
For a corporate body, the Board governs through the acts of its directors. They observe, consider, question, decide, delegate, oversee, correct and account. They do so collectively, within law, constitution and authority.
A framework does none of these things.
A policy does not govern.
A department does not govern.
A dashboard does not govern.
An algorithm certainly does not govern, howsoever enthusiastically its designers may describe it.
These things may help people govern, manage, record, control, test, report or decide. But the distinction matters because responsibility attaches to the person who acts, not to the noun we place around the action.
When we call every system of management, control and reporting “governance”, we make it harder to see who is governing and who is managing.
That ambiguity has proved remarkably hospitable to whole cottage industries.
Perhaps that is why it survives.
Assurance
Assurance has suffered a similar fate.
Boards receive assurance reports. Committees provide assurance. Audit provides assurance. Executives give assurance. Controls provide assurance. Software now promises assurance.
One could be forgiven for imagining assurance as a commodity, passed carefully from hand to hand until it eventually reaches the Board.
But a report is not assurance.
Nor is an opinion.
Nor is a green box.
A report may contain evidence. An auditor may express an opinion. A manager may make a representation. A clinician may describe what was observed. A control may have operated as intended.
The Board must still decide what reliance to place upon what it has been told.
That is the intellectual act.
Suppose a transformation programme is reported green. Milestones have been achieved. Management is confident. No major exceptions have been identified.
Very good.
What changed?
Was something designed, implemented, adopted, used, effective, or merely completed?
Who observed it?
When?
Against what standard?
What would falsify the claim?
What does not fit the story?
What remains unknown?
These are not hostile questions. They are the work.
A metric may inform judgement. It may even make better judgement possible. It cannot supply judgement.
Neither can an assurance report.
The deeper question is not whether the Board “has assurance”. It is whether the directors are justified in placing reliance on the proposition before them.
That is a harder question.
It is meant to be.
Risk
Risk may be the most abused word of the three.
We have turned it into a synonym for danger.
Cyber risk. Workforce risk. Financial risk. Clinical risk. Reputational risk. Regulatory risk. Strategic risk.
Soon everything becomes a risk, and the risk register becomes a catalogue of things that might go wrong.
Then come the colours.
Red.
Amber.
Green.
The modern organisation has acquired an extraordinary capacity to reduce uncertainty to traffic lights.
The trouble is that risk is not a colour.
Nor is it a bad thing waiting to happen.
ISO gives us a better starting point:
Risk is the effect of uncertainty on objectives.
Every word matters.
Risk is an effect.
It arises from uncertainty.
And it only makes sense in relation to an objective.
Without the objective, the sentence is unfinished.
If a Board intends to open a new service within twelve months, then workforce uncertainty may delay it. Technology may accelerate it. Demand may overwhelm it. Regulation may change its form. Finance may constrain it. An unexpected alliance may make it easier.
Uncertainty is not always an enemy.
It may worsen an outcome, improve it, delay it, accelerate it, distort it or reveal that the original objective was foolish.
That is why I become uneasy when a Board discussion begins with the “top ten risks”.
Top ten risks to what?
Start with what the organisation is trying to achieve.
Then ask what is uncertain.
Then ask what those uncertainties might do to the intended outcome.
Only then does risk acquire meaning.
The sequence matters.
Objectives first.
Uncertainty second.
Judgement follows.
The comfort of abstract nouns
There is a seductive quality to abstract nouns.
They sound settled.
Governance.
Assurance.
Risk.
Once named, they feel contained.
But naming something is not the same as understanding it.
“Governance failure” may conceal the fact that somebody failed to decide, failed to challenge, failed to act, or acted without authority.
“Assurance gap” may conceal the difference between a control that does not work and evidence that has never been sought.
“Risk issue” may conceal the absence of any clearly stated objective against which the uncertainty could be judged.
Language can illuminate responsibility.
It can also provide somewhere for responsibility to hide.
Nietzsche warned, in another context, of concepts becoming worn coins, their original image rubbed away through constant circulation. Boardroom language suffers the same fate. We continue to spend the words long after we have forgotten what was stamped upon them.
And so the meeting proceeds.
The governance is good.
The assurance is substantial.
The risk is managed.
Everyone nods.
Nobody is quite sure what has just been agreed.
Say what happened
There is a simple antidote.
Use verbs.
Who knew?
Who decided?
Who acted?
Who was authorised?
What changed?
What was observed?
What evidence supports the claim?
What contradicts it?
What remains uncertain?
What did we expect to happen?
What actually happened?
What have we learnt?
Language becomes clearer when we force it back towards people, action, evidence and consequence.
Instead of asking whether governance is effective, ask whether the Board is governing well.
Instead of asking whether assurance has been received, ask what reliance is justified and why.
Instead of asking what the risks are, ask what we are trying to achieve and what uncertainty might do to it.
None of this requires another framework.
It requires attention.
Words matter
I do not argue for linguistic pedantry.
Boards have better things to do than conduct philosophy seminars over every noun.
But there are moments when an imprecise word permits imprecise thought, and imprecise thought permits weak judgement.
That is when language becomes consequential.
If a word cannot tell us who acts, what is known, what is uncertain or what outcome is at stake, we should be suspicious of it.
Especially when it sounds impressive.
The next time someone says that governance is strong, assurance is substantial and risk is controlled, do not object.
Just ask what they mean.
Then listen carefully.
The answer may tell you more about the state of the organisation than the original report ever could.
