Topic 6.4 — Governance & Assurance

Governance exists to help you make good, fast, safe decisions and to prove — to yourself, your board, and the public — that a digital service is being run responsibly, so treat it as an enabler of delivery rather than a tax on it.

Why this matters in health and care#

In most sectors, weak governance costs money and reputation. In health and care it can cost lives, entrench inequity, and erode the public trust on which the whole system depends. A poorly governed change to a clinical system can propagate a dosing error to thousands of patients before anyone notices; an ungoverned data flow can breach the confidentiality of the most vulnerable people you serve; an unassured go-live can lock in a service that quietly excludes those who most need care. The stakes are why "how you work" is a clinical-safety, equity, and trust issue, not merely an efficiency one.

At the same time, governance in health and care has a well-earned reputation for being slow, ritualistic, and disconnected from delivery. Teams sit through board meetings that rubber-stamp decisions already made, complete templates nobody reads, and watch amber risks turn green the week before a review only to fail spectacularly afterwards. This is the paradox you must resolve. The answer is not less governance or more; it is proportionate governance that scales with risk and value, gives clear people clear accountability, and produces honest information fast enough to act on. This topic shows you how to build that, and how to layer independent assurance on top so that the people accountable — and the public — can be confident the controls actually work. It connects tightly to Topic 1.6 — Clinical Safety & Risk Management, Topic 1.7 — Information Governance, Data Protection & Cyber Security, Topic 5.3 — EPPM, and Topic 10.4 — Visibility for the CEO & Senior Leaders.

Core concepts#

Governance is the system of decision rights, accountability, and oversight through which an organization directs and controls what it does. In digital health and care you are really managing three overlapping governance domains at once. Corporate governance covers the board's stewardship of the organization as a whole — finance, strategy, risk, and legal duties. Clinical governance is the framework through which health organizations are accountable for continuously improving the quality and safety of care. Information governance covers how the organization handles data lawfully, securely, and ethically. A digital service touches all three; if you govern only one, you will be blindsided by the others.

Single-point accountability is the spine of good governance. The Senior Responsible Owner (SRO) is the one named individual personally accountable for a program or major project achieving its objectives and realizing its benefits — a role popularized by UK government but universally useful. Decision rights below the SRO are made explicit through a responsibility assignment matrix, commonly the RACI (responsible, accountable, consulted, informed) form, which prevents the two classic failures of "everyone thought someone else owned it" and "everyone tried to own it".

Assurance is distinct from governance. Governance is the act of directing and deciding; assurance is independent, objective confirmation that the governance and controls are actually working as intended. The dominant mental model is the "three lines of defense": the first line is operational management who own and manage risk day-to-day; the second line is oversight functions (risk, compliance, clinical safety, information governance) that set policy and challenge; and the third line is internal audit, independent of both, reporting to the board. External regulators and auditors form a de facto fourth line.

Two further concepts hold the system together. Risk appetite is the amount and type of risk the organization is willing to accept in pursuit of its objectives; without it, escalation is arbitrary. And the risk log — often extended to a RAID log (risks, assumptions, issues, dependencies) built on the same discipline as a risk register — is the working record that keeps a delivery honest. Review points are provided by staged assurance such as a phase-gate process and, in UK government, gateway-style reviews run by the Infrastructure and Projects Authority (IPA). Above the level of any single project sits enterprise risk management, the organization-wide discipline of identifying and managing the risks that could stop the whole enterprise achieving its objectives, rather than treating digital, clinical, financial, cyber and operational risk as separate silos.

Best practices#

1. Name one accountable SRO and mean it. Appoint a single, sufficiently senior individual who is personally accountable for the outcome, has the authority to make decisions, and stays with the program long enough to be held to account. Write their accountability into the terms of reference and their objectives. Resist the temptation to spread accountability across a committee — committees advise and decide collectively, but they cannot be accountable, because accountability that is shared is accountability that is absent.

2. Design governance to fit the risk and value, not the calendar. A small, low-risk internal tool does not need the same board, gates, and paperwork as a region-wide electronic patient record. Set tiers so that low-risk, low-value work flows through lightweight team-level governance, while high-risk or high-value work attracts formal boards and independent review. Publish the thresholds so teams know which tier they are in and can self-serve. Proportionality is what keeps governance from becoming a bottleneck that teams route around.

3. Write terms of reference that clarify decision rights. Every board should have a short terms-of-reference document stating its purpose, membership, quorum, what decisions it can make, what it can only recommend, and what must escalate above it. Pair this with a RACI so that recurring decision types — architecture choices, clinical sign-off, budget release, go-live approval — have a named accountable owner. Ambiguous decision rights are the single most common cause of governance drift, where meetings multiply because no one is sure who can actually say yes.

4. Separate assurance from governance and use the three lines. Do not let the people delivering a program be the only people who assure it is safe. Ensure the second line — clinical safety officers, information governance leads, cyber security — has an independent voice and can escalate over the SRO's head when needed, and that internal audit periodically tests the whole system. This separation is what turns optimistic self-reporting into credible assurance, and it is a regulatory expectation in most health systems, not a nicety.

5. Use integrated assurance and staged review points. Rather than commissioning uncoordinated reviews, plan an integrated assurance and approval schedule that aligns clinical safety, information governance, technical, and commercial reviews to the same decision points. Adopt gateway-style reviews at the transitions that matter — before committing money, before build, before go-live — modeled on IPA gateway reviews and, for public-facing digital services, the service assessments pioneered by the Government Digital Service (GDS) and adapted by NHS. A good gate is a supportive challenge that de-risks the next phase, not an exam to be gamed.

6. Make risk appetite explicit and let it drive escalation. Agree, at board level, how much risk you are willing to carry in each domain — patient safety, data, delivery, finance, reputation — and express it concretely enough that a team can tell whether a given risk sits inside or outside appetite. Then wire escalation to appetite: anything outside appetite goes up automatically, with a named owner and a decision deadline. This stops the two failure modes of trivia clogging the board and serious risks quietly sitting in a spreadsheet.

7. Run a living RAID log and a Board Assurance Framework. Maintain a RAID log that is reviewed every delivery cycle, with each entry owned, dated, scored, and actively worked — not a graveyard of stale amber items. At organizational level, maintain a Board Assurance Framework (BAF) that maps your principal strategic risks to the controls in place and the assurance you have that those controls work, exposing gaps where you are relying on hope. The BAF is what lets a board see, on one page, whether its most important objectives are actually protected.

8. Report honestly and kill governance theater. Insist on candid status reporting that surfaces bad news early, and protect the people who raise it. Watch for "watermelon reporting" — green on the outside, red on the inside — where dashboards stay green until the moment of failure; counter it by having assurance functions and delivery leads report on the same facts. Cut any meeting, template, or report that does not change a decision. Governance that produces documents nobody acts on is not caution, it is waste dressed as diligence.

9. Manage risk at enterprise level, not just project level. Hold a board-level enterprise risk register and a written risk appetite statement that connect digital, clinical, financial, cyber and operational risk instead of treating each in its own silo. Many of the risks that actually sink digital health services — an aging estate of legacy systems, a cyber attack, over-reliance on a single supplier — cut across every project and are owned by none of them, so give each cross-cutting risk a named executive owner and a place on the register. This is the difference between knowing that your programs are each roughly on track and knowing whether the organization as a whole is inside its appetite.

10. Aggregate the same risks up to the board without sanitizing them. Wire your three lines of defense so that a risk seen by a delivery team travels up to the enterprise register recognizably, not repackaged into reassuring language at each layer. The BAF and enterprise register are only as honest as the reporting beneath them, so guard against the watermelon effect where amber becomes green on its way to the top, and make it routine to escalate cross-cutting risks — legacy, cyber, supplier concentration — that no single project owns. A board that sees only aggregated, softened numbers cannot govern the risks that matter most.

Questions to discuss with your team#

1. Where is single-point accountability genuinely clear on our most important digital work, and where is it a comfortable fiction? Walk through your top three initiatives and ask, for each, who would personally answer to the board if it failed. If the honest answer is "the board", "the program", or a name that keeps changing, you have a gap. Test whether the named SRO actually has the authority and time the role demands, or whether they are a figurehead while real decisions happen elsewhere. Consider whether accountability is undermined by a matrix in which the SRO cannot direct the people delivering. Discuss how continuity is protected when SROs move on, since accountability that resets every reorganization is no accountability at all. The aim is not to blame individuals but to make sure that when something goes wrong, one empowered person owns putting it right.

2. Is our governance proportionate, or are we applying heavyweight process to low-risk work and vice versa? Map your current boards, gates, and approval steps against the actual risk and value of what passes through them. Look for the low-risk change that waited six weeks for a board that meets monthly, and the high-risk clinical change that slipped through on a team's own say-so. Ask whether teams are routing around governance because it is too slow, which is itself a serious risk signal. Consider whether you have published clear tiers and thresholds, or whether everything defaults to maximum ceremony out of caution. Debate where you could delegate decisions safely to move faster, and where you have been dangerously light. The goal is a system where the weight of governance visibly tracks the weight of the risk.

3. How would we know if our reporting is telling us the truth? Discuss concrete recent examples where a status went from green to red with little warning, and ask what the early signals were and why they did not surface. Explore whether delivery leads and assurance functions report from the same facts or from separate, conveniently divergent versions. Consider what happens, socially and professionally, to someone who reports a red status here — are they thanked or punished? Ask whether your board sees independent assurance alongside management's own account, or only the latter. Examine whether your dashboards measure things that predict problems or only things that are easy to make green. The purpose is to build a culture where honest bad news travels fast, because a governance system that cannot hear bad news cannot govern.

4. Have we written down our risk appetite concretely enough that a team can act on it, or is it a slogan? Take a live risk on one of your programs and ask whether the people closest to it could tell, from your stated appetite, whether it sits inside or outside the line. Most organizations have a risk appetite statement that reads well and decides nothing — "we take a balanced approach to risk" tells no clinician whether an undetected allergy-display defect is tolerable. Discuss whether appetite is expressed per domain — patient safety, data, delivery, finance, reputation — because a single global figure hides the fact that you may have zero appetite for clinical-safety defects and real appetite for schedule slippage. Examine whether escalation is actually wired to appetite, so anything outside it rises automatically with a named owner and a deadline, rather than depending on someone choosing to raise it. Consider who owns the appetite and how often it is revisited, since an appetite set once and never revisited drifts out of step with the real world. An honest answer names a recent decision that the appetite statement genuinely shaped, and admits where the statement is currently too vague to bite.

5. Do our gates and assurance reviews actually have teeth, or do failing programs sail through them? Look back at your last few gateway or service-assessment reviews and ask whether any of them stopped, paused, or materially reshaped the work — if every program has passed every gate, your gates are almost certainly theater. Discuss whether reviews are treated as a supportive challenge that de-risks the next phase or as an exam to be gamed, with the evidence pack curated to secure a pass. Consider whether clinical safety, information governance, technical and commercial assurance arrive at the same decision points or as a scatter of uncoordinated reviews that exhaust teams without adding confidence. Examine what authority a gate reviewer actually has: can they hold a go-live, and will they be backed if they do, or will commercial pressure override them? Explore whether the people delivering are also, in effect, the people assuring — because a gate run by the optimists is not assurance. The aim is a review that a serious problem could not survive, because a gate nothing ever fails is a cost with no control behind it.

6. Which of the risks that could actually sink us are owned by no single project, and who owns them? List the failures most likely to stop your digital services — an aging estate of legacy systems, a cyber attack, over-reliance on one supplier, a workforce that cannot operate the new tools — and ask, for each, whose register it sits on. These cross-cutting risks are dangerous precisely because they belong to everyone and therefore no one, falling between the cracks of project-level governance. Discuss whether you hold a board-level enterprise risk register that connects digital, clinical, financial, cyber and operational risk, or whether each is managed in its own silo blind to the others. Consider whether a risk seen by a delivery team travels up to the board recognizably, or gets softened from red to amber to green at each layer until the board sees only reassurance. Examine whether each cross-cutting risk has a named executive owner with the authority to act across programs. An honest answer confronts the gap between knowing each program is roughly on track and knowing whether the organization as a whole is inside its appetite.

In practice: a health & care example#

An integrated care system (ICS) is rolling out a shared care record that lets clinicians across hospitals, general practice, and social care see a unified view of each patient. It is high-value and high-risk: it touches clinical decisions, links sensitive data across organizations, and serves a population with wide variation in digital access.

Early on, accountability is muddy. Three chief information officers each feel partly responsible, a supplier is driving the timeline, and the program board of eighteen people spends its meetings receiving updates rather than deciding. Reporting is green. Then a near-miss surfaces: a medication allergy recorded in one system is not displaying in another, and a clinician nearly prescribes a drug the patient is allergic to.

The chief executives use this as a turning point and rebuild the governance. They appoint one SRO — a chief medical officer with the seniority to direct the program and the standing to challenge the supplier. They rewrite the board's terms of reference, cut it to the decision-makers, and attach a RACI so clinical safety sign-off, information governance approval, and go-live authorization each have a named accountable owner. Risk appetite is made explicit: zero appetite for undetected clinical-safety defects, limited appetite for schedule slippage. That single statement reorders everything.

Assurance is separated from delivery. The clinical safety officer and the information governance lead report independently and can escalate over the SRO to the chief executives; the shared-record work is added to each partner's Board Assurance Framework. An integrated assurance schedule sets three gates — before further build, before pilot, before full roll-out — each combining clinical safety, information governance, technical, and accessibility reviews, in the spirit of IPA gateway reviews and NHS service assessments. The RAID log is reviewed fortnightly, with the allergy-display defect logged as a red issue owned by name with a fixed resolution date.

The first gate is uncomfortable: the review team finds the clinical-safety case is thinner than the green reports implied, and the roll-out is paused four weeks. It is exactly the watermelon the old reporting had hidden. Because the pause happens before pilot rather than after go-live, no patient is harmed, the supplier fixes the data-mapping, and the eventual roll-out is slower to start but far safer and more trusted. Governance did not slow delivery; it prevented a failure that would have stopped it altogether.

Sector lenses#

Startup#

A health-tech startup rarely needs boards and gateway reviews, but it does need the essentials early, because regulators, buyers, and investors will ask. Name one accountable founder or executive for clinical safety and one for data protection, keep a lightweight RAID log, and write down your risk appetite even if it is a single page. The trap is treating governance as something to bolt on later; retrofitting evidence of safe, lawful decisions across a fast-moving product is painful and sometimes impossible. Build the minimum viable governance that a serious NHS buyer would recognize, and let it grow with you rather than lurching from nothing to bureaucracy overnight.

Small business#

An established small provider — a GP practice, a community pharmacy, a care home, or a single-site clinic — carries the same statutory duties for clinical safety and data protection as a large trust, but with no audit committee, no internal audit, and often no dedicated IT staff to run them. The governance discipline here is radical proportionality: one named person accountable for clinical safety and one for information governance (which in a very small organization may be the same senior clinician or partner), a single-page risk appetite, and a short RAID log that is genuinely reviewed rather than filed. Lean on the frameworks your regulators already expect — the Data Security and Protection Toolkit, CQC requirements, and any clinical-safety obligations your suppliers must meet — and make your software vendors' assurance (their DCB0129 safety cases, their certifications) do work you cannot do yourself. The realistic trap is not governance theater but governance neglect: safe, lawful decisions taken informally and never recorded, so that when an incident or inspection comes you cannot show what you decided or why. Keep the evidence trail light but real, because for a small business the goal is defensible decisions on a shoestring, not a governance machine you cannot staff.

Enterprise#

A large provider or supplier already has boards, audit committees, and internal audit, so the enterprise risk is the opposite of the startup's: too much governance, poorly integrated, generating theater. Consolidate overlapping boards, publish proportionality tiers, and integrate clinical, information, technical, and commercial assurance into a single schedule so teams face one coherent set of gates rather than a dozen uncoordinated reviews. Make sure the three lines of defense are genuinely independent and that internal audit periodically tests digital delivery, not just finance. The prize is turning an existing, expensive governance machine into one that actually accelerates safe decisions.

Government#

National and regional bodies — NHS England, ICBs, arms-length bodies — operate under statutory accountability, public spending controls, and formal assurance regimes such as IPA gateway reviews and the government's spend-control and service-assessment processes. Here the SRO role is codified and personally accountable to Parliament or its equivalents, and transparency is a duty, not a choice. The discipline is to make this mandated governance proportionate and to align the many external assurance demands so they inform delivery rather than merely audit it after the fact. Done well, public-sector governance is a model of accountability; done badly, it is the origin of the "governance theater" the whole sector fears.

Common failure modes#

• Accountability by committee. No single SRO, so when things go wrong everyone points sideways and nothing is owned.
• Governance theater. Boards that receive rather than decide, templates nobody reads, and gates that are exams to be passed rather than genuine de-risking.
• Watermelon reporting. Status stays green until the moment of failure because bad news is unwelcome and delivery reports go unchallenged by assurance.
• One-size-fits-all process. Heavyweight governance applied to trivial work, driving teams to route around it, while genuinely risky work slips through lightly.
• Assurance captured by delivery. The people building the service are the only people confirming it is safe, so optimism goes unchecked.
• Stale RAID logs. Risks logged once and never worked; amber items that quietly turn green before a review with no change underneath.
• Domain blindness. Governing the delivery well but missing the clinical-safety, information-governance, or equity dimension until it becomes a crisis.
• Gate theater without teeth. Review points that never actually stop or reshape work, so failing programs sail through every gate.

Maturity model#

Checklist#

• Every major initiative has one named, sufficiently senior, empowered SRO.
• Each board has current terms of reference stating its decision rights, quorum, and escalation.
• A RACI assigns a named accountable owner to each recurring decision type.
• Governance tiers scale with risk and value, and the thresholds are published.
• The three lines of defense are in place, with an independent second-line voice that can escalate.
• An integrated assurance schedule aligns clinical, information-governance, technical, and commercial reviews to staged gates.
• Risk appetite is written down per domain and escalation is wired to it.
• A living RAID log is reviewed each delivery cycle, with every entry owned and dated.
• A Board Assurance Framework maps principal risks to controls and to the assurance those controls work.
• Delivery and assurance report from the same facts, and raising bad news is safe.
• Every meeting, template, and report you keep changes a real decision.

Key sources#

• Infrastructure and Projects Authority (IPA), Principles for Project Success and the gateway/assurance review guidance — UK Cabinet Office / HM Treasury.
• NHS England, Clinical Risk Management Standards (DCB0129 and DCB0160) — for clinical governance of health IT (see also Topic 1.6).
• Institute of Internal Auditors (IIA), The IIA's Three Lines Model (2020 update) — the authoritative statement of the three-lines approach.
• HM Treasury, The Orange Book: Management of Risk — Principles and Concepts — risk appetite, controls, and assurance in UK public bodies.
• NHS England / former Government Digital Service, Service Standard and service-assessment guidance — assurance of public-facing digital services.
• UK Corporate Governance Code — Financial Reporting Council — board accountability and internal control.

References#

1. Governance — Wikipedia — https://en.wikipedia.org/wiki/Governance
2. Corporate governance — Wikipedia — https://en.wikipedia.org/wiki/Corporate_governance
3. Clinical governance — Wikipedia — https://en.wikipedia.org/wiki/Clinical_governance
4. Information governance — Wikipedia — https://en.wikipedia.org/wiki/Information_governance
5. Senior responsible owner (Executive sponsor) — Wikipedia — https://en.wikipedia.org/wiki/Senior_responsible_owner
6. Responsibility assignment matrix (RACI) — Wikipedia — https://en.wikipedia.org/wiki/Responsibility_assignment_matrix
7. Assurance services — Wikipedia — https://en.wikipedia.org/wiki/Assurance_services
8. Internal audit (Three Lines model) — Wikipedia — https://en.wikipedia.org/wiki/Internal_audit
9. Risk appetite — Wikipedia — https://en.wikipedia.org/wiki/Risk_appetite
10. Risk register — Wikipedia — https://en.wikipedia.org/wiki/Risk_register
11. Phase-gate process — Wikipedia — https://en.wikipedia.org/wiki/Phase-gate_process
12. Infrastructure and Projects Authority — Wikipedia — https://en.wikipedia.org/wiki/Infrastructure_and_Projects_Authority
13. The IIA's Three Lines Model — Institute of Internal Auditors — https://www.theiia.org/en/content/position-papers/2020/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense/
14. The Orange Book: Management of Risk — Principles and Concepts — HM Treasury — https://www.gov.uk/government/publications/orange-book
15. Clinical Risk Management: its Application in the Deployment and Use of Health IT Systems (DCB0160) — NHS England — https://digital.nhs.uk/services/clinical-safety
16. Service Standard — Government Digital Service / GOV.UK — https://www.gov.uk/service-manual/service-standard
17. The UK Corporate Governance Code — Financial Reporting Council — https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/uk-corporate-governance-code/
18. Enterprise risk management — Wikipedia — https://en.wikipedia.org/wiki/Enterprise_risk_management