Documentation is not evidence that governance is working.
This sounds obvious to the point of being trivial. In practice it is one of the most persistent confusions in how institutions assess their own governance quality, and the fact that it sounds obvious is part of why it survives. Nobody would defend the claim that paperwork equals good governance if it were put to them directly. Almost every institution behaves as though it were true, because the alternative is harder and the paperwork is right there.
A review finds the policies in place, the approval records current, and the committee minutes reflecting the discussions that were supposed to happen. The conclusion drawn is that governance is functioning. What has actually been established is narrower and less reassuring: that governance was documented. The two are not the same, and the distance between them is where institutional risk accumulates unseen.
What documentation can and cannot tell you
A framework built to satisfy a documentation requirement will produce documentation. This is not a cynical observation. It is a description of what the requirement asks for and what it therefore gets.
If the requirement is that decisions be recorded, decisions will be recorded. If the requirement is that committees minute their discussions, minutes will exist. None of this tells you whether the records reflect the accountability structures, the quality of judgment, or the ownership of decisions that governance is meant to create. A complete set of records is fully compatible with decision-making that operates entirely outside it. The documentation can be current, consistent, and audit-ready. Meanwhile the real decisions are made in conversations that never enter it, by people whose involvement the records do not show.
The error is treating the record as the thing rather than as a description of the thing. A map can be accurate or inaccurate. But a map is never the territory. An institution that inspects its maps without ever checking them against the ground will eventually be governed by a fiction it has documented to perfection.
Where the gap reveals itself
The separation between documented governance and actual governance is hard to see on a normal day. It becomes obvious at one specific moment, and by then it is a finding rather than a warning.
When something goes wrong, you trace the decision chain backwards. The documentation is intact. Every individual in the chain can point to an approval that was properly recorded. The policy was current. The committee was briefed. The escalation followed the documented path. And somewhere in that intact, complete, well-ordered record, the thing you are looking for is missing: anyone who owned the outcome rather than the signature. The framework was followed. The accountability was not there. The records describe a process that functioned. They cannot describe the absence at its centre, because an absence does not generate a document.
This is the pattern worth internalising. Documentation fails silently. It does not produce a record of the judgment that was missing, the ownership that did not form, or the question nobody asked. It records what happened, in the language of what was supposed to happen, and the two can diverge completely without the record showing a single inconsistency.
Why this is not an argument against records
It would be easy to read this as a case against documentation, and that reading would be wrong. Records matter. Policies matter. An institution that could not show how its decisions were made would have a different and more basic problem.
The point is about what documentation is for. It is the starting point of governance quality, not the evidence of it. Complete records are a precondition: without them you cannot even begin to ask whether governance is working, because you would have nothing to examine. But the records earn their value only when someone tests them against reality, rather than treating their completeness as the answer. A current policy that nobody follows is not a sign of governance. It is a sign of a well-maintained policy. The two are easy to confuse precisely because the well-maintained policy looks exactly like the working one until the day it is tested.
The institutions that handle this well do not document less. They hold their documentation to a higher standard: not whether it is complete, but whether it would survive being checked against an actual decision made under pressure.
The question that separates the two
There is a single test that distinguishes documentation that is evidence from documentation that is merely complete, and it is not a test of the records themselves.
Take a significant decision the institution actually made, ideally one made quickly and under real pressure. Trace it through its documented path. Then trace it through its actual path: who really weighed in, where the information stopped, which approval was genuine and which was ritual, who would have stood behind the outcome if it had gone wrong. If the two paths match, the documentation is evidence. It describes how the institution actually decides. If they diverge, the documentation is a record of how the institution is supposed to decide, quietly separated from how it does. Its completeness is telling you nothing about whether the governance works.
Most institutions never run this test. They assess governance by inspecting the documented path alone, find it complete, and stop. The completeness is reassuring and the test is uncomfortable, so the comfortable inspection substitutes for the useful one. The result is institutions that are confident in their governance precisely because they have only ever examined the part of it that was written down to be examined.
The starting point for genuine governance quality is not asking whether the documentation is complete. It is asking whether the documentation, tested against a real decision, would explain what actually happened, or only confirm that someone signed. The institutions that find out trace a real decision backwards through its actual path, not its documented one. Few ever do.
I write about governance, risk, and the decisions institutions find hardest to make. If this is relevant to a problem you are working through, reach me at aan@asifahmednoor.com.
← Back to writing