Governance can sound larger than it is. For us it mainly means making clear which role someone is acting in, who may make a decision and when an issue should move to another level. In a small company that matters, because the same person may wear different hats at different moments.
We therefore organise governance around roles and layers, not names. Each layer has a different mandate:
- Developer
- Project lead
- Top management
- Shareholder
If a topic exceeds the authority, independence or capacity of a role, it is escalated to a suitable layer.
Separating roles, even when people overlap
Segregation of duties means that higher-risk activities should not be designed, performed and approved by the same role from start to finish. In a small organisation, full separation is not always realistic. We then use compensating measures: peer review, approval by another role or an explicitly recorded exception.
Key idea: the purpose of separating roles is not distrust. It is to prevent speed, habit or blind spots from becoming the only test.
This matters especially for decisions that affect information security, continuity, customer commitments or HR matters.
For disciplinary or corrective steps, we also look at the role in which someone was acting. An operational issue should not be judged only by the same operational role. The more sensitive the topic, the more important an independent layer becomes.
Meetings as an operating system
Much governance does not happen in large documents, but in recurring meetings:
| Meeting | What it covers |
|---|---|
| Week start | Plans, project status and important action points |
| Sprint meetings | Project progress, blocked issues, refinement and completing work |
| Code reviews | Not just one pull request, but also style, approach and lessons that apply more broadly |
There are also one-to-one meetings with flexible team members. These cover availability, previous work, time spent and the next batch of tasks. That is capacity management too: not guessing how much someone can do, but deliberately matching availability and work.
Once a month we hold a quality and security day. We discuss incidents, logging and monitoring, open actions, non-conformities, risks, access matrices, internal reviews, the asset register and continuity. Not every topic gets the same attention each month, but this rhythm keeps them from disappearing when client work gets busy.
Management review: zooming out
Alongside operational meetings, there is a formal ISMS management review. Top management looks at the suitability, operation and improvement of the system as a whole.
How improvements come out of the review and meetings is described in our post on continual improvement: for governance, a decision about roles, authority or capacity gets an owner and a place on the roadmap. That brings separate signals about incidents, capacity and risks together at the level where management needs them.
HR as part of governance
Governance is also about people. The HR procedure describes the lifecycle from recruitment to leaving. Onboarding includes contract agreements, confidentiality, access, training, the handbook and registration in the asset register. New colleagues learn how we work securely and carefully.
During employment, HR conversations cover clarity of tasks, feedback, competencies, improvement points and how the work is going. That may sound soft next to words like "segregation of duties", but it is directly relevant. People who know what is expected of them ask questions sooner and spot risks earlier.
When someone leaves, the process focuses on a safe and respectful handover: revoking access, transferring knowledge, handling equipment and data, and updating the asset register.
Capacity is a security control
Capacity management is not just planning. If people structurally have too little time, reviews become thinner, documentation slips and exceptions start to look attractive. That is why we deliberately look at what is essential for continuity, information security and customer commitments.
Good governance does not make a small team heavy. It creates calm: roles are clear, meetings have a rhythm and decisions land at the level where they belong.