There is a version of company secretary work that looks like governance and a version that actually is governance. The difference is almost never visible in a board pack or a board performance report. It shows up when something goes wrong: a regulatory filing filed late, meeting minutes not written or ratified on the wrong date, a board resolution that cannot be located, a shareholder register that has not been updated since the last round. By then, the cost of the broken model is no longer theoretical; it’s felt both in stress and hard cash.
The uncomfortable truth is that a significant proportion of company secretary operations across UK, Europe, South Asia, Canada & Africa and other emerging markets are running on infrastructure that was never designed for governance at all. They are running Microsoft Excel, email inboxes, notebooks, and the memory of whoever has been in the role for the longest.
“Governance that lives in a spreadsheet is not governance, it is a liability dressed in columns.” – Romeo Effs, CEO Lumorus and Governance Professional
The Three Pillars of a Broken CoSec Model
Before diagnosing the fix, it helps to name exactly what is broken. The dysfunctional CoSec model almost always rests on three structural failures.
1. The Spreadsheet as a System of Record
Spreadsheets are tools for computation and quick analysis. They are not systems of record. When a statutory register lives in Excel, it has no audit trail, no access controls, no workflow enforcement, and no single version of truth. Anyone with edit access can change a cell, and there is no log of it happening. A company with five entities and a proactive CoSec team can maintain this for a while. A company with ten or more entities, multiple jurisdictions, and limited staff especially with turnover, cannot. According to research by Deloitte on enterprise data integrity, over 88% of spreadsheets used in business contain errors significant enough to affect decisions.
2. The Inbox as a Workflow Engine
Emails were designed for communication. In most CoSec functions, it has become the de facto workflow tool: tasks are assigned by forwarding, approvals are granted by reply, documents are stored by attachment, and institutional knowledge accumulates in threads that no one else can read. When the person who owns that inbox is on holidays or leaves, a material portion of the company’s governance history leaves with them.
A 2023 governance survey by the Chartered Governance Institute UK & Ireland found that nearly 60% of in-house company secretary teams reported relying on email as their primary tool for managing board and compliance workflows; this is not a problem with isolation, It’s a structural one: the function has not been given infrastructure that matches its responsibility.
3. Memory as Institutional Knowledge
The most invisible risk of all is the one that is actively celebrated in many organisations: the CoSec who knows everything; Where every document is, when every deadline falls, what was agreed at the last Board Meeting or AGM? This person is treated as an asset. However, they are actually a single point of failure.
When institutional knowledge is not encoded into systems, it is not truly institutional. It belongs to an individual. The moment that an individual is unavailable, whether through illness, resignation, or leave, the organisation’s governance continuity is immediately at risk.
What This Actually Costs Organisations
The argument for fixing Company Secretary infrastructure is sometimes framed as a compliance argument. It is more precisely a cost and risk argument. The financial and reputational consequences of governance failure are well documented across markets.
A report by PwC on corporate governance failures in Sub-Saharan Africa found that process fragmentation and manual record keeping were cited as contributory factors in many governance incidents reviewed at growth stage companies. These are not exotic failure modes; they are the predictable output of infrastructure that was never fit for purpose.
The Warning Signs Your CoSec Model is Already Failing
Organisations rarely know their CoSec infrastructure is broken until a deadline is missed, or a due diligence process surfaces with an inconsistency. These are the signals that appear well before that point.
- Filing preparation requires manually reconciling multiple spreadsheets before you can confirm what is current.
- New team members take weeks or months before they can operate independently because knowledge is not documented anywhere.
- Answering a question about the company’s current directors and/or shareholders requires contacting the Company Secretary directly rather than checking a live record.
- Board resolutions are retrieved by searching email subject lines.
- Entity management across subsidiaries is handled by duplicating the same spreadsheet template.
- Compliance deadlines are tracked in a shared calendar or spreadsheet that no one has formal ownership of.
- There is no auditable record of who accessed or amended a document.
If three or more of these describe your current operation, the risk is not theoretical. It is already present in your governance stack.
What Fit-for-Purpose CoSec Infrastructure Actually Looks Like
The answer is not more spreadsheets, better organised. It is not a more disciplined email filing system. It is a purpose-built governance infrastructure that encodes process, enforces accountability, and makes institutional knowledge structural rather than personal.
This is what CoSec Hub was built to deliver.
About CoSec Hub
CoSec Hub The secure digital platform designed to be the company secretary’s command centre. It is where compliance meets clarity, where filings meet efficiency, and where boards meet precision. It is built by Company Secretaries and replaces manual, fragmented CoSec workflows with a single structured environment for statutory compliance, entity management, board administration, and regulatory filing.
Lumorus is the governance advisory and corporate services firm behind CoSec Hub. Lumorus provides integrated governance, risk, and compliance infrastructure to organisations across the UK, USA, Canada, Middle East and Africa, combining professional services with technology to deliver governance advisory and company secretary operations that are auditable, scalable, resilient and dependabale.
CoSec Hub, powered by Lumorus, addresses each structural failure of the broken CoSec model directly. Statutory registers are maintained as live, structured records with full audit trails. Filing deadlines are tracked by an automated engine that escalates where action is required. Board resolutions are stored in a searchable repository linked to the relevant entity and meeting record. Institutional knowledge is encoded into the platform rather than carried by individuals.
CoSec Hub vs The Broken Model: A Direct Comparison
The Standard Has Changed. The Infrastructure Needs to Match.
Regulatory environments across the world are tightening. The Companies and Allied Matters Act amendments in Nigeria, the Companies Act requirements in Ghana, and the UK’s Economic Crime and Corporate Transparency Act all reflect the same direction of travel: greater transparency, faster disclosure, more rigorous record-keeping, and real accountability for governance failures.
Organisations that continue to run their CoSec function on spreadsheets and inboxes are not just operationally inefficient. They are operating on infrastructure that is increasingly misaligned with the legal and regulatory standard they are expected to meet.
The question is no longer whether to modernise CoSec infrastructure. It is whether to do it before a governance failure makes the decision for you.
“The CoSec function carries more legal and regulatory weight than most organisations appreciate. It deserves infrastructure that reflects that weight.”
Start Where You Are
The transition from a broken model to a functional one does not require rebuilding everything overnight. It requires a clear audit of where your current governance infrastructure is genuinely fragile, followed by a structured move to a platform built for the work.
CoSec Hub, powered by Lumorus, is built exactly for this: organisations that have outgrown their current CoSec model and need infrastructure that can carry the weight of genuine governance, not the appearance of it.
If your CoSec function runs on spreadsheets, inboxes, and memory, it is not a matter of whether something will break. It is a matter of when, and how much it will cost when it does.
Citations & Sources
- Chartered Governance Institute UK & Ireland (2023). Company Secretarial Benchmarking Survey: Governance Operations and Technology Adoption.
- PwC Africa (2022). Corporate Governance in Sub-Saharan Africa: Risk, Process, and Accountability in Growth-Stage Companies. PwC annual governance report series.
- Financial Reporting Council (2024). UK Corporate Governance Code. FRC. www.frc.org.uk
- Companies and Allied Matters Act (CAMA) 2020, Federal Republic of Nigeria. Corporate Affairs Commission.
- UK Economic Crime and Corporate Transparency Act 2023. Companies House.
