Growth changes the governance problem.
A financial firm with one regulated entity, a compact management team and a relatively straightforward operating model may be able to govern effectively through experienced individuals, established committees and a manageable set of policies; then the business grows, new products are launched, new entities are incorporated, more senior managers join, regulatory permissions expand, technology dependencies increase and operations cross jurisdictions.
The board receives more information, yet visibility can actually decline; risk committees multiply, yet ownership can become less clear, policies become more comprehensive, while the distance between documented governance and day-to-day decision making grows.
This is the point at which many financial firms discover that governance infrastructure has not kept pace with enterprise complexity. For regulated financial institutions, that is not merely an efficiency problem, it is an enterprise risk.
The Prudential Regulation Authority made governance and controls, operational and financial resilience, and data risk central priorities for UK banks and building societies in 2026. Its priorities for international banks similarly emphasise maintained focus on risk management, governance, controls and resilience.
Meanwhile, the Financial Conduct Authority continues to treat operational resilience as fundamental to protecting consumers and market integrity, while new operational incident and third-party reporting requirements are due to take effect from March 2027.
The implication is clear.
Growing financial firms need governance that can scale before organisational complexity overwhelms the systems designed to control it.
That makes the choice of governance infrastructure development partner strategically important.
Read More: Governance Infrastructure
What governance infrastructure actually means
Governance infrastructure is sometimes confused with governance software, it is much broader.
Technology can form part of the infrastructure, but governance infrastructure is the complete architecture through which authority is allocated, decisions are made, risk is challenged, information reaches the board and accountability is maintained.
For a growing financial firm, this usually includes:
- Board and committee structures.
- Matters reserved for the board.
- Delegated authorities.
- Senior management responsibilities.
- Risk and control frameworks.
- Regulatory accountability.
- Decision and escalation protocols.
- Management information.
- Board information flows.
- Governance calendars.
- Entity governance.
- Policy architecture.
- Assurance arrangements.
- Board and committee effectiveness.
- Director capability.
- Governance technology.
- Evidence and record keeping.
These components need to work together.
- If the board structure is sophisticated but management responsibilities remain unclear, governance is weak.
- If risk reporting is excellent but material issues reach directors too late, governance is weak.
- If the firm has advanced governance technology but nobody owns the underlying controls, governance is weak.
Therefore, the objective is not to install individual governance mechanisms.
It is to design an operating system for accountability.
The Financial Reporting Council describes corporate governance as the system of rules, practices and processes through which a company is managed and controlled, while emphasising trust, transparency and accountability as foundations for long-term performance.
That system becomes more important as a firm grows.
Explore More: Governance Review
Why financial firms need specialist governance infrastructure partners
Financial services governance is different from general corporate governance because regulation reaches deeply into organisational design.
Boards do not operate independently of prudential regulation, conduct obligations, operational resilience, financial crime controls, Consumer Duty, individual accountability and regulatory reporting.
The Senior Managers and Certification Regime, for example, is designed to ensure that firms can identify who is responsible for significant areas of the business and hold senior individuals accountable for conduct and competence.
Consequently, governance infrastructure cannot be designed solely around elegant organisation charts.
It must work in regulatory reality.
A credible development partner should understand how the board, senior management, risk, compliance, internal audit and business functions interact.
It should also recognise that a firm can have too much governance.
Excessive committees, overlapping responsibilities, duplicated reporting and unclear escalation routes create friction without necessarily improving control.
Good governance architecture therefore balances:
- Control with speed.
- Challenge with accountability.
- Consistency with proportionality.
- Board oversight with management autonomy.
The strongest partner is not the one that produces the largest governance manual.
It is the one that helps the firm make accountability clearer and decisions better.
The Governance Infrastructure Partner Landscape
There is no credible universal ranking of governance infrastructure advisers because different firms serve different needs.
A global bank undergoing enterprise-wide controls transformation may require a very different partner from a growing fintech, wealth manager, lender or investment firm building its first institutional governance model.
Therefore, the following is not a league table.
It is a practical market map of established providers whose published services align with governance infrastructure development.
Governance Infrastructure Partners to Consider
The important question is not which organisation is largest.
It is which partner best fits the governance problem your firm actually needs to solve.
1. Lumorus: specialist governance infrastructure for growing firms
Lumorus approaches governance infrastructure from the board and accountability perspective rather than treating it purely as a risk technology or controls programme.
Its Governance Infrastructure service is designed around establishing or strengthening frameworks, policies and procedures that support accountability, transparency and effective decision making.
Importantly, the approach is intended to be tailored to the organisation’s strategy, regulation and operating environment rather than based on a standard template.
For growing financial firms, this specialist model can be particularly relevant because governance problems frequently emerge at the point where an entrepreneurial operating model needs to become an institutional one.
The founder can no longer approve everything. The board needs more formal information. Committees require clearer mandates. Senior management responsibilities need sharper definition. Risk ownership needs to become institutional rather than personal. Governance must become repeatable.
Lumorus’ wider governance capabilities include:
That combination makes the proposition broader than framework drafting.
It connects architecture with the board’s ability to use it.
Read More: Governance Infrastructure
2. PwC: governance transformation at enterprise scale
PwC offers governance, risk and compliance services spanning enterprise risk management, controls, operating models, resilience and governance frameworks.
Its published approach combines business understanding, technical expertise, data and technology, with services including governance, risk and control frameworks and risk and controls operating models.
PwC also provides entity governance and compliance support, including governance operating model design, policy frameworks and subsidiary governance arrangements.
That breadth makes PwC particularly relevant where the challenge extends beyond the board into enterprise-wide transformation.
For example:
- A financial group rationalising hundreds of legal entities.
- A bank redesigning its governance, risk and controls operating model.
- A firm integrating governance following an acquisition.
- A multinational requiring consistent subsidiary governance.
- An organisation undertaking a substantial controls transformation.
The advantage is scale and breadth.
However, growing firms should also ask whether a large transformation model is proportionate to their needs.
The right solution is not always the largest one.
3. Deloitte: governance connected to risk and regulatory transformation
Deloitte positions governance within a broader governance, risk and regulatory framework, combining board oversight with enterprise risk management and corporate compliance.
Its published services include improving board effectiveness, designing risk infrastructure and aligning people, processes and technology across governance and compliance activities.
Deloitte also emphasises operational and non-financial risk, including the development of risk frameworks and systems capable of helping organisations manage increasingly complex risk environments.
This can make the firm particularly relevant where governance infrastructure is closely connected to:
- Risk transformation.
- Regulatory remediation.
- Technology.
- Controls.
- Enterprise compliance.
- Operational risk.
For a larger or rapidly scaling financial institution, that integration can be valuable because governance problems often cannot be separated cleanly from risk systems and regulatory architecture.
However, firms should still ensure board governance does not disappear inside a much larger transformation programme.
Governance infrastructure ultimately needs to improve accountability at the top of the organisation, not simply generate a better GRC operating model.
4. EY: financial services risk governance expertise
EY brings a particularly strong financial services orientation to risk and governance work.
Its Financial Services Risk Management practice combines regulatory, qualitative, quantitative and technology capabilities, while supporting financial institutions with integrated frameworks for identifying, measuring, mitigating and monitoring risk.
This can be valuable for financial firms whose governance infrastructure challenge is closely tied to regulatory risk.
For example:
- Risk appetite redesign.
- Enterprise risk frameworks.
- Regulatory change.
- Prudential governance.
- Digital transformation.
- Risk measurement.
- Governance surrounding complex financial products.
A growing financial institution may find this depth especially useful when it is moving into a more sophisticated regulatory category or expanding activities that materially alter its risk profile.
The key is ensuring that technical risk sophistication remains connected to clear board accountability.
A complex risk model is useful only if directors understand what it tells them and know when intervention is required.
5. KPMG: internal controls and assurance architecture
KPMG provides a broad suite of risk and regulatory services, including internal controls, risk and compliance, internal audit and technology-enabled governance support.
Its work on internal controls is especially relevant as organisations rethink how controls are designed, monitored and maintained in increasingly complex operating environments.
KPMG argues that traditional control environments can become manual, fragmented and retrospective, while more modern approaches use automation, continuous monitoring and data analytics to build dynamic control frameworks.
For listed financial firms, the 2024 UK Corporate Governance Code adds further relevance.
Provision 29 requires boards within scope to monitor and review risk management and internal controls and make declarations about material control effectiveness for financial years beginning on or after 1 January 2026.
This creates a governance infrastructure challenge because boards need evidence strong enough to support those conclusions.
KPMG may therefore be particularly relevant where the primary need is controls maturity, monitoring and assurance.
6. Grant Thornton: governance renewal and board effectiveness
Grant Thornton takes a governance advisory approach focused on board effectiveness, governance restructuring, leadership dynamics and decision making.
Its published services include designing governance frameworks, aligning board and leadership structures with strategic objectives and improving accountability. The firm also draws on a large governance benchmarking dataset covering listed-company practice.
In addition, Grant Thornton maintains a dedicated financial services advisory practice spanning banking, capital markets, insurance and investment management.
This combination can make the firm particularly relevant to:
- Growing financial institutions.
- Listed financial businesses.
- Mid-market firms.
- Organisations undertaking board renewal.
- Businesses responding to changing regulatory expectations.
Its 2026 financial services outlook also highlights the shift from documented compliance towards evidence that governance, controls and resilience actually work in practice.
That distinction matters because governance infrastructure should be tested by outcomes, not documentation.
What a Growing Financial Firm Should Actually Buy
The market often sells governance in fragments.
- Board evaluation.
- Risk framework.
- Committee review.
- Policies.
- GRC software.
- Compliance monitoring.
- Controls testing.
- Director training.
Each can be useful.
However, buying them independently can recreate the fragmentation governance infrastructure is supposed to solve.
A growing financial firm should first define the operating model it needs.
A Strong Governance Infrastructure Programme Should Address
A development partner should be able to connect these areas rather than treat them as independent projects.
Governance infrastructure should scale before the firm does
One of the most damaging assumptions in fast-growing financial businesses is that governance can be added later.
Growth often makes that impossible.
By the time the weakness becomes visible, the organisation may already have:
- Multiple entities.
- Several regulators.
- Complex delegation structures.
- New shareholders.
- International operations.
- Third-party dependencies.
- Significant technology risk.
- Numerous committees.
- Fragmented reporting.
At that stage, governance redesign becomes more disruptive.
A better principle is to build governance slightly ahead of complexity.
That does not mean creating bureaucracy before it is needed.
It means anticipating the governance consequences of strategy.
If the firm intends to double assets under management, enter another regulated market or launch a new digital proposition, the board should ask what governance infrastructure that future operating model will require.
Read More: Board Strategy Sessions
Regulatory accountability must remain visible as the business grows
Growth tends to distribute responsibility.
That can create strength because decisions move closer to people with relevant expertise.
It can also create ambiguity.
The FCA’s Senior Managers and Certification Regime is built around the principle that firms should be able to identify clearly who is responsible for significant functions and risks. Although reforms announced in 2026 aim to make aspects of the regime more proportionate, the underlying principle of individual accountability remains.
Therefore, governance infrastructure needs to answer:
- Who owns the risk?
- Who has authority to decide?
- Who challenges?
- Who receives escalation?
- Who provides assurance?
- Which senior manager is accountable?
- Where does board responsibility begin?
If those answers require prolonged interpretation of several diagrams and policy documents, accountability is probably not clear enough.
Operational resilience is now part of governance infrastructure
For financial institutions, governance infrastructure cannot stop at the boardroom door.
Operational resilience links governance to technology, outsourcing, business continuity and third-party risk.
The FCA defines operational resilience as the ability to prevent, adapt, respond to, recover from and learn from operational disruption. Firms within scope were required by 31 March 2025 to be able to remain within impact tolerances for important business services.
By July 2026, the FCA and PRA were also emphasising the increasingly interconnected nature of the financial system and the importance of resilience across networks of critical service providers.
This creates direct governance questions.
- Does the board understand critical dependencies?
- Who owns third-party risk?
- How quickly do incidents escalate?
- Can directors see whether important business services remain within tolerance?
- Does governance survive a technology outage?
These are not merely operational questions.
They test whether the governance architecture works under pressure.
Technology matters, but software is not governance infrastructure
Growing firms often recognise fragmentation and conclude that they need a governance platform.
They may.
However, digitising poor governance does not make it good governance.
A technology platform can help with:
- Workflow.
- Board papers.
- Actions.
- Policies.
- Compliance calendars.
- Risk registers.
- Entity records.
- Assurance evidence.
It cannot decide whether the committee structure makes sense. It cannot determine whether a senior manager’s responsibilities are genuinely clear. It cannot decide whether the board receives the right information. It cannot create constructive challenge. It cannot repair a dysfunctional Chair and CEO relationship.
Technology is infrastructure only when it supports well-designed governance. The architecture comes first.
How to select the right governance infrastructure partner
The selection process should begin with diagnosis rather than procurement.
Before issuing an RFP, leadership should agree what problem it is trying to solve.
- Is governance failing to scale?
- Has the regulator identified weaknesses?
- Is decision making too slow?
- Are committees overlapping?
- Is the board overwhelmed with information?
- Is accountability unclear?
- Is the firm preparing for listing?
- Is expansion creating entity complexity?
The answers determine the partner.
Eight Questions to Ask Potential Partners
1. Do you understand regulated financial services?
Generic governance knowledge is not sufficient when the operating model is shaped by conduct and prudential requirements.
2. Will you diagnose before redesigning?
A partner arriving with a predetermined governance model is unlikely to produce genuinely proportionate governance.
3. Can you work at board and operational level?
Governance architecture fails when board design and operational processes are disconnected.
4. Can you distinguish governance from compliance?
Compliance is necessary, although governance also concerns authority, judgement, challenge and accountability.
5. Will the new model be practical?
A framework that works only on paper creates governance theatre.
6. Can you help build internal capability?
The firm should become more capable after the engagement, not permanently dependent on advisers.
7. Can technology integrate with the governance model?
Digital tools should support the operating model rather than dictate it.
8. How will you measure whether governance improved?
Good partners should be able to explain the outcomes they expect the redesign to produce.
Red flags when choosing a governance partner
A strong brand does not guarantee the right engagement.
Boards should be cautious when a prospective adviser:
- Starts by selling software rather than diagnosing governance.
- Produces generic committee structures without understanding strategy.
- Equates more policies with stronger governance.
- Cannot explain the relationship between governance and decision making.
- Focuses on regulatory compliance while ignoring organisational behaviour.
- Designs governance without speaking to the board.
- Creates reporting that adds volume but not insight.
- Leaves accountability dependent on interpretation.
- Produces recommendations without an implementation plan.
- Cannot explain how the new model should evolve as the firm grows.
The most dangerous governance framework is not obviously poor.
It is one that looks sophisticated enough to create false confidence.
A five-stage governance infrastructure development model
Growing financial firms can approach infrastructure development through five stages.
Stage 1: Diagnose
Assess the current governance model against strategy, regulation, risk and organisational complexity.
This should include board effectiveness, committee architecture, delegation, management responsibilities, information flows, controls and culture.
Read More: Governance Review
Stage 2: Design
Create the governance operating model.
Define the board and committee structure, decision rights, accountability, reporting and escalation.
Stage 3: Build
Develop the policies, terms of reference, reserved matters, delegated authorities, reporting templates and governance calendar required to operate the model.
Stage 4: Embed
Train directors and executives, test governance workflows and make sure the model works in actual decisions.
Explore More: Director Induction and Director CPD Training
Stage 5: Test and improve
Evaluate whether governance is producing better information, decisions and accountability.
Read More: Board Evaluation & Assessment
The fifth stage is critical. Governance infrastructure should never be considered finished. The organisation changes. So should governance.
The best governance infrastructure improves decisions before it improves reporting
Boards should be wary of measuring governance maturity through documentation alone.
- The strongest evidence appears in behaviour.
- Decisions become clearer.
- Escalations happen earlier.
- Directors receive better information.
- Management knows where authority sits.
- Risk discussions become more useful.
- Control weaknesses become visible sooner.
- Actions have owners.
The board spends less time reconstructing what happened and more time deciding what should happen next.
That is governance infrastructure working.
The FRC’s current governance approach increasingly reinforces this outcomes orientation. The 2024 Code encourages outcomes-focused reporting, while Provision 29 requires boards within scope to make declarations concerning material control effectiveness.
The regulatory direction therefore increasingly favours evidence that governance works.
Not evidence that governance exists.
Which partner is right for your firm?
There is no single correct answer.
- A global systemically important bank may reasonably need the scale of a major multidisciplinary consultancy.
- A rapidly expanding fintech may need specialist governance architecture that can be implemented quickly without building unnecessary bureaucracy.
- A listed financial group preparing for Provision 29 may prioritise internal controls expertise.
- A wealth manager entering new markets may require stronger board, entity and accountability structures.
- A firm facing regulatory remediation may need deep financial services risk capability.
The choice should follow the problem.
A Simple Decision Guide
The most important principle is proportionality.
The governance infrastructure should be sophisticated enough for the firm’s risk and complexity, but simple enough to operate.
Why Lumorus approaches governance infrastructure differently
At Lumorus, governance infrastructure begins with a simple premise.
Governance is not paperwork.
It is the allocation, exercise, constraint and accountability of power inside organisations.
That means infrastructure development should answer practical questions.
- Who decides?
- Who challenges?
- Who owns the risk?
- What reaches the board?
- What requires escalation?
- What evidence proves the system is working?
Lumorus’ governance model connects architecture with board capability through:
For growing financial firms, the objective is not to import governance designed for a much larger institution.
It is to build governance capable of growing with the institution.
The real governance infrastructure test comes under pressure
Almost every governance framework works when conditions are normal.
The real test comes when the organisation faces pressure.
- A regulator challenges management.
- A technology provider fails.
- Liquidity tightens.
- A major customer complaint escalates.
- A senior manager departs suddenly.
- A cyber incident occurs.
- A new product generates unexpected conduct risk.
The board has hours rather than weeks to decide.
At that moment, elegant governance diagrams matter very little.
What matters is whether the organisation knows who has authority, who needs to be informed, what risks require escalation and how decisions will be recorded and implemented.
Strong governance infrastructure makes those answers obvious. Weak infrastructure forces the organisation to improvise.
For financial firms, improvisation during a crisis is an expensive way to discover that governance did not scale with growth.
Lumorus: Better Business, Built on Purpose
Lumorus is a UK headquartered global governance, ESG, company secretary and advisory firm supporting organisations across Europe, Africa, Asia, the Caribbean, Canada, the Middle East and international markets.
For more than 10 years, we have helped boards, leadership teams and organisations strengthen governance, accountability and organisational resilience.
For growing financial firms, governance infrastructure should evolve before complexity becomes a control failure. That means establishing clear decision rights, effective board structures, robust information flows, proportionate controls and accountability systems capable of standing up to regulatory scrutiny.
Is your governance infrastructure designed for the financial firm you are today, or the institution you are becoming?
Contact Lumorus to request a Governance Infrastructure Assessment and explore how we can help strengthen board oversight, accountability and organisational resilience as your firm grows.
Email: [email protected]
Together, we can build better business: one that performs with purpose, leads with integrity and creates lasting value.
Sources
- Financial Conduct Authority – Operational resilience requirements and regulatory expectations.
- Financial Conduct Authority – Senior Managers and Certification Regime and individual accountability.
- Prudential Regulation Authority – UK Deposit Takers Supervision: 2026 priorities.
- Financial Reporting Council – UK Corporate Governance Code 2024 and Provision 29.
- Lumorus – Governance Infrastructure Development.
- PwC UK – Governance, Risk and Compliance services.
- Deloitte UK – Governance, Regulatory and Risk services.
- EY UK – Financial Services Risk Management.
- KPMG UK – Internal controls transformation and governance.
- Grant Thornton UK – Governance advisory, board effectiveness and governance renewal.
