Most BAFs fail quietly: too many risks, no visible gaps, and assurance that asserts rather than proves. The fix is structural, not cosmetic.
Ask a board to describe its principal risks and you will often hear a long pause. That pause is the sound of a Board Assurance Framework that has become a compliance artefact rather than a decision-making instrument. In our reviews, the failure modes are remarkably consistent.
First, proliferation: fifteen strategic risks is not a framework, it is a list. Boards can genuinely grip between five and eight principal risks; beyond that, attention dilutes and everything becomes equally important — which is to say, nothing is.
Assurance must be three lines deep
Second, assurance is frequently asserted rather than evidenced. A line that reads 'monthly performance review' tells a board nothing about whether the control is working. Mature frameworks distinguish management oversight, compliance functions and independent audit — and, crucially, they show the gaps where assurance is thin or absent.
Make it earn its place on the agenda
The corrective is discipline: fewer risks, each with a named executive owner, an explicit appetite statement and a dated plan for every assurance gap. When a BAF changes what a board discusses — and what it asks for next — it is doing its job. Until then, it is wallpaper.
