For general counsel, board secretaries and audit committees
An institution with a board does not instruct, it delegates — and delegated authority fails by drifting rather than by being exceeded. So every grant is enumerated rather than described, time-bounded rather than standing, reviewed on a cadence the board sets, and revocable immediately by whoever granted it without a contract action or our cooperation.
Boards are accountable for things they cannot supervise directly. They meet periodically, receive prepared material, and delegate almost everything operational — which is correct and unavoidable, and it means the quality of governance depends entirely on the quality of the delegation.
Most delegations are written once and never revisited. A resolution from four years ago authorises a category of activity in terms broad enough to cover things nobody contemplated, and the person operating under it has changed twice since.
Committees have overlapping remits that nobody has reconciled. Audit, risk, finance and technology each believe a given question is theirs or somebody else’s, and the ones that fall between are exactly the ones that become incidents.
The material a board receives is prepared by the people whose work it describes, which is not a criticism — there is nobody else to prepare it — but it means the board sees a summary shaped by the summariser, and the gap between the summary and the operating reality is where governance failures live.
And when something goes wrong, the first question is always the same and is usually hard to answer quickly: who was authorised to do that, under what, and when was it last reviewed.
A delegation written in categories rather than in acts expands quietly as circumstances change, and nothing in the ordinary governance cycle detects the expansion — so a board discovers the scope of what it authorised only when something goes wrong under it.
That is the failure this page is about, and it is not solved by writing a stricter resolution. A stricter resolution written in categories drifts the same way; what changes the behaviour is enumeration, expiry and review.
Enumeration means the grant lists acts rather than describing a domain. "May send correspondence in category X from template Y" is enumerable. "May manage communications" is a category and it will grow.
Expiry means the grant ends on a date and has to be renewed by a person. A standing authorisation is one nobody will ever revisit, and the renewal is the moment the board actually re-reads what it authorised.
Review means the cadence looks at what happened under the grant rather than at the grant itself — the actual acts, with their actor, authority, time and result. A review that re-reads the resolution reviews the intention, not the practice.
And revocation means the person who granted it can withdraw it immediately, alone, without a contract action, without a notice period and without our cooperation. A revocation that requires the vendor to act is not a revocation, and that distinction is the one worth testing during an engagement rather than reading in a contract.
Whether the delegation register is current — measured by whether every live grant, its grantor, its scope and its expiry can be listed without asking the operating team.
Time to answer "who was authorised to do that" — measured by elapsed minutes from the question to a supported answer, tested on a real past action rather than estimated.
Grants operating past their own review date — measured by count of live grants whose review cadence has lapsed.
What the board reviews at the cadence — measured by whether the review material is the acts performed or the resolution text — most committees review the second.
Escalations arising from the boundary — measured by count of acts refused as outside the grant, which is a health signal rather than a failure count.
Revocation actually working — measured by a revocation exercised during the engagement and verified, rather than described in a contract.
any authority the board did not grant in writing; any ability to widen a grant; any decision reserved to the board, a committee or an officer; and any role in preparing the board’s own judgement. Nothing here writes a delegation, interprets one, or advises on governance — it makes what was delegated and what happened under it legible.
Every capability described anywhere else in this architecture operates under a grant of this shape. That is the point of this page: the same instrument governs a benefits office, a health system office and a housing authority, and a governance reviewer can read one document rather than learning a product.
The record is written into the institution’s own systems and is exportable by the institution without a request to us. A governance record held by a vendor is one the board does not control.
The register of live grants is a document the institution holds, not a screen in a product. A board secretary should be able to take it to a meeting whatever the state of any vendor relationship.
And revocation is unilateral and immediate by construction. Where an institution wants to verify that, the right way is to exercise it during the engagement on a low-stakes grant and confirm the effect, rather than to read the clause.
Enumerated: the grant lists acts. A grant that describes a domain has already begun drifting on the day it is signed.
Time-bounded: it expires on a date and a person renews it deliberately. Standing authority is authority nobody re-reads.
Reviewable: the cadence examines the acts performed, with actor, authority, time and result, rather than the resolution text. A committee reviewing its own prior intention learns nothing.
Revocable: immediately, unilaterally, by the grantor alone, without a contract action or our cooperation. This is the one to test rather than read — exercise a revocation on a low-stakes grant during the engagement and verify that it took effect without anybody from our side being involved. A contractual right nobody has exercised is a right nobody has verified, and this is the property everything else on this page depends on.
And on assurance: an independent SOC 2 Type II attestation is in progress and no report exists yet, described as an attestation with a scope and a period rather than as a certification.
Counsel reads the grant, and the test is whether they can enumerate from it exactly what may happen without asking anybody. If the answer requires a conversation, the grant is a description rather than a delegation.
The audit committee should change what it reviews. Reading the acts performed under a grant is a different exercise from re-reading the grant, and it is the one that detects drift.
The board secretary holds the register, in the institution’s systems, and can take it to a meeting regardless of any vendor relationship.
And the external auditor should be given the record format early. If it would not support an audit assertion about authorisation, that is worth knowing before it is relied upon.
One low-stakes act, granted under an enumerated, time-bounded, reviewable grant — then revoked deliberately, so the institution verifies the revocation rather than reading about it.
Revoking on purpose is the whole exercise. It costs almost nothing, it takes an afternoon, and it converts the most important property on this page from a clause into an observation.
Institutions that do this find out something useful either way. Either the revocation was immediate and unilateral, in which case every other grant rests on a verified property — or it was not, in which case the engagement should stop and the finding is worth far more than the scope.
The grant itself should be genuinely low-stakes, because the point is the mechanism rather than the capability.
Most institutions’ are, and the useful question is not whether they exist but what shape they take. Are they written as enumerated acts or as described domains? Do they expire, or stand until revoked? Does the review read what happened under them, or re-read the resolution? A register of standing, category-shaped delegations reviewed by re-reading is the ordinary arrangement, and it is exactly the one that drifts. If yours is already enumerated, expiring and reviewed on acts, you have solved this and should tell other institutions how.
Things stopping is the intended behaviour and it is the cheaper failure. The alternative — authority that persists because nobody remembered to end it — fails in the direction where a board discovers scope during an incident. Renewals are surfaced before expiry with lead time, so forgetting is visible rather than silent. If a grant lapses and nobody notices for a month, that is itself the finding: the act was not needed.
Because standard clauses are frequently untested and the failure only appears when it matters. Exercise it on a low-stakes grant during the engagement: does it take effect immediately, does it require anybody from our side to act, does it need a contract action or a notice period? A right nobody has exercised is a right nobody has verified, and every other property on this page depends on this one being real.
Nor should it change for a vendor — the change is worth making for its own sake and it applies to every delegation the institution holds, not only ones involving us. If the committee reads the acts performed under one grant as an experiment and finds it tells them nothing they did not know, keep the current practice. Most committees find the opposite, and the finding is about their own organisation rather than about any arrangement with us.