Skip to main content
Book

Fractional governance atlas

Fractional & Advisory Roles: from risk to evidence

A control map for creating durable governance leadership, decision records, and internal capability without a full-time hire.

A program can have policies and still lack the decision rhythm, ownership, and executive evidence needed to operate.

Executive accountabilityRisk acceptanceOperating cadenceKnowledge transfer

ADV-01 · Control 1

Priority setting

The organization agrees which risks and controls matter now.

Accountable owner
Executive sponsor or advisor
Review cadence
Review at least annually and after a material change.

Maturity path

  • Foundational: Establish ownership, a documented workflow, and initial evidence for priority setting.
  • Developing: Run priority setting consistently with review cadence, metrics, and exception handling.
  • Advanced: Continuously improve priority setting through automation, testing, and executive reporting.

Test method: Review current evidence with the accountable owner and record exceptions.

Evidence to look for

  • 90-day roadmap
  • Risk register
  • Decision memo

ADV-02 · Control 2

Executive reporting

Boards and leaders receive clear status, decisions, and residual risk.

Accountable owner
Program owner
Review cadence
Review at least annually and after a material change.

Maturity path

  • Foundational: Establish ownership, a documented workflow, and initial evidence for executive reporting.
  • Developing: Run executive reporting consistently with review cadence, metrics, and exception handling.
  • Advanced: Continuously improve executive reporting through automation, testing, and executive reporting.

Test method: Review current evidence with the accountable owner and record exceptions.

Evidence to look for

  • Program scorecard
  • Board briefing
  • Risk acceptance record

Related controls

ADV-03 · Control 3

Escalation

Urgent privacy and AI issues reach the right owner quickly.

Accountable owner
Executive sponsor or risk owner
Review cadence
Review at least annually and after a material change.

Maturity path

  • Foundational: Establish ownership, a documented workflow, and initial evidence for escalation.
  • Developing: Run escalation consistently with review cadence, metrics, and exception handling.
  • Advanced: Continuously improve escalation through automation, testing, and executive reporting.

Test method: Review current evidence with the accountable owner and record exceptions.

Evidence to look for

  • Escalation path
  • Incident playbook
  • Decision SLA

ADV-04 · Control 4

Capability transfer

Internal owners can operate the program after advisory support ends.

Accountable owner
Internal program owner
Review cadence
Review at least annually and after a material change.

Maturity path

  • Foundational: Establish ownership, a documented workflow, and initial evidence for capability transfer.
  • Developing: Run capability transfer consistently with review cadence, metrics, and exception handling.
  • Advanced: Continuously improve capability transfer through automation, testing, and executive reporting.

Test method: Review current evidence with the accountable owner and record exceptions.

Evidence to look for

  • Coaching plan
  • Office-hours record
  • Handover checklist

ADV-05 · Control 5

Risk acceptance

Residual risk is accepted by the right decision-maker with a reason, expiry, and review path.

Accountable owner
Executive risk owner
Review cadence
Review at least annually and after a material change.

Maturity path

  • Foundational: Establish ownership, a documented workflow, and initial evidence for risk acceptance.
  • Developing: Run risk acceptance consistently with review cadence, metrics, and exception handling.
  • Advanced: Continuously improve risk acceptance through automation, testing, and executive reporting.

Test method: Review current evidence with the accountable owner and record exceptions.

Evidence to look for

  • Risk acceptance record
  • Decision authority matrix
  • Expiry or reassessment date

ADV-06 · Control 6

Decision records

Important governance decisions remain understandable after the meeting or engagement ends.

Accountable owner
Program owner
Review cadence
Review at least annually and after a material change.

Maturity path

  • Foundational: Establish ownership, a documented workflow, and initial evidence for decision records.
  • Developing: Run decision records consistently with review cadence, metrics, and exception handling.
  • Advanced: Continuously improve decision records through automation, testing, and executive reporting.

Test method: Review current evidence with the accountable owner and record exceptions.

Evidence to look for

  • Decision memo
  • Options and rationale
  • Action owner and due date

Questions to ask internally

  • Who makes residual-risk decisions?
  • What does leadership review monthly?
  • Is there a clear escalation path?
  • Where are important decisions recorded?
  • Do risk acceptances expire or get reassessed?
  • Can internal owners run the controls without external help?