Strategy to Execution, part 2

In Formula 1, the brakes are not there to slow the car down. They are there so the driver dares to go 300 km/h. Governance should work the same way.

Most governance does the opposite. It adds checkpoints, slows teams down and pushes them towards workarounds. In this article I show why heavy governance creates more risk, not less, and give you a "Yes, if" framework and a short control audit you can use to make governance an enabler again.

Strict rules can make you faster

Watch an F1 pit stop. You do not see chaos. You see highly synchronised procedures playing out in seconds. Strict rules do not have to slow you down. Done well, they are the reason you can move fast.

That is the standard I hold governance to. Does it let us go faster with confidence, or does it just make us slower?

Why governance often fails

We often hear the call for "agility," followed immediately by a stack of new mandatory checkpoints being added to the project lifecycle. That is where innovation dies. When governance is seen only as a control mechanism, it becomes the friction point that disconnects strategy from execution.

Three patterns show up again and again:

• Red tape. Documentation for the sake of documentation, often in rigid NIS2 or ISO 27001 implementations. Compliance gets treated as a one-off audit. ISMS.online makes the point that NIS2, like most regulations, requires continuous improvement, monitoring and regular assessment, not a "one and done" mindset (ISMS.online 2025).
• The "No, because" mindset. Gatekeepers who see their job as stopping risk rather than enabling safe progress.
• Siloed compliance. Security, legal and delivery treated as separate hurdles instead of one integrated flow.

The safety paradox

Here is the irony. The more control we layer on in the name of safety, the more risk we create.

When governance gets too heavy, high-performing teams do not just slow down. In my experience, they find workarounds: shadow IT and shadow processes that keep them productive. The result is that you lose visibility, and suddenly you have no governance at all.

Real safety comes from trust that is verified by automated, lightweight systems, not from administrative friction.

Make governance visible instead of heavy

To break the paradox, replace manual checkpoints with transparency. Picture an executive compliance dashboard that gives the board the comfort it needs without a 100-page report. It shows that governance is working in the background, so the business can keep its speed while managing its risk in real time.

From "No, because" to "Yes, if"

The fix is what I call progressive compliance: governance built into the daily workflow instead of being a separate event.

The "Yes, if" framework has three steps:

1. Automate the evidence. Collect it once, automatically where you can, and reuse it. If a security check passes in the pipeline, that piece of the audit is done. Hyperproof, a compliance software vendor, describes a customer, Clarifire, that centralised its evidence and reused it across three audits. That cut audit preparation time by 50% and control owners' effort by 66% (Hyperproof).
2. Review progressively. Instead of one big gate at the end, use small, frequent checks aligned with sprint cycles. That way unchecked work does not pile up. SAFe's guidance on Lean governance makes the same point: automate governance wherever feasible, so compliance runs continuously through delivery (Scaled Agile).
3. Match controls to risk. Low-risk changes get the fast lane. High-risk changes get the deep dive. Context matters more than a generic checklist.

An example: documentation as part of the sprint

The best public example I know comes from a heavily regulated place: the US Food and Drug Administration.

The team behind the FDA's Emergency Operations Network Incident Management System worked inside a lifecycle framework with ten phases, each ending in a stage-gate review. Getting documents approved could take up to four weeks, which does not fit a sprint rhythm (Agile Alliance).

They did not ignore the rules. They tailored them, with formal approval. They combined the design, development and test gates into one review cycle and used sprint planning and sprint reviews to get the go/no-go from the stakeholders. Documentation was estimated per story, given an owner, written during the sprint, and supported by a technical writer and pair writing.

The result, as the team reports it: less time spent on stage-gate reviews, shorter gaps between documentation deliveries, better defect removal, and a programme that grew to more stakeholder groups and more funding. Same compliance. Less friction.

That is "Yes, if" in practice.

Your action plan

Better governance does not start with the perfect framework. It starts with what you do on Monday morning.

• Audit the audit. Pick your five most time-consuming controls. Ask: "When did this control last catch a critical risk?" If the answer is "never" or "we don't know," it is a candidate for removal or automation.
• Apply the one-screen rule. If an executive cannot see the real-time status of compliance on one dashboard, your governance is too complex to be effective.
• Flip the question. In your next steering committee, ask "How can we help you move faster?" instead of "Why are you behind?" It moves the relationship from policing to partnership.
• Test every new control. Does it directly reduce a documented risk? Can it be verified automatically? Does it cost less than the risk it covers? If not, do not add it.

In my experience, the audit takes about two weeks, and the first three automated checks about four more.

Common mistakes to avoid:

• Treating compliance and delivery as enemies.
• Over-engineering simple things in the name of safety.
• Holding executives accountable without giving them operational visibility.

The bottom line

Good governance works like F1 brakes. It is the reason you can go fast, not the reason you go slow.

Heavy, manual governance creates the very risk it is meant to prevent, because people route around it. Light, automated and visible governance keeps everyone inside the system.

The best governance is the kind you barely notice, because it is part of how the work gets done.

So how many of your controls would survive the question "when did this last catch something?"

Read next: Part 3 of the series, The Translation Layer: Bridging Sales & Delivery. If you missed part 1, start with Why 90% of IT Strategies Fail, and How to Fix It.

Want governance that speeds you up? See how I help leadership teams with IT Leadership Consulting & Strategy Execution.

References

1. Muncaster, P. (2025). "What's Going Wrong with NIS 2 Compliance, and How to Put It Right." ISMS.online, 6 May 2025. https://www.isms.online/cyber-security/whats-going-wrong-with-nis-2-compliance-and-how-to-put-it-right/
2. Hyperproof. "How to Reduce Audit Fatigue and Compliance Costs (Tips from Security Professionals)." https://hyperproof.io/resource/audits-fatigue/
3. Kasik, O. & Silver, O. "Agile in Government: Keeping Documentation Lean." Agile Alliance experience report. https://agilealliance.org/resources/experience-reports/agile-federal-space-best-practices-keeping-documentation-lean/
4. Scaled Agile, Inc. "Lean Governance." SAFe framework article. https://framework.scaledagile.com/lean-governance