Governance and policies

Why it matters

Poor governance shows up as fraud nobody caught, a key hire made on a whim, an underpayment that ran for years, an owner who cannot take a holiday, and a business nobody wants to buy because everything depends on one person. Good governance shows up as faster decisions, consistent treatment of staff and customers, cleaner due diligence when you raise money or sell, and a company whose directors can show they have met their legal duties. Lenders, investors, large customers and acquirers all price it.

Roles, authority and the duties of directors

Governance begins with being clear about who does what. Owners decide what the business is for and who runs it. Directors of a company are legally responsible for its oversight: they must act in good faith in the company’s interests, with care and diligence, avoid conflicts of interest, not misuse their position or information, and not allow the company to trade while insolvent. These duties under the Corporations Act apply to the director of a two-person company just as they do to a listed board, and ASIC enforces them.

Management runs the business day to day under authority delegated by the owners or board. Writing down that delegation, often as a simple table of who can approve spending, hire, sign contracts or change prices up to what limit, is the single most useful governance document a growing business can produce. It lets managers act without asking and tells everyone where the lines are.

The policies a growing business actually needs

A policy is a short statement of what the business will and will not do in a given area, and who is accountable. It is not a procedure, which describes how, and it is not a legal document, although several policies exist to meet legal duties. The test for whether you need a policy is whether inconsistent decisions in that area would cause harm or legal exposure. Money, people, data, safety and conduct almost always pass that test.

Keep each policy to one or two pages, in plain language, with a named owner and a review date. A code of conduct sets expectations for behaviour. A financial delegations and expenses policy prevents both fraud and bottlenecks. Workplace policies on leave, flexible work, bullying and harassment, and grievance handling are expected by Fair Work and protect the business when disputes arise. WHS, privacy, information security and, increasingly, acceptable use of AI tools round out the set. Each should link to the procedures that implement it.

Reporting, meetings and independent eyes

Policies without reporting are hopes. Governance works when a regular cycle of information reaches the people accountable: a monthly management pack with financials, pipeline, people and risk indicators; a quarterly review of the risk register, policy compliance and strategy progress; and an annual review of the policies themselves. The meetings should be short, decision-focused and minuted, because minutes are the evidence that directors have met their duties.

Many growing businesses benefit from independent perspective before they need a formal board. An advisory board of two or three experienced people meeting quarterly, or a single independent adviser, challenges the owner’s assumptions and brings pattern recognition from other businesses. When you later need a formal board, for investors or scale, the habits are already in place. SMBH Consulting’s business consulting practice often helps owners set up this first layer of structure and the reporting that feeds it.

• Monthly: management report with finance, sales, people, operations and risk indicators.
• Quarterly: board or advisory meeting on strategy, risk register and policy compliance, minuted.
• Annually: policy review, delegations review, insurance and compliance calendar check.
• Always: conflicts declared and recorded; significant decisions documented with their reasons.

Keep it proportionate and alive

The most common governance failure in small business is not too little structure but structure that nobody uses: a forty-page policy manual downloaded from a template site and never read. Policies must be introduced, explained and visible. New starters read them in induction; managers refer to them when they make decisions; breaches are handled consistently. If a policy is never referred to, delete it or rewrite it.

Treat the whole system as a cycle. Draft a policy because a real problem or duty needs it, approve it at the right level, communicate it, apply it, measure whether it works, and review it on a schedule or when the law or the business changes. The rhythm matters more than the paperwork.

How to introduce governance without bureaucracy

1. Write down who decides what A one-page delegations table: spending, hiring, contracts, pricing, with limits and approvers.
2. Separate board and management decisions Even as a sole director, hold a short monthly "board" session and minute it.
3. Confirm your director duties and records Director IDs, ASIC details current, solvency monitored, conflicts declared.
4. Draft the core policies Eight or so, one to two pages each, plain English, named owner, review date.
5. Build the monthly management report Finance, sales, people, operations and risk on one or two pages. Discuss it, do not just circulate it.
6. Communicate and induct Policies are explained to the whole team and built into onboarding.
7. Add independent perspective An adviser or small advisory board meeting quarterly to challenge and support.
8. Review annually Policies, delegations and the reporting pack are revisited each year and after any major change.

Real-world example

A Perth engineering consultancy outgrows its founder

Swan River Engineering has grown from three to twenty-six staff in four years. The founder, Amara, still approves every expense, signs every proposal and handles every HR issue. Two project managers have quietly started making their own calls because waiting for her costs them clients, and the two approaches to pricing and overtime have diverged. A long-serving staff member resigns over a flexible work request that was handled differently from a colleague’s a month earlier.

Amara brings in an experienced adviser who starts with a delegations table: project managers can approve expenses to a set limit and sign proposals below a set value; anything above goes to her. Eight policies are drafted over two months and walked through with the team, including flexible work, workplace behaviour and a financial approvals policy that also addresses a fraud risk she had not seen. A one-page monthly report replaces her habit of reading every transaction. The adviser and an experienced client join a quarterly advisory board. Six months later Amara takes her first two-week holiday since founding the business, and the firm passes a government panel’s governance questionnaire that it would have failed a year earlier.

Common mistakes

• Downloading a policy manual Templates written for another business do not reflect how you work and nobody reads them. Write short policies for real problems.
• Delegating without limits Telling managers to "use their judgment" without stated limits produces inconsistency and leaves them exposed. Write the table.
• Ignoring director duties because the company is small Insolvent trading and conflicts of interest are enforced against small company directors too, and personal liability is real.
• Reports nobody discusses A management pack that is circulated but never reviewed in a meeting changes nothing.
• Applying policies selectively A policy enforced for some and waived for others is worse than none; it becomes evidence against you in a dispute.

KPIs to track

• Decisions escalated to the owner per month Should fall as delegations take hold. A rising count means limits are too low or unclear.
• Policies within review date Share of policies reviewed on schedule. Target: all.
• Staff who have acknowledged core policies Share of team with a recorded acknowledgment, including new starters within their first week.
• Board meetings held and minuted A simple discipline metric; four quarterly meetings a year with minutes is the baseline.
• Days the owner can be absent without a decision stalling A practical test of whether governance works. Aim for at least two weeks.

Frequently asked questions

Do I need a board if I am the only director?

Not a formal one, but you still carry a director’s duties, and the habit of a monthly minuted "board" session separating strategic decisions from daily operations improves decision quality and leaves a record. An advisory board adds outside perspective without legal appointment.

How many policies does a small business need?

Usually eight to twelve short ones covering conduct, money, people, safety, privacy and security, plus whatever your licences or contracts require. If you have more than twenty, check which are actually used.

What is the difference between a policy and a procedure?

A policy says what the business will and will not do and who is accountable. A procedure says how a task is performed step by step. Policies are approved by owners or the board; procedures are owned by managers and change more often.

What are the main duties of a company director in Australia?

To act in good faith in the best interests of the company, with care and diligence, to avoid improper use of position or information, to manage conflicts of interest, to keep proper records and to prevent insolvent trading. ASIC publishes plain-English guidance, and a lawyer or accountant can explain how they apply to you.

Key takeaways

• Governance is what lets a business run well by more than one person; it should free the owner, not restrain them.
• A one-page delegations table is the highest-value governance document a growing business can write.
• Eight to twelve short, used policies beat a forty-page manual nobody reads.
• Reporting and minuted meetings are the evidence that governance works and that directors have met their duties.
• Add independent perspective early; the habits are harder to build under pressure later.