This chapter looks at whether you can operate confidently inside a sound governance framework—using the Board, committees, and control functions well—while setting the tone on ethics and compliance. Boards expect CEOs to understand their own role versus the Board’s, to respect process without hiding behind it, and to integrate risk and compliance into how the business is actually run. The skills here assess whether you’ve already behaved like a CEO in governance settings: transparent, appropriately challenged, and disciplined, with a clear sense of boundaries and accountability. In short, this chapter helps you test whether you can be trusted to “run the company” while working in partnership with those who “govern the company.”
10.1 Clear understanding of Board vs. management roles and governance norms
What the Board is looking for
When Boards evaluate a candidate’s understanding of Board vs. management roles and governance norms, they are checking whether this person knows how to operate at the top without overreaching or under-engaging. They want to see a track record of using the Board appropriately for strategy, oversight, and CEO accountability—while keeping day-to-day operations squarely in management’s remit. They also look for evidence that the candidate respects formal governance processes (committees, delegations, information flows) and can navigate them without gamesmanship or defensiveness. Ultimately, Boards want someone who can be a true partner: clear on who decides what, transparent in what they bring to the Board, and disciplined about how governance works in practice.
Open-ended question
“Describe your experience working with Boards and formal governance structures—how you have distinguished between what belongs with the Board versus management, how you have handled situations where those boundaries were tested or blurred, and what feedback you’ve received (explicitly or implicitly) about how you show up in governance settings.”
Rubric – 10.1 Clear understanding of Board vs. management roles and governance norms
Nascent
- Has had limited direct exposure to Boards; interactions have mostly been through presenting as a functional or business leader in selected sessions.
- Limited familiarity with formal governance documents (e.g., charters, delegations of authority) and how they translate into “who decides what.”
- Past behavior shows occasional blurring of roles—either escalating operational matters to the Board or, conversely, not escalating issues that clearly warranted Board involvement.
- Has not yet had responsibility for shaping Board agendas, materials, or committee discussions.
Developing
- Has had recurring interaction with a Board or equivalent body (e.g., division board, investment committee) and can describe basic role distinctions.
- Can point to instances where they adjusted their approach after learning what the Board wants to see vs. what should stay in management.
- Has contributed to Board papers or governance processes, with some feedback on clarity, relevance, or balance of detail.
- Still developing confidence and judgment in edge cases—for example, when a performance, risk, or people issue should be escalated to Board level.
CEO-Ready
- Has regularly engaged with a Board as an enterprise or major business leader and has helped shape agendas, materials, and discussions.
- Can demonstrate sound judgment in what is brought to the Board for decision, oversight, or information, versus what is handled within management.
- Operates comfortably within governance norms (e.g., committee structures, executive sessions, information rights) and uses them to enhance, not hinder, effective leadership.
- Feedback from Board members or senior colleagues indicates they are seen as a reliable, transparent, and appropriately bounded partner to the Board.
Distinctive
- Has played a central role in improving governance effectiveness—e.g., sharpening Board agendas, clarifying decision rights, or refining committee structures.
- Can point to situations where they successfully navigated significant tension around Board vs. management roles (e.g., activism, crisis, major transactions) while preserving trust and clarity.
- Is viewed by Chairs/Lead Directors as someone who “gets governance” and helps the Board focus on the right issues at the right altitude.
- Across roles or organizations, has built a reputation for exemplary Board-management interactions that others cite as a model for how governance should work.
10.2 Establishing and overseeing enterprise risk management and risk appetite
What the Board is looking for
When Boards evaluate a candidate’s ability to establish and oversee enterprise risk management (ERM) and risk appetite, they are looking for proof that risk is being managed systematically, not ad hoc. They want to see that the candidate has helped define what levels of risk the organization is willing to take in different areas and has put structures in place—frameworks, processes, reporting—to identify, assess, and monitor those risks. They also look for evidence that ERM is linked to real decisions: strategy, capital allocation, operations, and incident response, not just an annual risk register exercise. Ultimately, they want someone who can help the Board see the true risk profile of the company and ensure it stays within an agreed appetite while still pursuing growth.
Open-ended question
“Describe how you have established or significantly improved enterprise risk management and risk appetite in your organization—what frameworks or processes you put in place, how you worked with the Board and management to define risk appetite, how you embedded it into decision-making, and what changes you saw in the way risks were identified, discussed, and managed over time.”
Rubric – 10.2 Establishing and overseeing enterprise risk management and risk appetite
Nascent
- Has had limited involvement in formal risk management beyond contributing to function- or project-level risk registers.
- ERM activities under their remit were largely compliance-driven (e.g., annual templates, basic heat maps) with little linkage to real decisions.
- Cannot point to clear risk appetite statements or limits that guided behavior in their area of responsibility.
- Board or senior risk discussions, where they occurred, focused mainly on operational issues rather than integrated, enterprise-level risk.
Developing
- Has participated in or supported ERM efforts (e.g., risk assessments, workshops, risk reporting) for a business unit or function.
- Can point to at least one instance where identified risks led to concrete mitigation actions or changes in plans.
- Has been involved in early discussions of risk appetite, often in qualitative terms, but translation into thresholds and limits is still limited.
- Risk reporting has improved in their area (e.g., clearer dashboards, more structured reviews), though coverage and consistency are still maturing.
CEO-Ready
- Has led or co-led the design or enhancement of an ERM framework for a significant business or enterprise, including clear roles, processes, and reporting.
- Can demonstrate how risk appetite (qualitative statements and, where appropriate, quantitative limits) was defined with the Board and cascaded into policies, limits, and decision criteria.
- Regularly oversees integrated risk reviews that cover strategic, financial, operational, and compliance risks, with clear ownership and follow-up actions.
- Track record shows that risk insights have influenced major decisions (e.g., growth bets, portfolio moves, leverage, exposure to specific markets/products), keeping the organization within agreed risk appetite.
Distinctive
- Has transformed a fragmented or reactive risk approach into a robust ERM capability that is fully integrated with strategy, planning, and performance management.
- Can point to situations where a well-defined risk appetite and strong ERM framework prevented or mitigated significant value destruction (e.g., over-leverage, concentration risk, geopolitical or regulatory shocks).
- ERM processes and risk appetite frameworks developed under their leadership are seen as exemplars and have been adopted or adapted in other parts of the organization or in later roles.
- Across roles or companies, is known for creating an environment where risk is discussed openly and quantitatively, enabling bolder but better-calibrated strategic decisions.
10.3 Ensuring robust compliance, internal controls, and audit effectiveness
What the Board is looking for
When Boards evaluate a candidate’s ability to ensure robust compliance, internal controls, and audit effectiveness, they are looking for evidence that this person treats the “control environment” as part of how the business runs, not as a back-office obligation. They want to see a track record of strengthening controls and compliance where needed, responding decisively to findings, and supporting internal audit’s independence and access. They also look for proof that the candidate has balanced growth and performance ambitions with sound controls—avoiding both reckless risk-taking and paralyzing bureaucracy. Ultimately, they want someone they can trust not to preside over avoidable control failures, regulatory breaches, or integrity lapses.
Open-ended question
“Describe how you have strengthened compliance, internal controls, and audit effectiveness in your organization—what issues or gaps you identified (e.g., through incidents, audits, or reviews), what specific actions you took to address them, how you worked with compliance and internal audit, and what changed in terms of control environment, findings, or regulatory/partner confidence as a result.”
Rubric – 10.3 Ensuring robust compliance, internal controls, and audit effectiveness
Nascent
- Has mostly viewed compliance, controls, and audit as support or policing functions, with limited personal ownership for their effectiveness.
- Responses to control failures or audit findings in their area were mainly about fixing the immediate issue rather than addressing root causes.
- Few examples where they proactively assessed control or compliance risks ahead of incidents or external pressure.
- Limited engagement with internal audit or compliance beyond responding to specific requests, reviews, or training.
Developing
- Has taken some steps to address control or compliance weaknesses after issues were identified (e.g., improved procedures, added approvals, training).
- Can point to at least one case where they worked constructively with internal audit or compliance to resolve significant findings.
- Has begun to use audit results, control testing, or compliance reports as inputs into management discussions and improvement plans.
- Still developing a more systematic view of the control environment; focus is often on “hot spots” rather than integrated risk-based coverage.
CEO-Ready
- Has had clear responsibility for the control environment and compliance posture of a substantial business or function.
- Can demonstrate multiple examples where they strengthened controls, compliance processes, or segregation of duties, leading to fewer or less severe findings over time.
- Works closely and transparently with internal audit and compliance, supporting their independence, ensuring access, and driving timely remediation of issues.
- Is recognized by Boards, auditors, and regulators (where relevant) as someone who takes controls and compliance seriously and integrates them into how the business is run.
Distinctive
- Has led a significant uplift or transformation of the control and compliance environment after a period of weakness, rapid growth, or heightened scrutiny.
- Can point to substantial reductions in material weaknesses, significant deficiencies, or regulatory issues, alongside healthy business performance.
- Has helped redesign governance, control frameworks, and assurance models in ways that improved both effectiveness and efficiency.
- Across roles or organizations, is known for building cultures where “doing it right” is non-negotiable and where audit, compliance, and management work as aligned partners in safeguarding the enterprise.
10.4 Leading on ethics, integrity, and whistleblowing culture
What the Board is looking for
When Boards evaluate a candidate’s ability to lead on ethics, integrity, and whistleblowing culture, they are looking for proof that this person does more than recite values statements. They want to see a track record of setting clear expectations, acting consistently with those expectations under pressure, and creating channels where people can safely raise concerns without fear of retaliation. They also look for evidence that the candidate has handled real ethical issues and investigations transparently and fairly, including when senior or high-performing individuals were involved. Ultimately, they want someone whose behavior, and whose response to others’ behavior, signals that ethics and integrity are non-negotiable—even when it is inconvenient, embarrassing, or costly.
Open-ended question
“Tell us about specific situations where you have had to lead on ethics or integrity—this could include responding to misconduct or conflicts of interest, handling whistleblower reports or informal complaints, or shaping how people raise concerns. What did you personally do and decide, how did you communicate, and what were the consequences for the individuals involved, the wider organization, and the culture?”
Rubric – 10.4 Leading on ethics, integrity, and whistleblowing culture
Nascent
- Has had limited direct involvement in serious ethics or integrity matters beyond referring issues to HR, Legal, or Compliance.
- Few examples where they personally initiated or championed action based on ethical concerns, especially when not mandated by policy.
- Whistleblowing or speak-up mechanisms in their area were largely handled at arm’s length, with limited visibility into how concerns were raised or resolved.
- Track record does not yet show clear instances of taking a principled stand that involved personal or organizational cost.
Developing
- Has been involved in investigating or resolving at least one ethics or integrity issue, supporting fair process and consequences.
- Can point to some efforts to encourage open discussion of concerns (e.g., town halls, office hours, “speak-up” messaging), with early signs of impact.
- Has occasionally acted on informal signals (rumors, soft complaints), but follow-through and communication have been somewhat inconsistent.
- Is becoming more aware of the importance of non-retaliation and confidentiality, though systems and behaviors are not yet consistently reinforced.
CEO-Ready
- Has led multiple cases where ethical concerns, conflicts of interest, or misconduct were raised (via whistleblowing channels or otherwise) and were handled promptly, fairly, and transparently within appropriate confidentiality limits.
- Can demonstrate decisions where ethics and integrity clearly overrode short-term commercial or political considerations (including with senior or high-performing individuals).
- Has actively strengthened speak-up culture—promoting channels, reinforcing non-retaliation, and ensuring that people see issues being addressed, not buried.
- Is recognized by employees, peers, and the Board as someone whose actions and decisions consistently align with stated values, especially when under scrutiny or pressure.
Distinctive
- Has played a decisive role in resetting an organization’s ethics culture after serious issues (e.g., scandal, systemic misconduct, toxic behaviors) came to light.
- Can point to high-profile cases where their principled stance, transparency, and follow-through significantly rebuilt internal and external trust.
- Has embedded ethics and speak-up expectations into leadership evaluations, promotions, and succession—making integrity a true criterion for advancement.
- Across roles or organizations, is widely regarded as a moral anchor: someone whose presence materially raises the ethical standard and courage of those around them.
10.5 Integrating ESG and sustainability into strategy and reporting
What the Board is looking for
When Boards evaluate a candidate’s ability to integrate ESG and sustainability into strategy and reporting, they are looking for evidence that these topics have been treated as core to long-term value, not as a side program or branding exercise. They want to see that the candidate has identified the ESG issues most material to the business, embedded them into strategic priorities, investments, and operating decisions, and ensured transparent, credible reporting to stakeholders. They also look for a track record of engaging the Board on ESG and responding to evolving expectations from regulators, investors, customers, and employees. Ultimately, they want someone who can balance ambition and pragmatism—using ESG and sustainability to manage risk, unlock opportunity, and strengthen the company’s license to operate.
Open-ended question
“Describe how you have integrated ESG and sustainability considerations into the strategy and reporting of a business you’ve led—what you determined was most material, what you changed in strategy and operations, how you structured ESG metrics and disclosures, and what impact this had on performance, stakeholder perceptions, and Board/investor dialogue.”
Rubric – 10.5 Integrating ESG and sustainability into strategy and reporting
Nascent
- Has had limited involvement in ESG or sustainability beyond approving standalone reports or initiatives led by specialized teams.
- ESG topics under their remit were largely treated as compliance or communications issues, with minimal connection to core strategy or capital allocation.
- Cannot point to specific strategic choices, investments, or operating changes driven by ESG or sustainability considerations.
- ESG reporting, where present, was mostly descriptive and not clearly linked to targets, performance, or Board-level discussion.
Developing
- Has participated in identifying key ESG topics and contributed to some sustainability initiatives (e.g., energy efficiency, diversity programs, community efforts).
- Can point to at least one strategic or operational decision where ESG factors influenced direction, scope, or timing.
- Has begun to use ESG-related metrics and disclosures in leadership reviews, though integration with core KPIs and strategy remains partial.
- ESG reporting in their area has improved in structure or transparency, but may still lack clear links to value creation and risk management.
CEO-Ready
- Has led or co-led the integration of ESG and sustainability into the strategy of a substantial business or enterprise, focusing on material issues.
- Can demonstrate concrete examples where ESG considerations shaped portfolio choices, product/service design, supply chain decisions, or long-term investment priorities.
- Oversees ESG metrics, targets, and reporting that are connected to business KPIs, Board discussions, and, where appropriate, executive incentives.
- Is recognized by the Board and key stakeholders as someone who understands ESG’s strategic relevance and can articulate a coherent sustainability narrative supported by evidence.
Distinctive
- Has used ESG and sustainability as a meaningful driver of strategic differentiation—e.g., entering new green markets, redefining value propositions, or significantly de-risking the business model.
- Can point to sustained improvements in key ESG outcomes (e.g., emissions, safety, DEI, supply chain standards, community impact) that are acknowledged by external benchmarks, ratings, or stakeholders.
- Has helped establish high-quality ESG governance and reporting practices that withstand scrutiny from investors, regulators, and civil society and are viewed as best practice.
- Across roles or organizations, is known for integrating sustainability deeply into “how the company wins,” rather than treating it as a parallel agenda, thereby enhancing both reputation and long-term financial performance.
