Assurance and Governance

Definition

Assurance is demonstrating that controls exist and work. Governance is the structure that decides what controls should exist. Both are widely disliked because both are widely implemented as meetings.

The distinction that determines whether it works

Preventive controls make the wrong thing impossible: policy that blocks a public storage bucket, a pipeline that refuses an unsigned artefact, a network rule that cannot be bypassed.

Detective controls find it afterwards: scanning, drift detection, access review.

Preventive is better where the wrong thing is expensive and the rule is unambiguous. Detective is better where prevention would be too restrictive or where the rule requires judgement.

A governance model built on review meetings is neither — it is a third category, a human bottleneck that adds latency and, because reviewers cannot examine everything, provides less coverage than either automated option.

What good assurance looks like

• Controls implemented in the platform, so using the paved road makes a service compliant by construction. Then the assurance question becomes "is this service on the paved road", which is mechanically answerable.
• Evidence generated automatically as a side effect of normal operation. Auditors want proof a control operated throughout the period, and screenshots do not scale.
• Continuous rather than periodic. An annual review produces a snapshot; continuous checks produce a record.
• Exceptions tracked with owners and review dates, because a control set with no exception path is broken quietly rather than formally — and invisible exceptions are worse than granted ones.

The failure mode

Governance as a gate. Every change reviewed by a board that meets fortnightly. It adds latency, provides limited coverage because reviewers cannot deeply examine everything, and creates pressure to route around it — which produces the shadow infrastructure that has no governance at all.

The alternative is not less governance; it is governance implemented as automation and paved roads, with human review reserved for genuinely novel or high-risk decisions.

Interview question

"How would you provide assurance that controls are operating without a review board?"