The Governance Interview
Practitioners on what good governance costs, what it prevents, and what boards still get wrong.
Compliance Is an Operating Model, Not a Department
“If proving compliance takes three weeks, you do not have a compliance function — you have an archive.”
Devika Rao leads compliance at Asteron Financial Services, a fictional financial services group used in Boardroom Brief demonstration content. She spoke to the editorial desk about moving from documentation to evidence.
Where do most compliance functions get stuck?
At the point where documentation stops and evidence begins. Teams write excellent policies and then cannot show that the policy was followed on a specific day for a specific client.
What changed in your own programme?
We stopped measuring how many controls existed and started measuring how quickly we could produce proof for any one of them.
What does the board ask you now?
They ask for retrieval time, not control counts. It is a much harder question and a much more useful one.
What advice would you give a compliance leader starting this work?
Pick your five most inspected obligations and make the evidence for those instantly retrievable. The rest follows.
- Measure evidence retrieval time, not control counts
- Start with the five most inspected obligations
- Policy without retrievable proof is an archive
5 Questions With Tarun Vasudevan on AI Oversight
“Every model in production needs a name attached to it. Ownership is the whole of governance.”
A short-format conversation with the CISO of Vertex Technologies, a fictional enterprise software company used in Boardroom Brief demonstration content.
Where does AI governance start?
An inventory. You cannot govern what you have not counted.
What surprises boards most?
How many models are already in production without an owner.
Human in the loop — where?
Anywhere the decision has a regulatory or customer-harm consequence.
Biggest blind spot?
Third-party models embedded in vendor products.
First step this quarter?
Publish the inventory. Even an incomplete one changes the conversation.
- Inventory precedes governance
- Name an owner for every production model
- Vendor-embedded models are the common blind spot