Here is an uncomfortable experiment. Walk into the office of whoever owns governance at your organisation and ask them one question: “If a board member asked you, right now, what our governance gaps are costing us, in pounds, what would you say?”
You will get one of three answers. The honest one is a pause. The defensive one is a link to a SharePoint folder. The dangerous one is a confident number that the person cannot trace back to anything.
We have done this exercise dozens of times. The folder always exists. It is beautifully named: Governance Framework v3 FINAL (updated). Inside there is an acceptable-use policy, a risk register that was last touched the week it was created, a slide deck from a workshop, and a PDF of ISO 27001 that someone downloaded and nobody finished. It looks like governance. It photographs like governance. It will not survive a single hard question.
That gap, between something that looks governed and something you can actually defend, is the entire reason we built GovScape. So let’s talk about it plainly.
01A folder is an artefact. Governance is a chain.
The problem with the folder is not that the documents are bad. Some of them are excellent. The problem is that they don’t connect to anything.
A policy says “client data must be protected.” Fine. Which data is sensitive? Says who? Which control protects it? Who owns it? Where is the evidence that it actually happens, and when does that evidence expire? If a regulator, an auditor, or a sceptical finance director pulled on that single sentence, how many links of the chain would come away in their hand?
In most organisations, the answer is: all of them. The policy is a paragraph. The control is an assumption. The evidence is a screenshot somebody took once. Nothing is joined up, so nothing is defensible. You have a collection of true statements that cannot be assembled into one true argument.
Real governance is not a stack of documents. It is a traceable chain: a policy requirement, implemented by a named control, owned by a named person, backed by evidence with an expiry date. Pull on any sentence and the whole chain holds. That is the difference between compliant on paper and defensible in the room.
02“We passed the audit” is not the flex you think it is
The most common objection we hear is: “But we passed our audit.” Congratulations. Audits test whether you have the documents. They are not designed to test whether the documents describe reality, whether the controls are operating, or whether your remaining risk is acceptable. A control can pass an audit and still collapse under a single board question, because the audit asked “does a policy exist?” and the board asked “is the risk actually controlled, and what does it cost us if it isn’t?”
Those are different questions. The first one a folder can answer. The second one a folder cannot answer at all, because a folder has no idea what your risk was before your controls, what your controls actually reduced it to, or what the gap between the two is worth in money. The folder doesn’t do arithmetic. And governance, at the level where it matters, is arithmetic.
03The part nobody wants to price
Here is the sentence that makes the folder go quiet: put a number on it.
Most organisations have never worked out what poor governance actually costs them. Not the fine (everyone fixates on the fine) but the steady leakage: the hours lost to manual work and re-keying, the licences nobody uses, the invoices that go out late because the data doesn’t match, the tools that duplicate each other. None of that shows up in the folder. All of it shows up on the P&L, just never labelled as a governance problem.
And kept separately, because it’s a different kind of money: the risk of a breach or a failed audit that might never happen, but would cost a lot if it did.
This is the uncomfortable truth the document-based approach is built to avoid: governance that cannot be priced cannot be prioritised. If you can’t say what a gap is worth, you can’t make the case to fund the fix. So the fix doesn’t get funded, the gap stays open, and the folder gets a new version number. The cycle is very tidy and entirely hollow.
We built GovScape because we got tired of watching capable people lose that argument. Not because they were wrong, but because they had a folder and the person across the table had a spreadsheet.
04What we actually built, and why
GovScape is, at its core, a machine for turning that folder into a figure you can defend.
You upload your policies, and GovScape reads them and proposes the controls each one covers, with a confidence level, so a person reviews and approves rather than retypes. It connects to Microsoft 365, read-only, and checks it every day: who isn’t set up for multi-factor sign-in, who has full admin rights, which licences nobody uses, which policies are past their review date.
It keeps the chain intact: policy to control to evidence, each piece of evidence with an expiry date, so “we have a control” can’t quietly become “we had a control eighteen months ago.” Every risk is scored twice, before and after its controls, because the gap between the two is the value of the work.
And it does the arithmetic. Two figures: what your gaps cost you every year that you can get back, and, kept separate, the risk you’re carrying. Each one has a range, a stated confidence, and the working behind it. The output isn’t a maturity badge. It’s a figure your finance director can carry into a board meeting, and a 90-day plan to bring it down.
05The test
So here is the test, and it’s the same one we opened with. Forget the framework, the workshop, the version number. Ask the only question that counts:
Can someone in your organisation state what your governance gaps cost, as a number, and then defend that number, link by link, back to a policy, a control and a piece of evidence, when a board member pushes back?
If yes, you have governance. Genuinely, well done; you are rarer than you think.
If the honest answer is a pause and a link to a folder, then you don’t have governance yet. You have an artefact. And an artefact has never once survived a hard question.
That’s the gap we built GovScape to close. Not to replace the people doing the work, but to give them a number they can actually defend.
Governance, priced and closed.
