Governance Operations Audit: Are Your Controls Really Working?

The Governance Risk Your Board May Not Be Seeing

The most revealing test of a Company Secretary function is not whether its filings are up to date, but whether the organisation can demonstrate how its governance processes work when nobody is there to rescue them.

A board may receive its papers on time, approve resolutions and see regulatory obligations completed without recognising how much manual intervention sits behind those outcomes. An experienced Company Secretary may be reconciling conflicting records, chasing management actions and correcting process failures before they become visible to directors.

That can create an uncomfortable form of assurance, where everything appears controlled because somebody is constantly preventing the system from failing.

A CoSec Operations Audit should look beneath that apparent success. Its purpose is to examine whether the organisation has reliable governance records, clear responsibilities, effective controls and sufficient continuity, rather than merely confirming that routine tasks have been completed.

This matters particularly to CEOs, CFOs, General Counsel and boards overseeing growing groups. An inaccurate subsidiary record can complicate a transaction, a missing approval can delay financing, while an unresolved board action can leave a material risk without the response directors believed they had authorised.

The wider evidence reinforces the concern. In its 2026 Global State of Legal Entity Compliance research, Diligent reported that 51% of surveyed governance professionals had experienced a near-miss compliance event, while 47% identified technology gaps and legacy systems as their biggest challenge.

These are survey findings rather than measures of failure across every organisation. Nevertheless, they illustrate why operational resilience deserves board attention.

The central question is straightforward: does your organisation have a dependable Company Secretary operating model, or an exceptionally capable person compensating for the absence of one?

Executive Takeaway

A CoSec Operations Audit is a structured examination of how an organisation manages its Company Secretary responsibilities, governance information, statutory obligations, board processes and related operational controls.

Unlike a narrow compliance check, it considers whether the function operates reliably across people, systems, processes and jurisdictions.

For boards and executive leadership, the assessment should provide answers to six important questions:

Accuracy: Can the organisation demonstrate that its entity, director, ownership and statutory information is current and reliable?

Compliance: Are material filing and governance obligations identified, assigned, monitored and supported by evidence?

Accountability: Do board decisions translate into actions owned by the appropriate executives?

Control effectiveness: Are governance procedures operating consistently, or are they dependent on repeated manual intervention?

Resilience: Can critical Company Secretary activities continue during staff absence, leadership changes or periods of rapid growth?

Improvement: Does the organisation have a practical plan to address identified weaknesses, with accountable owners and review dates?

The audit should distinguish between immediate compliance exposure and deeper operating-model weaknesses.

A missed filing may require urgent correction. However, the underlying cause could be an inaccurate entity register, unclear responsibility or a compliance calendar that does not reflect local regulatory obligations.

Correcting the filing without addressing the cause leaves the organisation vulnerable to recurrence.

A successful CoSec Operations Audit should therefore do more than identify errors. It should explain why they occur, who is accountable for correcting them and what stronger governance infrastructure would require.

1. What Is a CoSec Operations Audit?

A CoSec Operations Audit examines the design and operation of the processes supporting an organisation’s Company Secretary function.

Its scope may include statutory records, entity management, board administration, governance calendars, regulatory filings, decision records, delegated authorities, information security and continuity arrangements.

Importantly, this is a practical description of a governance operations assessment, not the name of a universally prescribed statutory audit.

The precise scope should depend on the organisation’s legal obligations, entity structure, operating jurisdictions and risk profile.

For a smaller private company, the assessment might concentrate on statutory compliance, board records and continuity. A multinational group may require a broader examination of subsidiary oversight, local advisers, beneficial ownership information, intercompany approvals and cross-border reporting.

The distinction between a compliance check and an operations audit is particularly important.

A compliance check asks whether a specific obligation has been satisfied, while an operations audit goes further by examining how the organisation identifies that obligation, assigns responsibility, verifies completion and retains evidence.

For example, confirming that an annual filing was submitted is useful. Nevertheless, leadership should also understand whether the filing relied on accurate source information, appropriate approval and a repeatable process.

The difference is between confirming that something happened and understanding whether the system can be trusted to make it happen consistently.

The Financial Reporting Council’s Corporate Governance Code Guidance supports this wider perspective by distinguishing the existence of controls from their effective operation and emphasising ongoing monitoring, review and evidence.

Although the UK Corporate Governance Code applies to relevant listed companies, its governance principles can provide useful reference points for other organisations when adapted proportionately.

2. Why a CoSec Operations Audit Belongs on the Board Agenda

Company Secretary operations are sometimes treated as a specialist administrative matter, but that is an incomplete view.

The function supports the legal and procedural foundations through which boards exercise authority, companies maintain their corporate records and organisations demonstrate that important decisions have been properly taken.

Weaknesses can therefore affect more than filing accuracy.

An unreliable entity register may create uncertainty during an acquisition. Poorly maintained resolutions can complicate due diligence, while incomplete approval records may make it difficult to demonstrate that a significant transaction received the necessary authorisation.

These issues also have implications for executive management.

CEOs need confidence that decisions are implemented across the organisation. CFOs depend on reliable corporate information for transactions, financing, reporting and restructuring, while General Counsel need visibility over legal entities, statutory obligations and governance risks.

The Company Secretary connects many of these responsibilities, but should not be expected to own every operational risk arising from them.

For the board, the central issue is assurance.

Directors need to understand whether governance processes are sufficiently reliable to support informed decisions and appropriate oversight.

The UK Corporate Governance Code 2024 places particular emphasis on effective risk management and internal controls. Its revised Provision 29, applicable from 1 January 2026, requires in-scope boards to report on the effectiveness of material controls, including financial, operational, reporting and compliance controls.

A CoSec Operations Audit does not automatically satisfy those requirements, nor should it be represented as a substitute for an organisation’s wider assurance arrangements.

However, its findings may contribute relevant evidence where Company Secretary processes support controls that the board has determined are material.

The board does not need to perform Company Secretary administration. It needs confidence that the arrangements supporting governance are properly designed, controlled and accountable.

3. The Eight Areas a CoSec Operations Audit Should Examine

A meaningful assessment should look across the operating environment rather than examine individual tasks in isolation.

A. Legal Entity and Ownership Information

The organisation should be able to identify its legal entities, jurisdictions, directors, relevant ownership information and associated obligations.

Records should be accurate, maintained consistently and supported by appropriate evidence.

A key question is whether finance, legal, tax and Company Secretary teams rely on the same authoritative information.

Where separate versions exist, the audit should establish how discrepancies are identified and resolved.

B. Statutory Records and Regulatory Filings

The assessment should examine how filing obligations are identified, assigned, approved and completed.

Evidence may include statutory registers, filing confirmations, calendars, supporting resolutions and relevant correspondence.

Jurisdiction-specific requirements must be assessed against the applicable law rather than assumed to be identical across countries.

C. Board and Committee Operations

Board administration should be reviewed as a complete process, from forward planning and agenda development to the preparation of papers, meeting records and post-meeting actions.

The quality of information matters as much as whether it was circulated on time.

An audit should therefore consider whether directors receive clear decision requests, adequate supporting analysis and appropriate records of decisions.

D. Decision Rights and Delegated Authorities

The organisation should understand which decisions require board approval, which can be taken by committees and which sit within management’s delegated authority.

Where responsibilities overlap, the audit should examine whether the ambiguity creates delays or weakens accountability.

E. Board Action Tracking and Follow-Through

An action register should identify the decision, accountable owner, deadline, status and evidence of completion.

The Company Secretary may coordinate the register, but operational delivery should remain with the executive or function assigned to act.

F. Governance Technology and Information Controls

The assessment should examine how governance information is stored, accessed, updated and protected.

Relevant considerations include access permissions, version control, audit trails, confidentiality, data retention and recovery arrangements.

G. Resources, Expertise and Continuity

A function may appear effective while depending heavily on one experienced professional.

The audit should therefore assess whether responsibilities are documented, appropriate cover exists and critical obligations can continue during absence or transition.

H. Subsidiary and Cross-Border Governance

Group structures create additional coordination challenges.

The audit should examine how headquarters obtains assurance over local filings, entity changes, subsidiary approvals and the work of external advisers.

The central purpose is to establish whether governance operates as a connected system or as a collection of activities held together by individual effort.

4. The Most Important Test Is Often the Handover Between Functions

Governance weaknesses frequently emerge between responsibilities rather than within a single process.

Consider a director appointment.

The board approves the appointment, but the decision may trigger several subsequent actions.

Corporate records require updating, statutory filings may be necessary and the new director may need induction, access to board information and inclusion in relevant governance arrangements.

Finance, legal, human resources, compliance and the Company Secretary may all have responsibilities.

A process can appear complete from one department’s perspective while remaining unfinished elsewhere.

The same problem arises with changes in beneficial ownership, subsidiary restructurings, delegated authorities and board-approved transactions.

A CoSec Operations Audit should therefore examine hand-offs.

For each material process, leadership should be able to identify:

This framework helps prevent a common governance weakness.

The Company Secretary becomes responsible for chasing every action, even where another function possesses the authority and resources required for delivery.

Coordination should support accountability, not conceal its absence.

A mature operating model makes the distinction visible.

5. Worked Example: The Subsidiary Record That Looked Complete

Consider a fictional multinational group preparing to refinance part of its business.

Management asks the Company Secretary function to confirm the current directors, ownership information and corporate approvals for several subsidiaries.

The central entity register appears complete.

However, a local adviser has recently processed a director change that was not reflected in the group’s records. Meanwhile, a shareholder approval was obtained but its supporting documentation was stored outside the central governance repository.

The refinancing team discovers these discrepancies during due diligence.

No single issue necessarily indicates a major governance failure, but the combined effect creates uncertainty and additional work at a commercially sensitive moment.

A CoSec Operations Audit would examine more than the missing updates.

Finding One: Entity Information Is Not Consistently Maintained

The central register is not reliably updated following local changes.

Root cause: There is no sufficiently clear process requiring local advisers to confirm changes and provide supporting evidence.

Finding Two: Governance Evidence Is Fragmented

Important approvals exist, but they are not consistently retained in an accessible, authoritative location.

Root cause: Document ownership and record-retention arrangements are unclear.

Finding Three: Responsibilities Are Not Explicit

The Company Secretary coordinates information, but local management and external advisers have not been assigned consistent reporting obligations.

Root cause: The governance operating model relies on informal communication rather than documented accountability.

What Should Happen Next?

Management should establish clear responsibility for local updates, define the required evidence and agree how information reaches the central record.

The Company Secretary can coordinate the process and advise on governance requirements, while accountable operational owners implement the agreed changes.

A subsequent review should test a sample of entity changes to determine whether records are now being updated accurately and promptly.

The board or relevant committee should receive an appropriate summary where the weakness is material.

The objective is not simply to correct the register before the refinancing. It is to prevent the organisation from discovering the same problem during its next transaction.

6. Why Audit Readiness Is a Governance Capability, Not an Annual Exercise

Many organisations concentrate on governance records when an audit, transaction or regulatory review is approaching.

That approach creates unnecessary pressure.

A well-governed organisation should not need to reconstruct its decision history whenever evidence is requested.

Board approvals, statutory records, conflicts, filings and action completion should form part of a maintained governance record.

This does not mean every document must be held in one application.

However, the organisation should know which records are authoritative, who is responsible for maintaining them and how authorised users can retrieve them.

The distinction becomes especially important during acquisitions, refinancing, restructuring and leadership transitions.

Where evidence is fragmented, the Company Secretary may spend substantial time reconciling documents and explaining decisions that should already be traceable.

The cost is not merely administrative.

Delayed evidence can affect transaction timetables, increase professional fees and create uncertainty for directors, investors and lenders.

A CoSec Operations Audit should therefore examine how governance evidence is created during ordinary operations.

Audit readiness begins when the decision is made, not when somebody asks for proof that it happened.

7. The Difference Between Having Controls and Knowing They Work

An organisation may have a compliance calendar, an entity register and a board action tracker without possessing an effective control environment.

The existence of a tool does not demonstrate that information is accurate or responsibilities are being fulfilled.

A calendar can contain incomplete obligations. Similarly, an action register may show that a task is closed even though the underlying change has not been implemented.

A CoSec Operations Audit should therefore distinguish between control design and control operation.

Control design examines whether an appropriate process exists, including responsibility, approvals, information requirements and escalation.

Control operation examines whether the process is being followed consistently and whether it produces reliable results.

For example, an audit might select a sample of director changes and trace each one from approval through record updates, applicable filings and supporting evidence.

This approach provides stronger insight than simply confirming that a register exists.

The FRC’s Corporate Governance Code Guidance makes a similar distinction in its treatment of internal controls, emphasising monitoring and review of their design, implementation and operation.

For CEOs and boards, this matters because a control can appear satisfactory until it is tested against a real event.

Confidence should come from evidence that a process works, not from the fact that a process has been documented.

8. The Hidden Risk of an Overstretched Company Secretary Function

Operational weaknesses do not always arise from poor professional performance.

Sometimes, the function has simply become responsible for more complexity than its resources and infrastructure can reasonably support.

The Chartered Governance Institute UK & Ireland’s 2026 Governance Market Survey reported that 74% of respondents had experienced increased workloads during the preceding year, while 42% considered their governance functions inadequately resourced.

These findings help explain why organisations should examine capacity alongside process quality.

A Company Secretary may be highly competent but still lack the systems, staffing or professional support required to manage a growing group effectively.

The resulting pressure can create several risks.

Important knowledge becomes concentrated in individuals, while routine obligations depend on manual reminders and informal relationships.

As administrative demands increase, less time remains for board advice, regulatory interpretation and governance improvement.

The audit should therefore examine whether professional capability is being used effectively.

It should also identify work that could be standardised, better coordinated or supported through technology.

However, the response should not automatically be to add software or outsource more tasks.

Leadership first needs to understand the operating weaknesses that are creating unnecessary work.

The strongest Company Secretary function is not the one that can absorb unlimited complexity. It is the one designed to manage complexity without becoming dependent on constant personal rescue.

9. How to Prioritise Findings Without Creating Another Report That Sits Unread

A CoSec Operations Audit should not end with a long list of recommendations that all appear equally urgent.

Leadership needs a clear view of which weaknesses require immediate action and which should form part of a longer-term improvement programme.

A practical prioritisation model can consider three factors.

Exposure

What could happen if the weakness remains unresolved?

The assessment should consider regulatory consequences, transaction risks, financial exposure, governance disruption and reputational effects.

Likelihood and Frequency

How often does the underlying process operate, and how likely is the weakness to recur?

A problem affecting hundreds of entity changes may require a different response from an isolated administrative error.

Control Dependence

Does the organisation have a reliable process, or is the weakness being managed through individual knowledge and intervention?

High dependence on a single professional may justify attention even where no formal breach has occurred.

These considerations can be used to organise findings into a practical improvement plan.

The categories are illustrative rather than a prescribed regulatory scoring model.

Actual priorities should reflect the organisation’s circumstances and the applicable legal requirements.

The most useful audit finding is one that leadership can act on, with a clear understanding of the risk, responsibility and expected result.

10. CoSec Hub and the CoSec Retainer: Building a More Reliable Operating Environment

An operations audit can identify weaknesses, but organisations still need the capability to correct them.

This is where governance infrastructure and professional support become relevant.

CoSec Hub: The Company Secretary Command Centre

CoSec Hub is Lumorus’s technology-enabled governance operating environment, designed to bring greater structure to Company Secretary activities.

Its published capabilities include support for board meeting documentation, action tracking, statutory records, compliance calendars, entity management and governance forward planning.

These are precisely the areas where fragmented information and inconsistent processes can create avoidable operational risk.

A connected environment can support more reliable record-keeping, clearer visibility over obligations and better continuity.

However, technology should not be presented as a substitute for sound governance design.

Its effectiveness depends on accurate information, defined responsibilities and appropriate professional oversight.

CoSec Retainer: Experienced Professional Support

The CoSec Retainer provides an ongoing professional support layer for Company Secretary and governance responsibilities.

Depending on the agreed scope, this may include board administration, statutory records, compliance coordination and governance advice.

Such support can be particularly valuable where organisations require additional expertise, continuity or capacity across multiple entities.

Governance Knowledge Centres: Expertise Beyond Administration

The wider Lumorus model also incorporates Governance Knowledge Centres, providing access to governance knowledge, regulatory information, professional frameworks and practical guidance.

Together, these elements reflect a broader principle.

Technology should improve visibility, processes should establish consistency and experienced Company Secretaries should provide the judgement that governance requires.

For an organisation emerging from a CoSec Operations Audit, the objective should be to select the support and infrastructure that address its actual weaknesses.

Not every organisation requires the same operating model.

The appropriate response depends on its size, structure, regulatory exposure and internal capability.

Explore: CoSec Hub, The Company Secretary Command Centre

11. What Should the Board Receive After a CoSec Operations Audit?

A board does not need every operational detail from the assessment.

However, it should receive enough information to understand material weaknesses, management’s response and the implications for governance effectiveness.

A useful board-level report would include:

The scope of the assessment and any important limitations.

The most significant findings and their potential consequences.

Root causes, including unclear accountability or weak operating processes.

Immediate corrective actions already taken or required.

Named management owners for outstanding improvements.

Evidence required to demonstrate completion.

Review dates and escalation arrangements.

Decisions or resources requiring board approval.

The reporting should distinguish between matters requiring board attention and those appropriately managed within delegated authority.

For example, management may be able to resolve a records-reconciliation weakness without a formal board decision.

However, a material gap affecting group-wide governance, significant regulatory exposure or the reliability of important controls may warrant board or committee oversight.

The Company Secretary can support reporting and coordination, but should not automatically become responsible for delivering every improvement.

A strong audit report does not transfer operational responsibility to directors. It enables directors to oversee management’s response intelligently.

12. When Should an Organisation Consider a CoSec Operations Audit?

There is no universal interval that suits every organisation.

The appropriate timing should reflect changes in complexity, regulatory exposure, leadership and the effectiveness of existing controls.

Nevertheless, several circumstances provide a strong reason to consider an assessment.

Rapid Growth or International Expansion

Additional entities and jurisdictions create more filing obligations, reporting relationships and governance hand-offs.

An audit can help determine whether existing processes remain suitable.

Acquisitions, Refinancing or Restructuring

Transactions increase the importance of reliable entity information, decision records and corporate approvals.

An assessment can identify weaknesses before they become obstacles during due diligence.

Changes in Company Secretary Leadership

A transition provides an opportunity to examine institutional knowledge, documented processes and continuity arrangements.

It can also reveal dependencies that were previously hidden by individual experience.

Repeated Compliance Near Misses

Last-minute filings, recurring record discrepancies and unresolved board actions suggest that existing processes may require redesign.

Board Concerns About Governance Visibility

Directors may be receiving regular compliance updates without understanding the reliability of the underlying information.

An operations audit can help distinguish reassuring reporting from credible evidence.

Introduction of New Governance Technology

Before implementing new systems, organisations should understand which processes need improvement and who will own the information.

Digitising a weak process does not automatically make it effective.

The best time to examine governance operations is before a failure makes the weaknesses impossible to ignore.

13. The CoSec Operations Audit Maturity Framework

Organisations can use the following illustrative framework to assess how their Company Secretary operating model has developed.

This is a practical diagnostic model, not an established industry certification.

Its purpose is to encourage a more useful discussion than whether the organisation is compliant or non-compliant.

A function may meet its immediate obligations while remaining vulnerable to staff turnover or rapid expansion.

Likewise, a technologically sophisticated organisation may still have weak controls if information ownership is unclear.

Governance maturity should be assessed through reliability, accountability and resilience, not simply the number of systems an organisation has purchased.

Seven Warning Signs Your Organisation Needs a CoSec Operations Audit

1. Governance Records Require Regular Reconciliation

Different functions maintain conflicting versions of entity, director or ownership information, making it difficult to establish which record is authoritative.

2. Compliance Deadlines Depend on Individual Reminders

Obligations are met largely because experienced professionals remember what needs to happen, rather than through reliable monitoring and ownership.

3. Board Actions Remain Open Without Clear Accountability

The Company Secretary repeatedly follows up, but executives are not consistently accountable for delivery or evidence of completion.

4. Governance Evidence Is Difficult to Retrieve

Approvals, resolutions and filing confirmations exist, yet the organisation struggles to locate them quickly during audits or transactions.

5. Subsidiary Information Reaches Headquarters Too Late

Local changes are not consistently reflected in central records, increasing the risk of incomplete or inaccurate group information.

6. One Person Holds Most of the Institutional Knowledge

Critical processes would be disrupted by an unexpected absence or leadership transition.

7. Governance Problems Are Repeatedly Resolved at the Last Minute

The organisation celebrates successful recovery without examining why the same weaknesses keep recurring.

Several of these signs together suggest that leadership should examine the design of the operating model rather than simply ask the Company Secretary to become more efficient.

A Practical CoSec Operations Audit Checklist for CEOs and Boards

Before commissioning an assessment, consider the following questions:

Can we produce an accurate list of our legal entities, directors and relevant ownership information?

Are statutory and regulatory obligations identified and assigned to accountable owners?

Can we retrieve evidence of significant board and shareholder approvals?

Do board actions have named operational owners and clear completion requirements?

Are Company Secretary processes documented and consistently followed?

Can the function continue critical activities during an unexpected absence?

Do headquarters and subsidiaries use reliable arrangements for exchanging governance information?

Are governance systems subject to appropriate access, security and information controls?

Can we demonstrate that important processes work, rather than merely confirming that they exist?

Have we agreed how material findings will be corrected, tested and reported?

These questions provide a practical starting point for determining whether a more detailed CoSec Operations Audit is warranted.

The Lumorus View

A Company Secretary function should not be considered effective simply because nothing has gone wrong.

That is a dangerously limited standard.

Experienced professionals can prevent weaknesses from becoming visible for years. They correct records, rescue deadlines, chase actions and reconcile information, often without directors recognising the extent of the effort required.

Their competence is valuable, but it should not become the organisation’s principal control.

The purpose of a CoSec Operations Audit is to examine whether governance operations remain reliable beyond individual intervention.

It should establish whether responsibilities are clear, records are accurate, obligations are visible and processes can withstand growth, transition and scrutiny.

Importantly, the assessment should not become a fault-finding exercise directed at the Company Secretary.

Many weaknesses arise from organisational decisions about resources, technology, delegation and information ownership.

The board and executive leadership must therefore accept responsibility for addressing structural deficiencies.

At Lumorus, we believe governance capability should combine sound operating processes, reliable information and experienced professional judgement.

Our CoSec Hub model brings together governance technology, professional Company Secretary support and Governance Knowledge Centres to help organisations strengthen the environment in which governance is delivered.

However, the starting point should always be a clear understanding of the organisation’s actual risks and operating requirements.

An effective audit should not merely tell leadership where governance is weak. It should help establish what a stronger institution would look like.

The Bottom Line

A missed filing is visible, but the process weakness that caused it may remain hidden.

An inaccurate entity record can be corrected, yet the absence of reliable information ownership may persist.

Similarly, an experienced Company Secretary can resolve a delayed board action without addressing the management accountability problem behind it.

These examples reveal why governance operations deserve more rigorous examination.

A CoSec Operations Audit should test the reliability of the entire operating model, including records, controls, responsibilities, technology and professional capacity.

For boards and C-suite executives, the objective is not to supervise routine administration.

It is to understand whether the organisation has the infrastructure and accountability required to govern consistently.

The real question is not whether your Company Secretary is keeping everything together. It is whether everything would remain together without constant personal intervention.

That is the difference between governance that appears controlled and governance that is genuinely resilient.

Strengthen Your Company Secretary Operating Model

If your organisation is managing multiple entities, expanding across jurisdictions, preparing for a transaction or experiencing recurring governance administration challenges, this may be the right time to examine the resilience of your Company Secretary function.

A structured review of governance operations can help leadership identify where processes are fragmented, responsibilities are unclear and critical records or controls require attention.

From there, the organisation can determine which improvements require stronger processes, additional professional support or more connected governance technology.

CoSec Hub brings together the Company Secretary Command Centre, professional CoSec Retainer support and Governance Knowledge Centres within a structured governance operating environment.

For boards, CEOs, CFOs and General Counsel seeking to understand how the model could support their organisation, the next step is a conversation about their existing arrangements and requirements.

Book a CoSec Hub Demo or Discuss Your Governance Operations

Better governance begins with knowing where the weaknesses are, and having the discipline to correct them.

Continue Exploring

Understand the operational risks Company Secretaries often prevent from reaching the board: The Company Secretary Is Often the Control Nobody Realises They Depend On

Explore why experienced professionals should not become substitutes for governance infrastructure: What Happens When the Company Secretary Becomes the Organisation’s Operating System?

Strengthen governance evidence and corporate record-keeping: The Hidden Governance Risk in Poor Corporate Records

Examine regulatory risk and the challenges of growing governance responsibilities: Is Regulatory Risk Outgrowing Your Company Secretary Operating Model?

Explore a more connected approach to Company Secretary operations: Is Your Company Secretary Team Governing, or Holding the Governance System Together?

Discover professional support and connected governance infrastructure: CoSec Hub, The Company Secretary Command Centre

Lumorus: Better Business, Built on Purpose

Lumorus is a UK headquartered global governance, Company Secretary, ESG and advisory firm supporting organisations across international markets.

We believe governance should provide more than evidence of compliance.

It should give boards and executive teams confidence that decisions are properly authorised, responsibilities are clear and the organisation can demonstrate that important controls are working.

A resilient Company Secretary function is central to that ambition.

Through professional governance support and CoSec Hub, we help organisations strengthen the processes, information and expertise supporting governance operations.

For organisations reviewing their Company Secretary arrangements, the most valuable starting point is a clear assessment of what works, what depends too heavily on individuals and what needs to change.

Your Company Secretary function should be a source of institutional confidence, not a hidden concentration of operational risk.

Explore CoSec Hub

Lumorus: Better Business, Built on Purpose.

Sources and References

1. Financial Reporting Council: UK Corporate Governance Code 2024

The Code provides a framework for board responsibilities, risk management, internal controls and governance effectiveness. Its revised Provision 29 is particularly relevant to the monitoring and assessment of material controls by in-scope organisations.

Source: UK Corporate Governance Code 2024

2. Financial Reporting Council: Corporate Governance Code Guidance

The guidance addresses board information, Company Secretary responsibilities, control design, implementation, monitoring and the importance of evidence in governance oversight.

Source: FRC Corporate Governance Code Guidance

3. Financial Reporting Council: Provision 29 Mythbuster

This resource explains the reporting expectations relating to material controls, the importance of proportionality and the role of board judgement in determining the appropriate control framework.

Source: FRC Provision 29 Mythbuster

4. Diligent: Global State of Legal Entity Compliance 2026

Diligent’s research examines governance professionals’ experiences of compliance near misses, expanding responsibilities and technology limitations affecting legal entity management.

Source: Diligent Global State of Legal Entity Compliance Research

5. Chartered Governance Institute UK & Ireland: Governance Market Survey 2026

The survey examines changes in governance professionals’ responsibilities, workloads, resources and influence within organisations.

Source: Governance Market Survey 2026

6. Lumorus: Company Secretary Risks

This article examines the hidden governance risks that Company Secretaries manage across statutory obligations, board information, entity records, regulatory change and institutional continuity.

Source: Company Secretary Risks: What Boards Often Fail to See

7. Lumorus: Company Secretary Services for Audit-Ready Governance

The article explores the importance of reliable governance records, decision evidence and the ability to demonstrate that governance processes have operated effectively.

Source: The Hidden Governance Risk in Poor Corporate Records

8. Lumorus: Company Secretary Operating Model

This related article examines the risks created when organisations depend on experienced Company Secretaries to compensate for fragmented processes and weak governance infrastructure.

Source: What Happens When the Company Secretary Becomes the Organisation’s Operating System?

9. CoSec Hub: Company Secretary Command Centre

The platform combines Company Secretary operations technology, professional retainer support and Governance Knowledge Centres within a connected service model.

Source: CoSec Hub