Why Digital Systems Can Create False Assurance
Table of contents
Acknowledgements
We extend our gratitude to Romeo Effs, CEO of Lumorus, for the strategic direction and governance philosophy that shaped this white paper. The central idea that governance is infrastructure, not administration, provides the intellectual foundation for this work and for the wider Lumorus governance practice.
Special thanks are due to the Lumorus creative and editorial colleagues whose prior white papers, visual standards and publication treatments informed the structure and design direction of this draft. Their work has helped establish a recognisable Lumorus rhythm: rigorous insight, accessible layout, strong imagery and practical board-level application.
We also acknowledge the Lumorus practitioners whose case studies, board effectiveness reviews, company secretary assignments and governance-control-gap work provided the practical evidence behind the paper. Their experience shows that the most important governance weaknesses are often not found in formal charts or policy documents, but in the hidden routes through which information, decisions, records and accountability actually move.
This draft is prepared for review and design development. It should not be treated as an externally approved Lumorus publication until it has completed editorial, factual, design and leadership sign-off.
Thank you to everyone who contributed source materials, feedback and guidance for the rebuild.
01. Overview
Boards are being asked to govern through more information, more systems, more regulatory expectations and more automated workflows than ever before. Governance technology has emerged as a response to this pressure. It promises cleaner records, faster circulation of papers, automated reminders, searchable registers, workflow visibility, electronic approvals and more consistent evidence.
Those benefits are real. In organisations with multiple subsidiaries, dispersed leadership teams, complex committee structures or recurring regulatory obligations, digital tools can reduce friction and improve access to information. The company secretary should not have to rely on email trails, spreadsheets, personal memory and repeated chasing to make governance work.
But this paper argues that there is a governance paradox at the heart of digital adoption. An organisation can become more digitally organised while becoming less well governed. A system may show that actions have been closed, board papers circulated, registers updated and filings completed. Yet that still may not prove that the underlying information was accurate, that the right issues were escalated, that accountability was clear, that assumptions were challenged or that directors exercised informed judgement.
The result is false assurance: a board sees evidence of activity and mistakes it for evidence of control. The risk is subtle because the better the digital surface looks, the easier it becomes to miss weak foundations beneath it.
Lumorus’s position is that governance is infrastructure, not administration. Technology should therefore be judged as one component of the architecture through which authority, information, decisions, records and accountability move. The central question is not whether the organisation has governance technology. It is whether governance works through the technology.
THE ARGUMENT IN ONE SENTENCE: Digital systems strengthen governance only when they improve information quality, accountability, resilience, institutional memory and human judgement.
02. Introduction: The Illusion of Control
The opening mistake in many governance technology conversations is to begin with software capability. What can the platform do? Can it circulate board packs? Manage registers? Send reminders? Can it create dashboards? These questions matter, but they start in the wrong place.
The more important question is what the board needs to know and trust. Directors rely on the architecture that brings information to them. They do not inspect every source record, reconcile every register, chase every action owner or test every assumption behind a management report. They depend on governance processes that should ensure the right matters are brought forward in the right form at the right time.
Digital systems can make those processes faster and more visible. They can also make them look more reliable than they are. A green status indicator can conceal a weak evidence trail. A circulated paper can omit the risk that should have been escalated. A completed approval can obscure the fact that the approver did not have enough context. A closed action can hide a failure of implementation.
This is why technology is not neutral. It influences what is seen, what is filtered, what is escalated, who is treated as accountable and what remains available for later review. Once technology becomes part of the path through which board information and governance evidence move, it becomes part of the governance system itself.
The illusion of control arises when boards and executives mistake digital order for governance assurance. The organisation feels more controlled because more activity is visible. But visibility is only valuable when it reveals what matters, including exceptions, ambiguity, unresolved issues and weak signals.
03. Why Digital Visibility Is Not Governance Assurance
Visibility is one of the most attractive benefits of governance technology. A chair can see the board pack. A company secretary can see which actions are overdue. A general counsel can see approvals. A committee chair can see papers and minutes. The organisation can see more than it could when information lived in scattered inboxes and local files.
Yet governance assurance requires more than visibility. Assurance depends on the reliability, completeness and meaning of the information being shown. A dashboard is only as good as the data model beneath it, the ownership assigned to it, the thresholds used to escalate matters and the professional judgement applied to exceptions.
The G20/OECD Principles of Corporate Governance state that board members should have access to accurate, relevant and timely information. This is a useful standard because it does not merely say that information should be accessible. It requires information to be accurate, relevant and timely. Governance technology can help meet that standard, but it can also create the impression that the standard has been met when only the access problem has been solved.
For example, a board portal may solve the access problem by ensuring directors receive papers on time. It does not necessarily solve the relevance problem if the pack is too long, too operational, too backward-looking or missing the assumptions directors need to test. A register tool may solve the storage problem. It does not necessarily solve the integrity problem if ownership, verification and version control remain unclear.
BOARD TEST: Do we know whether the information is reliable, or do we only know that it has been uploaded?
04. The Board Information Problem
Governance failures often begin as information failures. The board may not receive the relevant fact. The paper may not distinguish evidence from assertion. A dashboard may compress uncertainty into a single traffic-light indicator. A committee may not escalate a material exception to the full board. A decision may be recorded, but not the challenge, alternatives or assumptions that shaped it.
Technology can improve the mechanics of information flow, but it cannot by itself determine what the board needs to know. That requires governance design. It requires clear ownership for information quality, disciplined reporting standards, escalation thresholds and the professional courage to bring uncomfortable matters forward.
The FRC’s 2024 UK Corporate Governance Code is relevant here because of its strengthened focus on risk management and internal controls, including Provision 29’s requirement for a board declaration on the effectiveness of material controls for financial years beginning on or after 1 January 2026. Even where an organisation is not directly within the Code’s scope, the direction of travel is instructive: boards are expected to understand whether the systems they rely on are effective, not merely whether they exist.
Governance technology therefore sits close to the internal control conversation. If a system shapes board information, records decisions, tracks actions, stores evidence or controls access to governance records, it affects the board’s ability to oversee the organisation. It should be assessed accordingly.
05. Four Ways Governance Technology Can Create False Assurance
False visibility
False visibility occurs when technology makes activity easier to see but does not reveal the quality of that activity. The board can see that a process happened, but not whether it worked. It can see that an action closed, but not whether the underlying issue was resolved. It can see that papers were circulated, but not whether directors received a complete and balanced account.
This risk is particularly acute when governance reports rely heavily on simplified dashboards. Dashboards are useful for scanning, but they can compress uncertainty. A green indicator may mean that a deadline was met. It may not mean that the information was robust, that challenge occurred or that the issue no longer requires oversight.
The board consequence is that directors may believe they have assurance when they are actually seeing a record of activity. The remedy is not to abandon dashboards. It is to design them so that exceptions, unresolved questions, stale evidence, owner disputes and risk movements are visible.
Digitised disorder
Occurs when technology automates fragmented or poorly designed governance processes without correcting them. A weak process becomes faster. An unclear responsibility map becomes searchable. An outdated approval route becomes embedded in workflow. The organisation feels more organised while the underlying governance weakness remains.
This is one reason technology projects should begin with governance design. Before a process is digitised, the organisation should ask whether the process is fit for purpose. Who owns the outcome? Has authority to decide? Who must provide evidence? What happens when the evidence is weak? What is escalated, and to whom?
Without that discipline, digital transformation can make weak governance harder to challenge. The process acquires the authority of the system. Users comply with the workflow because it is the workflow, even where the workflow no longer reflects the governance outcome the board needs.
Automated complacency
Automated complacency arises when users begin to assume that the absence of an alert means the absence of a problem. AI summaries, auto-classification, reminder engines and exception logic can improve governance operations, but they also influence attention. They decide what is surfaced, what is prioritised and what appears routine.
The ICO’s AI guidance on human review is a helpful reference point because it emphasises that meaningful review requires knowledge, experience, authority and independence to challenge automated outputs. That principle is directly relevant to governance. A human reviewer who cannot challenge the system is not exercising judgement; they are simply confirming the system’s conclusion.
Boards should therefore ask where automation materially influences governance information. Does AI summarise board papers? Workflow logic classify issues as routine or exceptional? Does the system determine escalation thresholds? Are users trained to challenge outputs, or do they treat them as authoritative because they are generated by the system?
Institutional dependency
Institutional dependency arises when critical governance records, knowledge and workflows become concentrated in platforms, suppliers or individuals without adequate resilience. The risk is not only cyber disruption. It includes loss of access, failed integrations, supplier changes, staff turnover, unclear administrator rights and weak continuity planning.
NIST Cybersecurity Framework 2.0 is relevant because it treats cybersecurity risk governance as an enterprise issue and is intended for executives and boards as well as technical teams. Governance technology should be considered within that broader resilience environment. A system that performs well only in normal conditions is not yet reliable governance infrastructure.
The company secretary often sees this dependency first. If the organisation cannot reconstruct what is due, what has been decided, who owns the action and where the evidence sits without searching an individual’s inbox, then the control has not been institutionalised. It remains person-dependent.
06. Giving Technology a Fair Hearing
The argument of this paper is not anti-technology. Good governance technology can make a material difference. It can reduce the manual burden on company secretary teams, improve continuity, help boards access papers securely, support consistent record keeping and provide better evidence of decisions and follow-through.
For complex organisations, technology is increasingly essential. It is unrealistic to expect modern governance to rely indefinitely on heroic individual effort, disconnected spreadsheets, email reminders and informal memory. Manual workarounds may be effective for a period, but they are rarely resilient. They create key-person risk and make it harder for the board to know whether governance activity is complete, evidenced and appropriately escalated.
The fair question is therefore not whether technology is valuable. It is what kind of technology, designed around what governance purpose, embedded in what operating model, with what ownership and assurance. Technology is powerful when it carries the right work. It is dangerous when it conceals the wrong assumptions.
LUMORUS POINT OF VIEW: Technology should carry workflow, evidence and visibility. People should carry judgement, challenge and accountability. Governance fails when either side is asked to do the other’s work.
07. The Lumorus Governance Infrastructure Framework
Lumorus’s Governance Infrastructure Framework shifts the conversation from software capability to governance effectiveness. It asks whether technology supports the architecture through which power, information, decisions, records and accountability move.
The framework is deliberately broader than a technology checklist. It can be used by chairs to ask whether board assurance is reliable, by company secretaries to test operating-model maturity, by audit and risk committees to connect governance technology with internal control, and by executives to understand where ownership must sit outside the secretariat.
08. Practitioner Evidence and Case Studies
The strongest evidence for this paper comes from the practical gap between formal governance arrangements and the real work required to make governance function. Lumorus case material shows that governance weaknesses frequently appear as documentation gaps, excessive board packs, unclear ownership, weak evidence trails, person-dependent knowledge and fragmented systems.
Case study 1: Regulated pensions firm
In a governance review for a regulated pensions firm, Lumorus observed strong commitment to governance principles but identified weaknesses in documentation and reporting. Board minutes did not capture the level of challenge raised by non-executive directors. Board materials were too voluminous. There was a potential conflict arising from the chair’s role across committees. Group policies appeared to have been adopted without clear evidence of tailoring to the entity’s specific regulatory context.
The board-level issue was not merely administrative. If minutes do not evidence challenge, the board may struggle to demonstrate that oversight was active, board packs are too large, directors may receive more information but less insight, policies are adopted without tailoring, the organisation may appear compliant while failing to address its actual risk profile.
Lumorus’s response included recommendations to strengthen the governance framework, improve documentation and reporting, mitigate conflicts, streamline board packs, support nominations arrangements and tailor governance policies. The case illustrates the core argument of this paper: governance assurance depends on information quality and evidence, not just visible activity.
Case study 2: Regulated insurance firm
In a regulated insurance context, Lumorus observed the absence of a dedicated company secretary support unit and the need for a robust external support model. The organisation required standardised reports, better meeting coordination, integration with regulatory reporting calendars and more structured governance policies.
This was a governance infrastructure issue. The risk was that board and regulatory processes depended on manual coordination rather than visible ownership, forward planning and reliable evidence. When governance activity is coordinated through personal effort, the organisation may continue to function but remain exposed to key-person dependency and continuity risk.
Lumorus developed a two-year governance forward plan, redrafted terms of reference and policies, standardised minutes and reports, mapped company secretary processes, strengthened register management and improved board operations. The lesson is that technology becomes valuable only when it is connected to ownership, workflow, evidence and accountability.
Practitioner signal: governance-control-gap survey
Lumorus internal survey material used for governance-control-gap work provides a further practitioner signal. In a small 18-response module, 59.5% reported manual updates to governance records, 59.5% reported chasing actions, sign-offs and filings across teams, 55.6% described systems as manual or time-consuming and 44.4% reported duplication caused by disconnected tools.
These figures should not be over-generalised. They are not a market-wide statistical study. Their value is as a structured echo of what company secretaries frequently experience: technology adoption can coexist with manual work, duplication and person-dependent governance. The question for boards is whether the organisation has digitised activity while leaving the company secretary as the human integration layer.
09. The Board Agenda
Boards do not need to become technology procurement committees. They do need to understand when governance technology affects their own ability to oversee the organisation. The agenda should remain strategic, evidence-led and focused on the architecture of assurance.
- Review governance technology as part of the organisation’s governance architecture, not as an administrative tool.
- Test whether current systems reveal exceptions, weak signals and unresolved issues, rather than only reporting completed activity.
- Clarify who owns information quality, data provenance, escalation and assurance.
- Map where AI, automation or workflow logic materially influences what reaches decision-makers.
- Assess dependency on suppliers, platforms, integrations and key individuals.
- Bring governance technology within internal control, cyber risk and operational resilience conversations.
- Test whether the organisation can reconstruct significant decisions, including what was known, who challenged, who decided and what action followed.
For the chair, the key concern is whether the board can rely on the infrastructure through which information and accountability move. For the company secretary, the concern is whether systems support the integrity, continuity and effectiveness of governance rather than simply moving administrative burden into a new interface.
10. What Chairs and Company Secretaries Should Do Next
A practical response should begin with diagnosis, not procurement. Before selecting or expanding governance technology, organisations should examine where the current governance operating model depends on individual effort, informal knowledge or disconnected records.
The most useful starting point is often one recurring burden. It may be board-paper submission, minutes approval, action tracking, statutory registers, policy reviews or compliance calendars. The task is to move that burden from informal personal effort into a visible workflow with an owner, deadline, escalation route and evidence record.
11. The Lumorus Response
Lumorus applies this philosophy through its governance advisory work, CGPS methodology and technology-enabled company secretary model. CoSec Hub and the Governance Knowledge Centre should be understood in this context: not as a claim that software produces good governance, but as a way of connecting workflow, accountability, professional expertise and institutional knowledge.
The organisation retains accountability. The board remains responsible for decision-making. Executives and business owners remain accountable for their actions. The company secretary retains professional judgement, leadership and influence. The role of better infrastructure is to stop the company secretary from becoming the entire operating model.
CoSec Hub can provide a digital command centre for governance obligations, tasks, accountable owners, forward planning, board and committee actions, decisions, approvals, supporting evidence and reporting. The Governance Knowledge Centre can provide the human expertise and delivery capacity needed to make the model work in practice. Together, the model reflects the central Lumorus view: technology should carry the workflow; expert people should carry judgement, challenge and accountability.
12. Conclusion: Resolving the Paradox
The paradox is now clear. Technology can make governance activity more visible while leaving governance assurance weak. It can organise administration without improving accountability. can accelerate workflows without strengthening judgement. It can preserve records without preserving the context required to understand decisions.
But the opposite is also true. When designed well, technology can strengthen governance materially. It can make ownership visible, reduce manual burden, protect institutional memory, improve evidence, surface exceptions and support more disciplined board oversight. The difference lies in whether technology is treated as a governance infrastructure decision rather than a software purchase.
Responsibility for that cannot sit solely with the company secretary, technology function or procurement team. Management, governance professionals, technology leaders and risk teams each have distinct responsibilities. But the board must ultimately be satisfied that the infrastructure through which information, decisions and accountability move is capable of supporting effective oversight.
FINAL QUESTION: Can our governance infrastructure assure the board that information is reliable, material issues will be escalated, accountability is clear, critical processes are resilient and directors remain capable of exercising informed judgement?
Lumorus: Better Business, Built on Purpose
Lumorus is a UK-headquartered global governance, ESG, Company Secretary and advisory firm supporting organisations across Europe, Africa, Asia, the Caribbean, Canada, the Middle East and international markets.
We help boards and leadership teams strengthen governance infrastructure, accountability and organisational resilience as regulation, technology and corporate complexity continue to evolve.
Our Company Secretary capabilities include:
For organisations seeking a more connected operating model, CoSec Hub combines governance technology, professional Company Secretary expertise and governance knowledge infrastructure.
Is your governance team genuinely under-resourced, or is too much of its capacity being consumed by infrastructure that no longer matches the organisation?
That distinction matters. Adding more people to a fragmented operating model may increase capacity without addressing the structural problem.
Better governance starts with a better operating environment.
Explore Lumorus or visit CoSec Hub to strengthen the infrastructure behind your governance function.
Lumorus: Better Business, Built on Purpose.
13. References and Source Notes
- OECD Corporate Governance Factbook 2025, including comparative material across 52 economies and board risk/internal control data
- FRC, UK Corporate Governance Code 2024 and implementation material, including Provision 29 effective date and material controls guidance
- NIST, The Cybersecurity Framework 2.0, February 2024
- ISO/IEC 42001:2023 listing, Information technology – Artificial intelligence – Management system
- Lumorus internal sources supplied for this commission: Lumorus Case Studies V3JD; Appendix L1A Corporate Governance Precision System; Malaria Consortium Board Effectiveness Review Proposal; Governance Control Gap deck plan; Balancing Political Dynamics and Climate Risks whitepaper reference.
