Introduction: The Paradox of More
Firms can’t move for governance. We see it and hear it all the time. In our conversations. In what we read. In the anecdotes we are told.
Every process has a framework. Every framework has a dashboard. Every dashboard feeds a committee.
The controls multiply, yet somehow, the visibility shrinks.
Boards receive thicker packs, but thinner insight. Executives spend more time signing attestations than making decisions. Risk teams chase metrics that look reassuring but reveal almost nothing.
This is control creep – the slow, well-intentioned expansion of oversight that ends up blurring the very risks it was designed to clarify.
It’s not the absence of governance that worries regulators now. It’s the excess of it, and what gets lost in the noise.
Why Now: Oversight in an Age of Inflation
Across financial services, the oversight footprint has ballooned.
The Financial Conduct Authority’s Annual Work Programme 2025–26 reiterates “culture, governance, and accountability” as enduring priorities.
The Prudential Regulation Authority’s Business Plan 2025–26 similarly highlights governance of change and operational resilience as central supervisory themes.
And from January 2025, the EU’s Digital Operational Resilience Act (DORA) took full effect, requiring continuous third-party due diligence, data integrity, and board accountability.
None of these frameworks is misguided. Each strengthens resilience and responsibility. But collectively, they create an ecosystem of overlapping reports that few organisations can navigate without fatigue.
The danger isn’t a lack of control it’s the illusion of mastery created by it.
How Control Creep Happens
Control creep rarely starts as a policy failure; it begins as over-correction.
After each audit or near-miss, firms add another layer of checks, another form, another dashboard. Each new process feels rational in isolation. Together, they form a labyrinth.
Over time, accountability fragments. The same risk appears in three registers, owned by four teams. Assurance functions spend weeks validating overlapping MI while critical decisions stall.
The internal audit committee becomes a gallery of controls with hundreds of items reviewed in seconds because no one has time for context.
This isn’t diligence. It’s dilution.
The FRC’s Annual Review of Corporate Governance Reporting 2024 warned that boards risk “mistaking volume for vigilance”, a phrase that captures how governance inflation can mask the true state of risk.
The Cost of Complexity
When oversight expands faster than understanding, three quiet failures emerge.
First, decision paralysis. The more metrics a board receives, the less confident it feels to act. Information becomes a defensive tool rather than a guiding one.
Second, desensitisation. When every issue is red, nothing is urgent. When every risk is escalated, the truly strategic ones drown.
Third, erosion of trust. Operational teams begin to see compliance as a performance rather than a partnership. Risk functions lose influence precisely because they are everywhere – and nowhere.
Research across UK boardrooms through 2024 shows directors spending more time validating assurance outputs than discussing emerging risks. Oversight has become an end in itself.
The irony? Firms with the most controls often struggle to explain their biggest exposures.
A New Definition of Oversight
If governance is to remain credible, it must rediscover focus.
The FCA, in its 2025–26 plan, calls for “smarter, more targeted data” to reduce duplication.
The PRA, likewise, urges firms to strengthen “the link between board oversight and operational reality”, particularly for technology and change management.
That requires a new definition of oversight – one based on clarity, not quantity.
- Consolidate controls that duplicate the same intent.
- Prioritise metrics that drive board discussion, not reassurance.
- Shift from evidence of activity to evidence of effectiveness.
- Re-centre ownership where decisions are actually made.
Good oversight isn’t about knowing everything. It’s about knowing enough to act.
Restoring Focus: From Administration to Intelligence
To reverse control creep, firms need fewer frameworks – and smarter ones.
The best are redesigning their risk architectures to emphasise narrative and judgement over repetition. Dashboards now include context notes, escalation pathways, and behavioural indicators.
Internal audit and risk teams are collaborating to build “insight reports” – concise, thematic summaries that focus on lessons and trends, not compliance throughput.
Another key concern is redundant and ineffective controls. We need to include into change management a review of all control areas affected by major change and then remove controls which no longer apply due to the changes – all too often, we still execute controls years after the business changed and made them redundant.
The same applies to ineffective controls – after an adverse event or a near-miss, we should analyse where the issue arose and where it was detected, then review all controls in process between those two points – they obviously did not contribute to mitigating or preventing the risk, so do we really need them?
Every control has a cost associated with it, so removing redundant and ineffective controls cuts cost.
Others are embedding “risk fluency” training across business lines so staff can recognise exposure without waiting for a checklist.
This is oversight as a living system – one that learns, questions, and adapts.
Final Word: The Discipline of Less
Control creep is the governance equivalent of clutter: comforting, but costly.
The instinct to add new safeguards after every event is human, but the discipline to simplify is what distinguishes resilient organisations from bureaucratic ones.
Regulators aren’t asking for more paperwork; they’re asking for better purpose. Boards don’t need thicker reports; they need sharper conversations.
Because in the end, control doesn’t equal control.
Understanding does.
And in a world where oversight expands faster than insight, the firms that win will be those brave enough to simplify with intent.
Stay up to date with the latest stories from the world of governance, risk, audit and compliance >>>
