ISO 37004 is an international standard published in October 2023 that provides guidance on measuring and assessing governance. It is significant because it is currently the only international standard offering this guidance and uniquely focuses on assessing governance outcomes and maturity, rather than solely relying on compliance with principles and practices (inputs and outputs). This focus on outcomes helps organizations understand the net result of their governance activities and drives meaningful improvement.

Traditional governance assessments often focus on whether an organization is following specific principles and practices, such as holding regular board meetings or having terms of reference. These are considered “inputs” and “outputs.” ISO 37004, however, emphasizes “outcomes,” which are the actual impacts of good governance on the organization. It asks, “What is the net result of the good governance?” and evaluates whether the organization is performing effectively, behaving ethically, and demonstrating responsible stewardship. This shifts the focus from simply ticking boxes to understanding the tangible results of governance efforts.

Building on the foundation of ISO 37000, the standard identifies three key governance outcomes:

• Effective Performance: The organization is doing what it set out to do and achieving its targets.
• Ethical Behaviour: When performing well, the organization does so ethically, upholding its values and avoiding unethical practices.
• Responsible Stewardship: The organization demonstrates responsible stewardship of its own resources and those it uses from the community, goodwill, and the natural environment, acting in the best interest of the organization and generating value over the longer term.

ISO 37004 identifies three crucial aspects that shape governance outcomes and are key to assessing governance maturity:

• Behaviour: This refers to the learning and improving behaviour of the governing body. It assesses how the board adopts, understands, applies, analyzes, evaluates, and ultimately improves its governance behaviour, aiming for it to become an intrinsic part of the organization’s DNA.
• Effectiveness: This measures the mindful and purposeful application of governance principles and conditions. It goes beyond simply following recommended practices and looks at whether the governing body understands why certain principles are important for their specific organization and how they are applying them to achieve desired outcomes.
• Efficiency: This focuses on the explicit components of the governance system, such as the governance framework, strategies, policies, charters, performance results, and management reports. It assesses the presence, review, measurement, and ongoing improvement of these components.

ISO 37000 places the purpose of the organization at the very heart of its governance principles. It then outlines four foundational governance principles: policy, strategy, oversight, and accountability. A notable distinction of ISO 37000 is the emphasis on understanding the value generated for stakeholders before developing strategy, highlighting stakeholder inclusivity. These foundational principles are supported by six enabling principles including stakeholder engagement, ethical and effective leadership, better decision-making, risk governance, social responsibility, and double materiality.

ISO 37000 identifies “conditions for good governance” which, while not principles in themselves, are essential for the principles to flourish. These conditions often tend to be embedded in laws and other governance codes. They include effective governance and delegation, understanding the difference between governing and managing, fair treatment of stakeholders, embedding sustainability into governance thinking, and ensuring appropriate composition, structure, and competence of the governing body. Assessing these conditions is crucial because if they are not in place, the application of governance principles will be significantly hindered, much like needing a working oven to bake a cake even with all the ingredients.

ISO 37000 is designed to be a “one-size-fits-all” international standard applicable to organizations of all sizes and types, regardless of where they are incorporated. ISO 37004 then provides the framework to take this model and assess how appropriately it fits a specific organization. It recognizes that the level of detail and formalisation of governance components may vary depending on the organization’s context, emphasizing what is appropriate for a given organization rather than mandating a rigid structure.

A key challenge in implementing ISO 37000 can be gaining buy-in and adopting a mindful and purposeful approach to governance rather than just a compliance mindset. Organizations may struggle to move beyond simply ticking boxes and truly understand the why behind governance practices. ISO 37004 directly addresses this by focusing on the maturity aspects of governance: behaviour, effectiveness, and efficiency. By measuring and assessing these aspects, organizations can identify areas where their governance is not only compliant but also genuinely effective, purposeful, and continuously improving, leading to better outcomes and demonstrating the tangible benefits of good governance to stakeholders.