The ISO 37004 standard provides international guidance for assessing, comparing, and improving an organisation’s governance maturity. It offers a model to help organisations understand their current level of governance, rather than being a certifiable compliance standard. Developed with input from experts across many countries, it aims to foster effective performance, ethical behaviour, and responsible resource stewardship.

Governance, particularly under ISO 37000 and 37004, is fundamentally distinct from compliance. Compliance focuses on meeting legal requirements and compliance obligations. In contrast, governance, guided by principles, encourages organisations to “do their best” – exceeding minimum standards to achieve optimal outcomes. While a governing body must ensure compliance as a foundation, true governance is about dynamic, strategic decision-making and continuous improvement, rather than adhering to mandated rules.

Well-governed organisations, by appropriately applying governance principles, can expect several beneficial outcomes. These include effective performance, meaning the organisation operates efficiently and achieves its objectives; ethical behaviour, where decisions and actions align with moral principles; and responsible resource stewardship, ensuring that resources are used wisely and sustainably. These outcomes collectively contribute to the organisation’s overall success and its ability to meet stakeholder expectations.

ISO 37004 measures governance maturity across three key aspects:

1. Efficiency of Communication: This relates to how well governance policies and principles are documented, communicated, understood, and integrated throughout the organisation and to its stakeholders. It assesses whether this communication leads to cohesive and comprehensive guidance.
2. Behaviour of the Governing Body: This focuses on the attitude and commitment of the governing body towards governance. It evaluates whether board members actively engage with principles, apply them in decision-making, analyse their results, and proactively seek to innovate and improve governance practices.
3. Effectiveness of Application: This assesses how well the established governance principles and practices are actually implemented and make a tangible difference in the organisation’s operations and decision-making. It looks at whether policies are not only in place but are also consistently applied, measured for impact, and continuously improved.

The ISO 37004 standard uses a 0-5 scale for governance maturity, aligning with other ISO maturity models:

• Level 0 (No Evidence): No commitment, no evidence of governance in place.
• Level 1 (Limited): Some limited activities, minimum commitment, often driven by compliance requirements.
• Level 2 (Emerging): Governance practices are beginning to appear, with some documentation, but not yet formally adopted or consistently managed. There’s an intent to engage with governance.
• Level 3 (Formalised): Governance is organised, documented, and actively discussed and actioned, with a cohesive set of policy documents in place, though it may be a reactive process.
• Level 4 (Measured): Governance is seen as a strategic advantage, with aggregated evidence, interconnected policies, active engagement from the governing body, and regular measurement of effectiveness.
• Level 5 (Optimised): Governance is creative, proactive, and continually improving, serving as a core strategic advantage for the organisation.

It’s crucial to note that these are integers (no decimals) and represent subjective assessments, with the process of discussion and improvement being more important than the number itself.

The appropriate governance maturity level varies depending on an organisation’s size, industry, and environment:

• Level 0 (No Evidence): May be appropriate for a truly self-employed individual with no significant external dependencies.
• Level 1 (Limited): Suitable for micro-enterprises or highly unregulated environments, like a small “mom and pop” store.
• Level 2 (Emerging): Appropriate for small, growing businesses that are starting to gain traction and bring in others, requiring emerging practices.
• Level 3 (Formalised): Ideal for medium-sized organisations with established teams and potentially seeking external funding, where organised and documented governance is essential.
• Level 4 (Measured): Necessary for large organisations in highly regulated environments (e.g., financial services, pharmaceuticals), where consistent application and measurement of governance are critical.
• Level 5 (Optimised): Reserved for very large groups in highly innovative, fast-moving environments (e.g., asset managers rapidly acquiring and selling companies) where governance is a competitive advantage and drives continuous innovation.

It’s inappropriate to over-govern a small, low-margin business or under-govern a highly regulated or dependent entity. The level must align with the organisation’s context and needs.

Organisations should not get “hung up” on the specific numerical score. The number is merely a guide or an indicator, providing brevity and a common language for discussion (e.g., “we were a 3, we want to be a 4”). The true value lies in the process of the assessment and the subsequent conversation it sparks. This involves understanding why a particular score was given, identifying areas for improvement, and discussing what actions can be taken to progress. Publicly disclosing a single number is less useful than explaining the narrative behind it, including current status, future aspirations, and the journey of improvement. Good governance is not a competition; it’s about finding the most suitable level for the organisation at a given point in time and continually evolving.

AI can certainly be a helpful tool in governance maturity assessments, but its role is primarily to enhance communication and understanding, not to generate scores independently. AI could assist in summarising complex discussions or written responses from board members, making their thoughts more succinct and easily interpretable by others. This can facilitate better dialogue around the subjective aspects of governance maturity. However, AI cannot “gather data” in the sense of making subjective judgments about behaviour, commitment, or effectiveness. These assessments require human insight into the nuances of an organisation’s culture and practices, such as whether policies are truly understood and applied, or if board members are actively engaged beyond mere compliance.