The Strategic Governance Triangle

A board can pass every test on its own sheet — a sharp strategy, a fully populated risk register, a culture survey trending green — and still preside over a failure. Not because any one of those was wrong, but because governance was never three tests. It is one.

The organisations that fail rarely fail a single corner at a time. A strategy outruns a risk appetite no one ever wrote down. A control exists on paper but a fearful culture buries the warning before it reaches the board. A sound plan is handed to a culture too tired or too siloed to carry it, and dies without anyone recording a decision to kill it. In each case the board was looking at three separate dashboards, saw three green lights, and missed the one thing that mattered: the relationship between them.

This essay sets out a simple shape for holding those relationships in view. I call it the Strategic Governance Triangle. It is not a new committee or another report. It is a way of seeing the board's oldest duty as one integrated whole — and, just in time, because a single force is now pulling on all three corners at once.

Boards have, without quite deciding to, divided their own core duty into three rooms. Strategy is the away-day: a deck, a facilitator, a horizon. Risk lives in the audit committee, with its register and its heat maps. Culture is delegated to the people or remuneration committee and sampled once a year through an engagement score. Each room has its own papers, its own experts and its own rhythm. And each, examined alone, can look perfectly healthy.

The problem is structural, not diligence. Three well-run committees can still produce a badly-governed company, because the failures live in the gaps the committees are not asked to look at. Enron had a strategy and an audit committee; what it lacked was a culture willing to say the strategy and the risk had come apart. The board that governs by corners will always be surprised by the edges.

Regulators have noticed the seam. The UK's revised Corporate Governance Code now asks boards not merely to assess culture but to show how the desired culture has been embedded (Provision 2, from 2025); and, from 2026, requires directors to make a personal declaration on the effectiveness of their material controls (Provision 29). Read together, the Code is refusing to let boards treat strategy, risk and culture as three separate filings signed by three separate committees. It is asking one board to answer for the whole.

Three well-run committees can still produce a badly-governed company.

Picture the duty as a triangle. At the apex sits strategy — where value is created, the board's forward-looking work. At one foot sits risk — what could destroy that value, the protective work. At the other sits culture — how the organisation actually behaves when no one is filing a paper, and the only real assurance that the other two are lived rather than laminated.

The three corners are familiar; every board has them on its terms of reference. The insight is the one every schoolchild learns and every board forgets: a triangle is defined by its edges, not its corners. The strength is in the lines that hold the points in relation. Govern the corners in isolation and you have three committees. Govern the edges and you have a board.

If the corners are where the papers are written, the edges are where the governing is done. There are three of them, and each has a question the board should be able to answer at any meeting.

Strategy — Risk: the appetite edge

This edge already has a name most boards use without connecting it to the whole: risk appetite. A strategy without a stated appetite is a hope; a risk function without the strategy is a brake with no map. The governing act on this edge is to make the trade explicit — this ambition implies this much exposure, and we have decided that is acceptable — rather than letting the strategy assume an appetite the risk committee never agreed to.

Risk — Culture: the truth edge

This is the most dangerous edge, and the least instrumented. A risk framework is only ever as good as a culture's willingness to use it. Controls do not usually fail loudly; people quietly decline to pull them, because the culture punishes the messenger. Bob Garratt's phrase — the fish rots from the head — names the pattern precisely: most governance failures are not gaps in the register but silences in the room. The board's job on this edge is to ask whether a junior who spotted the problem would actually tell them, and to mean the question.

Culture — Strategy: the execution edge

The quietest failure of the three. A sound strategy handed to a culture that cannot carry it — too fearful, too fragmented, too depleted — does not get voted down; it simply dissolves. Culture is the medium through which strategy either travels or disappears. The governing question here is whether the organisation the board actually has can do the thing the board has actually asked for.

Governance failures are rarely gaps in the risk register. They are silences in the room.

If the triangle were only a tidy way to redraw an old duty, it would be a poster. What makes it urgent now is that a single force pulls on all three corners at the same time — and, in doing so, exposes every board still working in separate rooms. That force is agentic AI: systems that no longer merely inform a decision but take one.

AI is, at once, a strategy question (where does it create or destroy our advantage?), a risk question (what can a system that acts, but cannot be held to account, do to us?), and a culture question (will our people surface what the machine gets wrong, or defer to it?). Assign it to any one committee and you have miscast it. It does not sit in a corner. It sits at the centre, touching every edge.

The evidence says boards are doing precisely the wrong thing. Deloitte's 2025 survey of directors found two-thirds describe their boards as having "limited to no knowledge or experience" of AI; and while 72% engage their technology chief on it, just 12% engage their chief risk officer. AI is being handled as a technology procurement — pushed into one corner of a triangle it actually occupies the middle of. Meanwhile the regulator is moving the other way: the personal controls declaration arriving in 2026 will not accept "the system did it" as an answer.

This is where the earlier essays in this series land in the boardroom. Who answers for the machine? was a question of accountability; governing what you didn't build was about the models you deploy but never trained. The Triangle is where both become the board's own responsibility. AI is not an agenda item to be delegated. It is a load applied to the whole structure — and the board's task is to make sure it is weighed on all three edges at once, with the authority to halt it kept human, named and in the room.

The framework resolves into five things a board actually does differently. This is the operating model.

None of this asks directors to become strategists, risk quants or culture consultants. It asks them to do the one thing only the board can do: hold the three in tension and read the lines between them. The corners will always have their committees. The edges have only the board.

The board's job was never to perfect three corners. It is to hold the shape.