Jene’ Palmer CA(SA) GCB.D | Director | CGF Research Institute | mail me |
Consider a regulatory institution with an enviable compliance record. Its enabling legislation contains robust independence provisions. Its annual report is filed on time. Furthermore, its external audit is clean. It has a conflict-of-interest policy, a risk management framework, and a signed memorandum of understanding with each of its peer regulators. By many conventional measures, its governance arrangements appear sound.
Now consider what happens when those arrangements face a real test. A systemically significant institution under the regulator’s oversight fails. This may happen because someone challenges a key regulatory decision as politically influenced. Alternatively, a regulated entity may exploit a cross-sector blind spot that an information-sharing agreement was intended to close.
The governance policies still exist. The annual reports were still submitted. More so, the audit opinion has not changed. However, a more important governance question has emerged: Did the governance arrangements actually work when they were needed?
The scenario is hypothetical, but the governance problem is not. Regulatory failures can expose a gap between the existence of governance arrangements and their effectiveness when tested in practice. This is why compliance and accountability, although closely related, should not be confused. Put simply, compliance is not accountability.
Compliance can tell us whether an institution has met its governance requirements. Accountability, however, asks those entrusted with authority to explain and justify how they have exercised that authority. It also requires them to demonstrate their actions with evidence.
Both are necessary for effective governance, but neither defines it alone. Effective governance also depends on integrity, ethical judgement and the quality of decision-making through which institutions exercise authority in practice. Accountability provides the mechanism that makes these qualities visible and open to scrutiny. Without it, we cannot even begin to answer questions about governance effectiveness.
What compliance tells you – and what it cannot
Compliance is indispensable to good governance. Regulatory institutions derive their powers from legislation and must operate within clearly defined legal and institutional frameworks. Policies, delegations, reporting obligations, control processes and audit arrangements establish the conditions for sound governance. However, the existence of these arrangements does not, by itself, establish their effectiveness.
An arrangement can exist without functioning as intended. A rule can exist without consistent application. Similarly, an institution can make a commitment but fail to fulfil it when tested. The gap between having governance arrangements and demonstrating that they work is precisely where accountability begins.
This shift from structure to outcome increasingly features in contemporary governance thinking. The OECD’s governance principles for regulators, ISO 37000:2021 and the King V™ Code on Corporate Governance for South Africa 2025 all orient governance accountability around demonstrable outcomes. They focus on more than the adoption of appropriate frameworks. Consequently, the central question is shifting from: What governance arrangements do you have? to: What evidence demonstrates that those arrangements are working?
This distinction reinforces that compliance is not accountability. Meeting prescribed requirements establishes a foundation. However, institutions must also demonstrate how they translate those requirements into effective governance practices.
Testing governance under pressure
The distinction between compliance and accountability becomes consequential when governance depends on more than the existence of a rule or structure. It also depends on behaviour, judgement and the exercise of discretion.
Consider the following governance domains, which illustrate where this distinction typically arises:
-
Independence
Legislation affirming a regulator’s independence tells us something important about institutional design. However, independence matters most when exercising it becomes difficult. This may happen when enforcement affects a politically connected entity, when a powerful industry participant challenges an uncomfortable regulatory decision, or when external stakeholders attempt to influence an outcome.
In these circumstances, the accountability question goes beyond whether statutory protection exists. It asks: Can the institution explain how it reached the decision? Can it demonstrate that decision-makers weighed relevant considerations appropriately? Is the reasoning traceable? Is there evidence that the institution’s independence held when tested?
Independence written into law is important. However, independence demonstrated under pressure is what creates trust.
-
Conflicts of interest
A conflict-of-interest policy establishes the rules. Governance faces its real test when those rules encounter an actual conflict involving a consequential decision.
Accountability asks: Did the institution identify the conflict before making the decision? Did the relevant individual declare it? Did the institution appropriately exclude the affected person from deliberations? Is the reasoning traceable? Did the institution treat the situation consistently with comparable cases?
A policy can establish what should happen. Accountability requires the institution to demonstrate what actually happened. More importantly, integrity does not emerge simply because an institution has an integrity mechanism. It becomes credible through how the institution addresses difficult situations.
-
Transparency
Publication does not necessarily equal transparency. A regulator may publish an annual report, enforcement statistics and regulatory decisions while revealing relatively little about how it exercised significant discretionary powers.
The accountability question is not simply whether the institution published the required information. Instead, it asks whether legitimate stakeholders can understand the basis for significant decisions. Can they also form a reasonable view about whether the institution exercised its authority consistently, fairly and within its mandate?
A decision can be visible while the governance behind it remains opaque. Therefore, transparency only becomes meaningful when it enables scrutiny rather than merely facilitating disclosure.
-
Cross-regulatory cooperation
Many contemporary regulatory risks no longer fit neatly within a single institutional mandate. Digital financial services, cross-border transactions and increasingly interconnected markets require regulators to exchange information and coordinate their responses.
An MoU provides an important starting point, but accountability asks different questions. When an emerging risk crossed institutional boundaries, did the regulators identify it jointly? Did they share relevant information timeously and securely? Did they understand their respective responsibilities? Additionally, did the institutions act on intelligence they received from one another?
Ultimately, the MoU’s operation under real conditions determines whether institutions can rely on that cooperation.
The same distinction can arise in risk governance, ethics, technology governance, delegation, oversight, performance and many other governance domains. Wherever institutions exercise authority, the accountability question follows: Can the institution explain and demonstrate how it governed?
These examples reinforce why compliance is not accountability. An institution may satisfy the formal requirements governing each domain without demonstrating that its arrangements consistently deliver the intended outcomes.
Governance is a continuum – not a compliance threshold
Compliance naturally tends towards a threshold. An institution has either met a requirement, or it has not. However, governance effectiveness is rarely so binary.
Two institutions may have almost identical governance structures while demonstrating vastly different capabilities in practice. Similarly, two governing bodies may both receive comprehensive risk reports. One simply notes and accepts them. The other interrogates emerging patterns, challenges assumptions and changes strategic decisions as a result. Both can demonstrate that risk reporting exists, but they are not demonstrating the same quality of governance.
The concept of governance maturity captures this distinction. Governance develops along a continuum. Initially, arrangements may exist largely in form. Over time, they become increasingly embedded and consistently applied. Ultimately, institutions reach a point where they can evidence, evaluate and improve their effectiveness.
ISO 37004:2023 formalises this thinking. Its core insight is that having governance and demonstrating effective governance represent distinct stages of institutional capability.
Institutions can genuinely claim that governance is working when they demonstrate accountability through evidence. At that point, governance becomes more than a collection of existing structures. It becomes a functioning institutional capability. That is the destination that compliance alone cannot reach.
Making governance demonstrable
This leads to a deceptively simple test for any regulatory institution:
If someone independently examined your governance tomorrow, what evidence would you produce? The examination would focus on your governance, not merely your compliance record.
Could you show that significant decisions are traceable to documented reasoning? Could you demonstrate that your independence held when tested? Would your conflict-of-interest records show that you managed conflicts at the point of decision rather than reconstructing events afterwards? Could you also demonstrate that your governance is more effective today than it was three years ago?
These questions do not imply that governance is absent when an institution has incomplete evidence. In fact, one of the more important challenges facing institutions may be precisely the opposite. They may practise sound governance but cannot demonstrate it adequately. Their practices may be good, but their evidence trails may not reflect that.
Within an individual institution, an incomplete evidence trail limits the governing body’s ability to assess whether governance works consistently. However, the implications extend further across a regulatory ecosystem. Peer regulators, government, Parliament, regulated entities, development partners and the public may all need to rely on the integrity of an institution’s governance. Governance that institutions cannot demonstrate provides weaker assurance to those who depend on it.
Institutions should also actively use evidence to identify recurring patterns, emerging relationship risks and inconsistencies in how their structures operate. This approach allows them to ask a more demanding question: Are we governing better than we were before?
That is where governance moves from periodic assurance to genuine institutional learning. It also reinforces the distinction between compliance and accountability. Institutions must do more than collect evidence to demonstrate compliance. They must use that evidence to evaluate their decisions, improve their practices and demonstrate progress.
The SADC imperative
For regulatory institutions across the Southern African Development Community (SADC), the stakes of this distinction are rising. Digitalisation, financial innovation, AI-enabled decision-making and growing cross-border interdependence are increasing the complexity of the environments regulators must oversee. As that complexity grows, the limitations of relying predominantly on structural compliance become more pronounced.
The implications extend beyond institutional credibility. The integrity and effectiveness of a country’s regulatory environment influence the confidence of citizens, markets, development partners and investors. A SADC regulatory landscape that can demonstrate how governance works in practice presents a materially stronger proposition than one that can demonstrate only structural compliance.
Some SADC institutions may already practise governance at a level their formal reporting does not fully reveal. In such cases, the challenge is to strengthen the evidence rather than create more governance. For others, closer examination may expose arrangements that are sound in design but inconsistently applied in practice.
In either circumstance, institutions must make the same shift. They must move from asking whether governance arrangements exist to demonstrating whether those arrangements work.
This is particularly important as regulatory institutions navigate increasingly complex governance environments. Compliance with established frameworks remains essential. However, compliance is not accountability. Regulators must demonstrate how they exercise their authority, manage emerging risks and maintain public confidence when circumstances become challenging.
Compliance is the floor
Compliance will always matter. A regulator that does not comply with its enabling legislation, reporting obligations and governance requirements has a fundamental problem. However, compliance is the floor, not the destination.
A regulatory institution exercises authority that citizens, markets and regulated entities must respect. That authority carries a corresponding obligation. Institutions must not merely comply with the rules governing them. They must also demonstrate that they exercise their powers independently, transparently, consistently and effectively.
The question regulators should therefore ask is no longer simply: Are we compliant? Instead, they must confront the harder question: What evidence do we have that our governance is working?
For institutions entrusted with public power, this is not merely an assessment methodology. It represents the fundamental expression of accountability. When institutions can answer this question with confidence, accountability contributes to effective governance. It produces governance that the system, and those who depend on it, can genuinely rely on.
