There is a job that does not exist in most companies but whose absence is felt in almost every one. It shows up as a policy that nobody has updated since the last CFO left. It shows up as a vendor contract signed three years ago that nobody has reviewed since. It shows up as a new AI feature deployed by engineering before anyone asked whether it was permitted, or a state privacy law that went into effect in January that the company technically falls under but has not mapped to anything yet. The function that would have caught each of those things is the governance office — and in most mid-market companies, that function either does not exist or exists only in fragments held by people who have other jobs.
At the largest public companies, the most sophisticated nonprofits, and the most heavily regulated financial institutions, this function is led by a Chief Governance Officer. The CGO role is real and growing: the position appears on the org charts of Fortune 500 companies, in board committee charters at regulated institutions, and increasingly in the governance sections of proxy statements. It is frequently combined with the Chief Legal Officer role, particularly at companies where the legal team owns both external compliance obligations and internal governance practice. At companies large enough to separate the two, the CGO runs a dedicated office.
Understanding what that office actually does — in plain language, without the framework jargon — is useful for any company that feels the absence. Not to staff it identically, but to understand what it covers and why the gap costs money when the moment arrives that requires it.
01 / Owning the rulebook
The first and most foundational function of a governance office is owning the rulebook. Every company has policies — acceptable use, information security, data retention, expense approval, vendor procurement, conflicts of interest, and many others depending on the industry and the regulatory environment. In a company without a governance function, these policies are written by different people at different times, stored in different places, and reviewed on no consistent schedule. Some are current. Some are years out of date. Some contradict each other. Almost all of them are difficult to find when the moment arrives that requires them.
A governance office makes the rulebook findable, consistent, and current. That means a single home for every policy the company has adopted, with version history so anyone can see when a rule changed and who approved the change. It means a review schedule so policies are revisited at defined intervals — annually, or when a triggering event occurs such as a regulatory change or a significant operational shift. It means a mechanism for identifying conflicts between policies before they create operational problems, rather than discovering them when two departments both think they are right.
This is less glamorous than the strategic aspects of the role, but it is the infrastructure everything else depends on. A company cannot prove it follows its own rules if it cannot produce its rules in a form that is coherent and current. The rulebook is the foundation. The evidence that the company follows the rulebook is what the governance office builds on top of it.
02 / Mapping dependencies and routing decisions
Policies do not exist in isolation. A data retention rule touches the legal team, the IT team, the customer success team that manages CRM records, and the finance team that manages transaction records. A vendor procurement rule touches procurement, legal, IT security, and the business unit that wants the vendor. An AI use policy touches every team that uses AI tools — which, in most companies today, is every team.
One of the CGO's core functions is mapping the dependencies between rules and departments so that when a rule changes, everyone it touches knows about it. This sounds like communication work, and it is — but it is structured communication built on a map of who owns what, who depends on what, and who has authority over what. Without that map, rule changes get announced but not implemented. The retention policy update gets sent in an email that IT reads and compliance reads and nobody in sales reads because it was addressed to the wrong distribution list.
The mapping function feeds directly into decision routing. When a question arises — can we add this new AI vendor to our stack, can we extend the retention period on this data category, can we share this dataset with this partner — the governance office routes it to the right authority. The right authority is the person whose role gives them accountability for the decision, not the most senior person in the room or the person who happened to be copied on the email. Getting decisions to the right place, with the right context, is what makes the organisation's authority structure real rather than theoretical.
03 / Keeping evidence the company follows its own rules
A policy that exists on paper but is not verified in practice is not governance. It is documentation. The difference matters enormously when an auditor, a regulator, a customer, or a counterparty in a deal asks whether the company actually does what its policies say. The governance office maintains evidence that the company follows its own rules — not through periodic sampling or annual audits, but through continuous verification of the controls the rules require.
This is the function that requires the most operational infrastructure. It is not enough to say that multi-factor authentication is required for all access to sensitive systems. Someone has to verify that it is enabled, across all the users and systems in scope, and record that verification in a form that can be produced when asked. It is not enough to say that vendor contracts are reviewed annually. Someone has to track which contracts are due for review, confirm that the review happened, and hold a record of what the review found and what was done about it.
A policy that exists on paper but is not verified in practice is not governance. It is documentation. The difference shows up when someone asks for proof.
The evidence function is where governance offices spend a significant portion of their operational capacity — and where companies without a governance office feel the gap most acutely during audits. The scramble to produce evidence that was never collected continuously is one of the most reliable indicators that a governance office either does not exist or is not properly resourced.
04 / Watching the horizon: new laws and expanding obligations
The regulatory environment for most mid-market companies has become materially more complex in the last three years, and it is continuing to change. The EU AI Act is now in phased enforcement, with requirements for high-risk AI systems that will apply to vendors whose products touch European customers. US state privacy laws have been enacted in more than a dozen states, each with its own definitions, thresholds, and requirements — and more are coming. Sector-specific requirements around cybersecurity incident disclosure, AI governance, and data localisation are proliferating across industries and jurisdictions.
A governance office watches this horizon. It tracks which laws apply to the company, when they take effect, and what they require. It maps new obligations to existing policies and identifies where the policies need to change. It engages outside counsel on novel interpretation questions and brings the relevant findings back to the organisation in a form the business can act on. This is not legal advice — it is the operational function of translating legal developments into governance requirements, which is a different and complementary task.
For a company without this function, the horizon is invisible until a deadline arrives or a customer asks about a law the company has not evaluated. The AI Act is the current example. Most mid-market companies operating SaaS products that touch EU customers have not completed an assessment of which AI features they deploy that might fall under high-risk or general-purpose AI obligations. The assessment requires knowing what the company has deployed, mapping it to the regulation's scope, and making decisions about how to respond. That is governance work, and it does not happen without someone to own it.
05 / AI and vendor sprawl: the two fastest-growing governance challenges
The two areas where governance gaps are accumulating most rapidly in mid-market companies are AI deployment and vendor management. Both involve systems that expand faster than most companies' governance processes can track, and both create obligations that compound when they go unaddressed.
AI sprawl is the newer problem. Microsoft 365 Copilot is deployed. Salesforce Einstein is active. Engineering is using AI coding tools that can access parts of the codebase. Customer success is using AI summarisation tools that touch customer records. Most of these deployments were made by individual teams solving immediate problems, without a governance review of what data the tools access, under what retention and processing policies, with what vendor obligations attached. The governance office's job is to make this visible — to maintain a register of AI tools in use, assess each against the company's policies and applicable regulations, and flag the ones that create unaddressed risk.
Vendor sprawl is the older but equally persistent problem. The average mid-market company has more sub-processors than it has formally assessed. Many vendor contracts were signed under terms that predate the current regulatory environment. Annual review obligations exist in procurement policies that are reviewed by nobody on an annual basis. A governance office runs the vendor register, tracks assessment status, and ensures that the obligations the company has accepted in its customer-facing contracts — to assess and manage sub-processors, to notify of changes, to ensure processors meet security requirements — are actually being met.
06 / What the office costs — and who can afford it
Running a governance office as a dedicated function is expensive. A Chief Governance Officer at a mid-to-large public company commands a total compensation package in the range of several hundred thousand dollars annually. Supporting staff — compliance analysts, a policy manager, a governance programme coordinator — add further cost. Board governance software, legal advisory retainers, audit support, and external framework assessments add more. A fully resourced governance office at a public company plausibly runs between $250,000 and $750,000 per year or more, depending on the company's complexity and regulatory footprint. These are directional estimates, not precise benchmarks, but the order of magnitude is consistent with what governance-function costs look like at scale.
That cost structure is why the standalone CGO is predominantly an enterprise role. Mid-market companies — those in the $10 million to $200 million revenue range — have typically not built this office. They hold fragments of it: a controller who owns some financial policies, an outside lawyer who reviews contracts on demand, a security lead who manages compliance certifications, and tribal knowledge distributed across people who have been at the company long enough to know how things are supposed to work. These fragments keep the company functional under normal conditions. Under audit pressure, deal scrutiny, a regulatory inquiry, or the arrival of a significant new law, they are not enough.
The governance function is now something that can be embedded rather than fully staffed. The combination of a structured system, a defined method, and an independent integrator — someone who owns the function without sitting on the payroll as an officer — allows a mid-market company to operate with governance coverage that was previously available only to companies large enough to staff a dedicated office. The economics are different. The coverage is real. And the gaps that cost money when the audit arrives, or the deal goes to diligence, or the AI Act obligation comes due, are the same gaps the embedded function addresses as the staffed one would.
See it on your company.
This is the desk work of the office we embed. A structured governance review shows you, on your own documents and systems, exactly where your proof is strong, fragile, and missing — in plain language, no data required.