Every quarter, a function head fills in a status color for the risk categories under her control. Cyber resilience: green. Safety documentation: green. Supply chain continuity: green. The colors roll up into a single page, and the page reaches the board looking exactly like evidence. It is not evidence. It is a claim, written by the person whose own performance the claim reflects on, and no one downstream of her has tested whether it is true.
This is not a new failure. It is one of the oldest patterns in governance, and it survives because it is comfortable for everyone involved. The function head who reports green is rarely lying. She believes it, based on what reaches her own desk, filtered again by the people below her who are reporting on their own performance in turn. The board that accepts green is rarely negligent. It is doing what boards have always done: trusting the people it hired to run the parts of the business the board cannot run itself. The mechanism does not require anyone to act in bad faith. It only requires everyone in the chain to prefer the version of events that reflects well on them, which is not a character flaw. It is what incentives do to people, reliably, in every organization Glenn has watched in thirty years of sitting across the table from boards and the executives who report to them.
There is a name for the distinction that resolves this, and boards that have not drawn it correctly keep discovering the gap only after it has cost them something. The Governance Boundary Principle holds that the board governs and management manages, and that the line between the two is not about how much information crosses it. It is about who tested the information before it arrived. A board that reads a color-coded packet the CEO's office assembled is not exercising oversight, no matter how many pages the packet runs. It is receiving management's account of itself, formatted to resemble independent judgment. Genuine oversight requires a channel the function being measured does not control: an auditor with a dual reporting line, a named verifier outside the chain, a director who tested the claim personally rather than read someone else's summary of it.
Boards that try to fix this by asking management to be more forthcoming are solving the wrong problem. Under Delaware's hardened Caremark doctrine, the officer who now carries personal exposure for a failure inside her own domain has every incentive to describe that domain accurately. What she does not have is the distance to see her own blind spots, and no amount of asking for candor changes that. The fix is not a better conversation with the person being measured. It is a channel her own incentives cannot reach.
The UK's Provision 29 makes the correct response explicit: not more reporting, a smaller, board-judged list of the thirty to fifty things capable of actually breaking the company, each independently verified rather than self-attested. The standard is deliberately narrow, and it is narrow on purpose. A board drowning in hundreds of self-reported line items has not built oversight. It has built a paperwork burden that happens to arrive in color, and the volume itself becomes the excuse for never testing any single line of it.
The reason this pattern is so durable is that trusting your people feels like leadership, and demanding independent verification of what they tell you can feel like its opposite. Glenn has sat across from boards that treated a request for independent testing as an insult to the executive being tested, as though verification were an accusation rather than a structure every serious institution eventually builds around the people it depends on most. The board that confuses trust with the absence of checking has not built a relationship. It has built a liability, one green rating at a time.
A board that keeps accepting the report because the report looks clean will keep discovering, one incident at a time, how much of its confidence it borrowed from people it never checked. A board that builds the independent channel before anything breaks is not expressing distrust of its executives. It is doing the one thing a self-graded report can never do for it: knowing, rather than believing, that green means green.