COSO’s 2025 attempt at board-oversight guidance was quite prescriptive, and the result was an unpopular publication that was eventually withdrawn. That’s how we got the streamlined version: 12 principles, not a step-by-step manual. Jim DeLoach of Protiviti reads each one as something wider than a directors’ document, a shared vocabulary for the audit, risk and compliance professionals who feed the governance process.
Earlier this year, the Committee of Sponsoring Organizations (COSO), a joint private-sector initiative aimed at improving organizational performance and governance, issued new guiding principles for board oversight, developed in collaboration with big four consultancy PwC. The guidance includes 12 principles that “offer boards a practical tool for assessing whether their governance model remains fit for purpose as organizations confront accelerating change, heightened stakeholder scrutiny and increasingly complex risk environments,” COSO said.
By grounding oversight in terms of clear roles and accountability, appropriate board composition and culture, disciplined strategy and performance monitoring, informed use of technology and data, thoughtful stakeholder engagement, strong leadership and incentives, and resilient risk and internal control practices, the framework’s principles help boards and governance professionals focus on what matters most: sustaining trust and long-term value.
The good news is that the guidance is easy to use and is principles-based, avoiding a prescriptive one-size-fits-all approach to governance. Used as a common governance language for self-assessments, committee agendas, onboarding, education and decision-making during periods of transition, the guidance can help boards sharpen constructive challenge, improve communications with those who support vital information flows and reinforce follow-through as circumstances and needs evolve.
Is your board governance fit for purpose?
The COSO publication is effectively board-facing, but its impact should extend far beyond the boardroom, including to audit executives, risk and compliance professionals and others who take part in the governance process at all types of organizations, whether public, private or nonprofit.
Here is a crisp summary of the 12 principles:
Board governance structure: The board defines and oversees a governance structure that supports its fiduciary duties; clarifies roles and delineates authorities; and aligns oversight responsibilities with the organization’s mission, strategy, objectives, risk appetite and applicable legal and regulatory requirements.
Board accountability: The board follows laws, regulations and governance standards; honors shareholder or other beneficiary rights; and oversees governance and controls to promote stakeholder trust through complete, accurate and timely disclosures.
Board composition and leadership: Board members offer a diverse set of skills and backgrounds; maintain independence from management; and regularly review the board’s composition, leadership roles and succession plans to ensure ongoing effectiveness.
Board effectiveness: The board regularly assesses and improves its performance; monitors internal and external changes; and refines governance practices to enhance oversight, support informed decision-making and sustain long-term value creation.
Purpose, mission and values: The board periodically reviews the organization’s purpose, mission and values and oversees their alignment with strategy, culture, incentive structures and workforce practices, so they guide decision-making and sustain strategic consistency at all levels of management.
Culture, conduct and tone at the top: The board sets clear expectations for integrity and ethical conduct; models these values in its actions and decisions; expects senior managers to uphold them; and ensures their alignment with the organization’s purpose.
Strategy, objectives and performance: The board provides independent perspective on strategy and objectives; approves plans and actions to execute the strategy; and oversees execution by monitoring performance against agreed objectives and measures while also confirming alignment of incentives with the organization’s purpose, mission, values, risk appetite and focus on creating long-term value.
Technology and data: The board ensures technology and data practices are managed according to the organization’s strategy and risk appetite and used to enhance performance and resilience.
Stakeholder engagement: The board oversees management’s approach to identifying and engaging stakeholders; promotes credible, balanced communication; engages directly when appropriate; and incorporates relevant stakeholder interests and feedback into strategic conversations to strengthen trust and long-term value creation.
Executive leadership and succession: The board appoints the CEO and, as appropriate, key executives; oversees leadership and succession planning; and periodically reviews management’s talent strategy, leadership pipeline and capability needs to ensure leadership continuity and organizational resilience.
Executive performance and compensation: The board reviews CEO and, as appropriate, executive management performance; approves compensation plans; and oversees incentive structures to drive long-term performance and reinforce accountability for long-term value creation.
Risk management and internal control: The board oversees the organization’s approach to managing risk and internal control, including management’s monitoring and assurance activities, to support strategy and objectives and strengthen resilience.
A key takeaway: For each of the 12 principles, the guidance is structured to enable directors to wade into the content so that they can ease in—starting with the essentials—rather than feeling forced to work through the guidance as if it were a novel.
Bored Directors? How to Make Sure Board Materials Are Contributing Value
Board materials should be channeling the board’s energy and effectiveness as strategic advisers, not bogging them down, Protiviti’s Jim DeLoach writes. He offers a disciplined approach for excellent board operations through a shift from presentation to collaboration that honors the sanctity board members’ time.
Read moreDetailsWhy is guidance needed?
For sure, ample guidance already exists in exchange listing standards, regulatory requirements, industry-specific expectations, general practices framed by case law (e.g., the Caremark standard in the US) and accepted practices as outlined in various handbooks for public, private and nonprofit organizations.
COSO’s stated intent is to offer general guidance that serves as a unified reference for directors, executives and board advisers who operate in an environment largely framed by guidance available in multiple sources. COSO says its corporate governance publication clarifies roles, facilitates governance discussions and highlights practices that support informed decisions and accountability in a changing environment.
It is important to note that COSO asserts that the guidance is directional and illustrative. It does not mandate requirements or a single governance model, nor does it purport to cover an exhaustive summary of all board responsibilities. Simply stated, the intention is to bring together interrelated principles that support and inform effective board oversight. The bottom line: The guidance is meant “to complement, not replace, applicable law, regulation and other widely recognized governance guidance.”
Some may question that because COSO is led, in effect, by accountants, auditors and financial executives, it lacks the credentials to publish guiding principles for board oversight. The reality is that these professionals often engage with boards and provide valuable information to inform boards. They are well aware of the history of governance failures and their root causes linked to ineffective board oversight. And, to no surprise, many ultimately serve on boards.
Importantly, COSO does not develop guidance in a vacuum. The development of the guiding principles draws on extensive research, a review of widely recognized governance guidance and input from directors, executives and governance professionals, in addition to representatives of each of COSO’s sponsoring organizations.
Tips on using the guidance
The principles are broadly applicable to public, private and nonprofit organizations. Since it is not tied directly to any particular jurisdiction’s legal framework, it applies globally as well. Board members have the flexibility to determine the specific practices and examples that are most relevant.
For example, they can use the framework as a benchmark when conducting a periodic board self-assessment. The principles can be used to frame board and committee discussions around priority oversight topics and inform director onboarding and continuing education through a shared governance vocabulary. During transitional moments — events like leadership changes, major market shifts, material or unusual transactions or heightened stakeholder scrutiny — the board may find a framework grounded in governance principles useful to its deliberations.
COSO’s publication also provides a shared governance language for directors and governance professionals, including corporate secretaries, chief audit executives, risk and compliance professionals, board advisers, institutional investors and others who interact with the governance process. The shared language COSO’s guidance offers can provide context for the information and analysis executive management needs to support those discussions. It can also be useful in identifying where information flows, decision-making processes or accountability may benefit from further clarification.
Deciding where to start is a matter of judgment. For those who like a simple approach, here are five questions to ask that are based on several of COSO’s guiding principles:
- Governance structure: How well does our current governance structure align with COSO’s guiding principles? Our defined roles, delegated authorities and committee functions clearly defined for effective oversight?
- Accountability and value creation: Does our board oversight model support disciplined decision-making that supports sustainable long-term value creation and organizational resilience?
- Board composition and expertise: Are we periodically reassessing board composition and director expertise to ensure alignment with market opportunities, emerging risks and strategic challenges, as highlighted in the COSO framework?
- Culture and ethical conduct: How does the board monitor and reinforce ethical conduct, integrity and tone at the top across the organization, as emphasized by COSO’s principles?
- Stakeholder engagement: Are we actively engaging stakeholders and communicating governance expectations transparently, ensuring alignment with COSO’s emphasis on accountability and responsiveness?
Conclusion
Some assert that the guidance is too high-level and may argue for something more granular. In fact, COSO tried that approach in 2025 and it was not received well, forcing a significant streamlining of the guidance. My experience with the board community is that directors prefer general principles that give them some running room to stake out the best approaches that make the most sense in the circumstances. A cookbook is neither needed nor wanted.
COSO’s 12 principles are timeless, which makes them a convenient compendium of well-known governance concepts. There is nothing controversial about them, as they reflect both widely established board expectations and context-dependent practices based on the facts and circumstances in each case and the applicable legal and regulatory environment. It is their familiarity that makes them credible and enhances their usefulness as a framework for assessing effectiveness of board oversight.
Jim DeLoach, a founding 
