Governance Services
Governance Frameworks Built for Defence
Effective governance is the foundation on which every compliance programme rests. WHG helps defence organisations design, implement, and embed governance structures that satisfy MOD expectations, withstand scrutiny, and drive genuine accountability at every level.
Why Governance Matters in Defence
In the defence sector, governance is not a corporate formality. It is the mechanism by which organisations demonstrate to the MOD, to prime contractors, and to regulators that compliance obligations are understood, owned, and actively managed — not just documented.
Weak governance is the most common root cause of compliance failure. When accountability is unclear, when board-level oversight is absent, and when audit findings are not tracked to closure, even well-designed management systems break down under scrutiny.
WHG works with organisations at every level — from board and executive teams to operational managers — to build governance structures that are proportionate, defensible, and genuinely effective. We design frameworks that create accountability, not bureaucracy.
Governance Standards We Align To
- JSP 892 — Risk Management Framework
- JSP 440 — Defence Security
- JSP 375 — Health, Safety & Environment
- ISO 9001 — Top Management Obligations
- ISO 27001 — Information Security Governance
- ISO 31000 — Risk Management Principles
- ISO 19011 — Audit Programme Management
- Def Stan 05-061 — Quality Governance
- UK Corporate Governance Code (adapted)
- HM Treasury Orange Book — Risk Management
- NCSC Cyber Assessment Framework (CAF)
- Armed Forces Covenant — Governance Obligations
Governance Maturity Assessment
Before designing a governance framework, WHG assesses your current maturity across five dimensions. The assessment identifies where governance is strong, where it is fragile, and where the highest-priority improvements lie.
Board Oversight
No formal compliance reporting to board. Compliance managed operationally with no executive visibility.
Occasional board updates. No structured reporting cadence or defined board responsibilities.
Regular compliance reporting to board. Responsibilities assigned but not formally documented.
Formal board compliance committee or agenda item. KPIs reported. Responsibilities in governance charter.
Board actively challenges compliance performance. Governance charter reviewed annually. External assurance obtained.
Risk Governance
No formal risk register. Risks managed informally by individuals.
Risk register exists but not regularly reviewed. No escalation protocol.
Risk register maintained and reviewed quarterly. Escalation protocol defined.
Risk appetite statement approved by board. Risk governance aligned to JSP 892. Regular risk reviews.
Risk governance integrated across all management systems. Board risk appetite drives operational decisions.
Audit & Assurance
No internal audit programme. External audits managed reactively.
Internal audits conducted but not to a programme. Findings not formally tracked.
Annual internal audit programme. Findings tracked to closure. Audit committee in place.
Risk-based audit programme. Audit committee with defined ToR. Trend analysis of findings.
Integrated assurance map. Audit findings drive management system improvement. Board receives assurance opinion.
Accountability Structures
Compliance ownership unclear. Responsibilities assumed rather than assigned.
Key compliance roles identified but not formally documented. Gaps in coverage.
RACI or equivalent documented. Compliance responsibilities in job descriptions.
Accountability framework reviewed annually. Performance against compliance KPIs included in appraisals.
Compliance accountability embedded in culture. Leadership behaviours assessed. Escalation culture strong.
Policy & Documentation
Policies exist but are outdated, inconsistent, or inaccessible.
Core policies in place but not systematically reviewed or version-controlled.
Policy framework documented. Annual review cycle. Document control in place.
Policy hierarchy aligned to standards and Def Stan requirements. Ownership assigned per policy.
Policy framework integrated across all management systems. Policies actively used, not just filed.
Request a Governance Maturity Assessment
WHG conducts a structured assessment across all five dimensions, producing a maturity score, gap register, and prioritised improvement roadmap — typically completed within two weeks.
Board-Level Compliance Responsibilities
MOD contracts and ISO standards increasingly require evidence of board-level engagement with compliance. This means more than a signature on a policy document. It means demonstrable oversight, regular reporting, and clear accountability for compliance performance at the highest level of the organisation.
WHG works with boards and senior leadership teams to define their compliance responsibilities, establish appropriate reporting mechanisms, and build the governance cadence — board papers, management reviews, KPI dashboards — that demonstrates active oversight to auditors and contract monitors.
Risk Governance Structures
JSP 892 establishes the MOD's risk management framework. Organisations working closely with the MOD are expected to align their own risk governance with JSP 892 principles — maintaining risk registers, escalation protocols, and risk appetite statements that reflect the defence operating environment.
WHG designs risk governance structures that satisfy JSP 892 alignment requirements, integrate with ISO 31000 principles, and connect operational risk management to board-level oversight. We build the registers, escalation frameworks, and review cycles that make risk governance real rather than theoretical.
Audit Committee Best Practices
An effective audit committee is the cornerstone of a credible governance framework. In defence organisations, the audit committee must oversee both internal audit activity and the organisation's response to external audit findings — from ISO surveillance audits to MOD contract compliance reviews.
WHG supports the establishment and operation of audit committees — defining terms of reference, designing internal audit programmes, tracking non-conformance close-out, and ensuring the committee's work is documented in a way that satisfies external scrutiny.
Audit Committee Essentials
Terms of Reference
Formal ToR defining the committee's scope, membership, meeting frequency, and reporting obligations.
Internal Audit Programme
Risk-based annual programme covering all management system elements and contractual obligations.
Non-Conformance Tracker
Live register of all audit findings — internal and external — with owner, due date, and close-out evidence.
Assurance Opinion
Periodic assurance opinion to the board on the effectiveness of the compliance and risk management framework.
Stakeholder Accountability
Governance only works when accountability is clearly assigned and actively enforced. WHG builds accountability frameworks that define who owns each compliance obligation, how performance is measured, and what happens when obligations are not met.
Board / Executive
Set compliance policy, approve risk appetite, receive assurance reporting, and demonstrate active oversight to MOD and certification bodies.
Compliance Director / Manager
Own the compliance programme, manage the management system, coordinate internal audit, and report performance to the board.
Audit Committee
Oversee internal audit activity, review external audit findings, track non-conformance close-out, and provide independent assurance to the board.
Risk Owner
Maintain the risk register for their area, implement controls, report risk status, and escalate emerging risks in accordance with the risk governance framework.
Line Managers
Ensure their teams understand and comply with relevant policies and procedures, complete required training, and report non-conformances promptly.
Information Security Lead
Own the ISMS, manage information security risks, coordinate with JSP 440 requirements, and report security incidents and near-misses.
Real-World Governance Scenarios
The governance challenges WHG addresses are grounded in the realities of defence contracting. These scenarios reflect the situations our clients most commonly face.
Scenario 01
MOD Contract Award — Governance Due Diligence
The Situation
A defence SME is awarded a significant MOD prime contract. The contract requires evidence of a governance framework that demonstrates board-level compliance oversight and a documented risk management process aligned to JSP 892.
The Challenge
The organisation has no formal governance framework. Compliance is managed by one individual with no board reporting structure, no risk register, and no audit committee.
The WHG Approach
WHG conducts a governance gap analysis, designs a proportionate governance framework, establishes a compliance reporting structure to the board, implements a JSP 892-aligned risk register, and prepares the governance evidence pack required for contract compliance.
Outcome
Governance framework in place within eight weeks. MOD contract compliance confirmed. Board now receives quarterly compliance dashboard.
Scenario 02
ISO Surveillance Audit — Governance Non-Conformance
The Situation
An organisation receives a major non-conformance at ISO 9001 surveillance audit. The finding: management review is not being conducted in accordance with the standard, and there is no evidence of top management engagement with the QMS.
The Challenge
The management review process exists on paper but has not been conducted for 14 months. Senior leadership are not engaged with the QMS. The certification body has given 90 days to close the non-conformance.
The WHG Approach
WHG facilitates an immediate management review, redesigns the review process to be practical and sustainable, trains the leadership team on their ISO obligations, and produces the corrective action evidence required for the certification body.
Outcome
Non-conformance closed within six weeks. Management review cadence established. No recurrence at subsequent surveillance audit.
Scenario 03
Supply Chain Governance — Prime Contractor Requirement
The Situation
A tier-one defence contractor requires all tier-two suppliers to demonstrate a governance framework that includes documented accountability structures, a risk register, and evidence of internal audit activity — as a condition of continued supply.
The Challenge
The tier-two supplier has ISO 9001 certification but no formal governance framework beyond the QMS. The prime contractor's requirement goes beyond the ISO standard and includes JSP-aligned risk governance.
The WHG Approach
WHG maps the prime contractor's governance requirements, designs a proportionate framework that satisfies both the ISO standard and the prime's specific obligations, and produces the governance evidence pack required for supply chain qualification.
Outcome
Supply chain qualification maintained. Governance framework adopted as the organisation's standard operating model.
How WHG Supports Your Governance Journey
From initial assessment to ongoing assurance — WHG provides the expertise and practical support to build and maintain governance frameworks that work.
Governance Maturity Assessment
A structured assessment across five dimensions, producing a maturity score, gap register, and prioritised improvement roadmap.
Governance Framework Design
Design of a proportionate governance framework — accountability structures, reporting mechanisms, policy hierarchy, and review cycles.
Board Reporting & Oversight
Design of board compliance reporting packs, KPI dashboards, and management review processes that demonstrate active oversight.
Risk Governance Implementation
JSP 892-aligned risk governance — risk registers, appetite statements, escalation protocols, and risk review cycles.
Audit Committee Support
Establishment and operation of audit committees — terms of reference, internal audit programmes, and non-conformance tracking.
Ongoing Governance Assurance
Periodic governance reviews, management review facilitation, and continuous improvement support to maintain governance maturity.
“Before WHG, our compliance programme was entirely dependent on one person. Now we have a governance framework the whole board understands and owns. Our last MOD audit specifically commended our governance structure.”
Managing Director, UK Defence Systems Integrator
Build a Governance Framework That Holds
Whether you are establishing governance from scratch or strengthening an existing framework, WHG provides the expertise and practical support to build structures that satisfy MOD requirements and stand up to scrutiny.
Speak to Our Governance Team