Governance and speed are not natural enemies, but most organisations have built governance processes that make them feel that way. The result is a constant tension between teams trying to deliver and controls trying to protect — with both sides frustrated and neither achieving their goals effectively.
Controls that create drag
The most common governance failure is designing controls around process rather than outcomes. A change advisory board that reviews every change regardless of risk creates the same overhead for a CSS colour change as for a database migration. Teams learn to game the system — batching changes to reduce reviews, or classifying risky changes as "standard" to avoid the process entirely.
Tiered, automated, transparent
Effective governance applies controls proportionate to risk. Low-risk changes with passing automated checks should flow through with no human intervention. Medium-risk changes need asynchronous review by the right person. Only high-risk changes — those affecting security boundaries, data processing, or critical infrastructure — should require synchronous review.
Automation is the key enabler. Evidence that's captured automatically during the build and deployment process is more reliable than evidence assembled manually after the fact. Automated checks provide consistent enforcement without human bottlenecks. And automated dashboards give leadership visibility without requiring teams to produce reports.
Making the right thing the easy thing
The best governance processes are ones that teams barely notice when they're doing the right thing. Guardrails should guide, not block. Controls should be embedded in tooling, not layered on top. And the governance team should measure its success not by the number of changes it reviews, but by how fast compliant changes reach production.