Governance Compliance Shield

Governance & Compliance Shield

The startup corporate governance and compliance system. From "good enough" seed-stage governance to board-room ready Series C+ — practical frameworks that satisfy investors, regulators, and auditors without drowning in bureaucracy.

Keywords

board, board of directors, board meeting, board minutes, board resolution, governance, corporate governance, compliance, audit, auditor, statutory audit, internal audit, SOC 2, SOC2, ISO 27001, ISO 9001, ESG, CSR, internal controls, risk management, ERM, whistleblower, anti-bribery, FCPA, UK Bribery Act, related party transaction, RPT, independent director, audit committee, nomination committee, remuneration committee, shareholder meeting, AGM, EGM, proxy, voting, fiduciary duty, D&O, director liability, Companies Act, MCA, ROC, SEBI, LODR, secretarial audit, annual return, corporate social responsibility, Section 135, Section 188, NCLT, CLB, company secretary

How to Use This Skill

Chain with existing skills:

• legal-ip-fortress for legal compliance and regulatory frameworks
• crisis-war-room for board/governance crises
• ops-scale-engine for operational compliance integration
• fundraising-command-center for investor governance requirements

1. Board Governance by Stage

Board Composition Evolution

Board Meeting Management

Pre-Meeting (7 Days Before):

1. Send board deck (12-15 slides max)
2. Include: financials, KPIs, team update, strategic issues, asks
3. Pre-read materials: detailed appendix, data room updates
4. Board member 1:1 pre-calls (no surprises in meetings)

Board Deck Template:

During Meeting:

1. Start on time, end on time
2. CEO drives agenda, Chair manages discussion
3. Limit presentations — maximize discussion time (60/40 rule)
4. Capture action items and decisions in real-time
5. Executive session (without management) at end — this is normal and healthy

Post-Meeting (48 Hours After):

1. Circulate draft minutes within 48 hours
2. Action items with owners and deadlines
3. Board-approved resolutions documented

2. Compliance Certification Roadmaps

SOC 2 Type II (Most Common for SaaS)

What: Audit of controls related to Security, Availability, Processing Integrity, Confidentiality, and Privacy Who needs it: Any SaaS selling to mid-market or enterprise customers Timeline: 6-12 months (Type I: 3-6 months, Type II requires 6+ month observation) Cost: $20,000-80,000 (auditor fees) + internal effort

SOC 2 Readiness Checklist:

Implementation Timeline:

• Month 1-2: Gap assessment, policy writing
• Month 3-4: Control implementation, tool deployment
• Month 5: Type I audit (point-in-time)
• Month 6-11: Observation period (controls operating)
• Month 12: Type II audit (period of time)

ISO 27001 (Information Security Management)

Who needs it: Companies with EU/global enterprise customers, regulated industries Timeline: 6-18 months Cost: $30,000-150,000+ Key difference from SOC 2: Prescriptive controls (Annex A — 93 controls), certification by accredited body

ISO 9001 (Quality Management)

Who needs it: Manufacturing, healthcare, government contractors Timeline: 6-12 months Cost: $15,000-50,000

3. Internal Controls Framework

COSO-Lite for Startups

Financial Controls Minimum

4. Risk Management Framework

Enterprise Risk Register (Simplified)

Risk Response Options:

• Accept: Risk is low and cost of mitigation exceeds potential impact
• Mitigate: Implement controls to reduce likelihood or impact
• Transfer: Insurance, indemnification, outsourcing
• Avoid: Change plans to eliminate the risk entirely

5. ESG Framework for Startups

ESG Relevance by Stage

Minimal Viable ESG (Series A)

6. India Corporate Governance Stack

Companies Act 2013 — Key Governance Requirements

India Board Composition Rules

India CSR Requirements (Section 135)

Trigger: Net worth ≥INR 500 Cr OR Turnover ≥INR 1,000 Cr OR Net profit ≥INR 5 Cr (in any of preceding 3 years)

Requirement: Spend 2% of average net profits (preceding 3 years) on CSR activities

CSR Activities (Schedule VII):

• Eradicating hunger, poverty
• Education, gender equality, women empowerment
• Environmental sustainability
• Healthcare, sanitation
• Rural development
• Protection of heritage, art, culture
• Armed forces veterans welfare
• Sports promotion
• Technology incubators (DPIIT approved)
• Rural sports, Paralympic, Olympic training

India Statutory Compliance Officers

7. Anti-Bribery & Ethics

FCPA / UK Bribery Act Essentials (For International Operations)

Minimum Anti-Corruption Program

• Written anti-bribery policy
• Tone from the top (board-level commitment)
• Due diligence on third parties (agents, distributors, JV partners)
• Gifts and hospitality policy (limits, approval, documentation)
• Training for employees in at-risk roles
• Confidential reporting mechanism (whistleblower)
• Regular monitoring and review
• Documented investigations of any concerns

Reference Files

For detailed governance documentation, load:

• reference/board-templates.md — Board deck template, resolution formats, minutes template
• reference/india-governance-calendar.md — Month-by-month India Companies Act compliance calendar

Adversarial Governance Layer

Red Team Governance

Before every major board decision:
1. Assign 2-3 people to build strongest case AGAINST the proposal
2. Give 24-48 hours for evidence-based counter-argument
3. Present counter-case BEFORE the proposal
4. No rebuttal during presentation — listen first
5. Score objections: likelihood x severity. Address anything >7/10.

Devil's Advocate Protocol

1. Rotate role — never same person twice consecutively
2. Give preparation time (unprepared advocacy is theater)
3. Advocate presents FIRST (prevents anchoring)
4. No interruptions during counter-presentation
Effective only when advocate is genuinely prepared, not role-playing.

Pre-Mortem for Strategic Governance

90-MINUTE SESSION before any major commitment:
1. Brief board on proposal (10 min)
2. "Imagine 12 months from now, this FAILED. Write why." (15 min silent)
3. Round robin — one reason per round (30 min)
4. Cluster: Likelihood x Impact 2x2 (20 min)
5. Mitigate top-right quadrant (15 min)
Prospective hindsight increases diagnostic accuracy by 30%.

ACH for Board Decisions

1. List ALL plausible hypotheses (not just obvious two)
2. Evidence matrix: hypotheses as columns, evidence as rows
3. Mark what each evidence DISPROVES (not confirms)
4. Eliminate hypotheses with most inconsistent evidence
5. Surviving hypothesis gets resourced. Others get monitoring triggers.
Source: CIA Structured Analytic Technique (Richards Heuer)

Counter-Intelligence for Governance

Board materials: CONFIDENTIAL default, numbered/watermarked copies, access logging
Social engineering defense: "talk track" for public info, classification system
Insider threat: unusual data access flagged, departing exec access restricted
Quarterly: security awareness refresher, board-level access audit