Consider a regulatory institution with an enviable compliance record. Its enabling legislation contains robust independence provisions. Its annual report is filed on time. Its external audit is clean. It has a conflict-of-interest policy, a risk management framework, and a signed memorandum of understanding with each of its peer regulators. By many conventional measures, its governance arrangements appear sound.
Now consider what happens when those arrangements are tested and a systemically significant institution under a regulator's oversight fails — due to a key regulatory decision being challenged as politically influenced, or a regulated entity exploiting a cross-sector blind spot that an information-sharing agreement intended to close. The governance policies still exist. The annual reports were still submitted. The audit opinion has not changed. But a more important governance question has emerged: Did the governance arrangements actually work when they were needed?
The scenario is hypothetical, but the governance problem is not. Regulatory failures can expose a gap between the existence of governance arrangements and their effectiveness when tested in practice. This is why compliance and accountability, although closely related, should not be confused.
Compliance can tell us whether governance requirements have been met. Accountability asks those entrusted with authority to explain and justify how that authority has been exercised — and to demonstrate it with evidence.
Both are essential to effective governance. Neither, on its own, defines it.
What Compliance Tells You — and What It Cannot
Compliance is indispensable to good governance. Regulatory institutions derive their powers from legislation and must operate within clearly defined legal and institutional frameworks. Policies, delegations, reporting obligations, control processes and audit arrangements establish the conditions within which sound governance can occur. But the existence of those arrangements does not, by itself, establish their effectiveness.
An independence provision demonstrates that independence is required — not that it was maintained when pressure was applied. A conflict-of-interest policy establishes rules for identifying and managing conflicts — not how an actual conflict involving a consequential decision was handled. An annual report demonstrates that reporting obligations were met, while potentially saying little about how significant discretionary powers were exercised. A memorandum of understanding commits institutions to cooperate — not whether the right information was exchanged at the right time when a cross-sector risk emerged.
This shift from structure to outcome is increasingly reflected in contemporary governance thinking. The OECD's governance principles for regulators, ISO 37000:2021 and the King V™ Code on Corporate Governance for South Africa 2025 all orient governance accountability around demonstrable outcomes — not merely the adoption of appropriate frameworks. The question is shifting from: What governance arrangements do you have? — to: What evidence demonstrates that those arrangements are working?
Compliance documents the input. Accountability evidences the output. Effective governance is what results when institutions can demonstrate both.
Testing Governance Under Pressure
The distinction between compliance and accountability can arise across virtually every aspect of governance. It becomes particularly visible where governance depends not merely on the existence of a rule or structure, but on behaviour, judgement and the exercise of discretion.
Independence
Legislation affirming a regulator's independence tells us something important about institutional design. But independence matters most when exercising it becomes difficult — when enforcement affects a politically connected entity, a powerful industry participant challenges an uncomfortable regulatory decision, or external stakeholders seek to influence an outcome.
In those circumstances, the accountability question is not simply whether statutory protection exists. Can the institution explain how the decision was reached? Can it demonstrate that relevant considerations were weighed appropriately? Is the reasoning traceable? And is there evidence that its independence held when it was tested?
Independence written into law is important. Independence demonstrated under pressure is what creates trust.
Conflicts of interest
A conflict-of-interest policy establishes the rules. Governance is tested when those rules encounter an actual conflict involving a consequential decision.
Was the conflict identified before the decision? Was it declared? Was the affected person excluded appropriately from deliberation? Is the reasoning traceable? Was the treatment consistent with comparable situations?
A policy can establish what should happen. Accountability requires the institution to demonstrate what actually happened. Integrity is not established by the existence of an integrity mechanism — it becomes credible through the way difficult situations are handled.
Transparency
Publication does not necessarily equal transparency. A regulator may publish an annual report, enforcement statistics and regulatory decisions while revealing relatively little about how significant discretionary powers were exercised.
The accountability question is not simply whether required information was published. It is whether legitimate stakeholders can understand the basis upon which significant decisions were made and form a reasonable view as to whether authority was exercised consistently, fairly and within mandate.
A decision can be visible while the governance behind it remains opaque. Transparency only becomes meaningful when it enables scrutiny, not merely disclosure.
Cross-regulatory cooperation
Many contemporary regulatory risks no longer sit neatly within a single institutional mandate. Digital financial services, cross-border transactions, data-sharing arrangements and increasingly interconnected markets require regulators to exchange information and coordinate their responses.
An MoU is an important starting point, but accountability asks different questions. When an emerging risk crossed institutional boundaries, was it identified jointly? Was relevant information shared timeously and securely? Were responsibilities understood? Did institutions act on intelligence received from one another?
The MoU's operation under real conditions is what makes cooperation capable of being relied upon.
These four examples are illustrative. The same distinction can arise in risk governance, ethics, technology governance, delegation, oversight, performance and many other areas. Wherever authority is exercised, the accountability question follows: Can the institution explain and demonstrate how it governed?
Governance Is a Continuum — Not a Compliance Threshold
Compliance naturally tends towards a threshold: a requirement has either been met or it has not. However, governance effectiveness is rarely so binary.
Two institutions may have almost identical governance structures while demonstrating vastly different capabilities in practice. Consider a scenario where these two governing bodies may both receive comprehensive risk reports — one notes and accepts them, the other interrogates emerging patterns, challenges assumptions and changes strategic decisions as a result. Both can demonstrate that risk reporting exists, but they are not demonstrating the same quality of governance.
The concept of governance maturity captures this distinction. Governance develops along a continuum: arrangements may initially exist largely in form, become increasingly embedded and consistently applied, and ultimately reach a point where their effectiveness can be evidenced, evaluated and improved over time. ISO 37004:2023 formalises this thinking, and its core insight is straightforward — having governance and demonstrating effective governance are distinct stages of institutional capability.
It is at the point of demonstrated, evidence-based accountability that governance becomes genuinely effective — verifiable rather than asserted, and improvable because it can be examined.
The Evidence Standard
This leads to a deceptively simple test for any regulatory institution:
If your governance were independently examined tomorrow — not your compliance record, but your governance — what evidence would you produce?
Could you show that significant decisions are traceable to documented reasoning rather than simply recorded outcomes? Could you demonstrate that independence was maintained in circumstances where maintaining it was difficult? Would conflict-of-interest records show that conflicts were identified and managed at the point of decision rather than reconstructed afterwards? Could you demonstrate that cooperation with peer regulators produced substantive outcomes — not merely meetings and information-sharing agreements? And could you show that governance today is more effective than it was three years ago?
These questions are not intended to imply that governance is absent where the evidence is incomplete. One of the more important challenges facing institutions may be precisely the opposite: they may be practising sound governance that they cannot adequately demonstrate. The practice may be good, but the evidence trail may not be.
In an individual institution, an incomplete evidence trail limits the governing body's ability to assess whether governance is working consistently. In a regulatory ecosystem, the implications extend further — peer regulators, government, Parliament, regulated entities, development partners and the public may all need to place reliance on the integrity of an institution's governance. Governance that cannot be demonstrated provides weaker assurance to those who depend upon it.
There is also a forward-looking dimension to this proposition. Evidence that is actively used — to identify recurring patterns, emerging relationship risks, or inconsistencies in how structures operate in practice — allows an institution to ask the more demanding question: Are we governing better than we were before? That is where governance moves from periodic assurance to genuine institutional learning.
The SADC Imperative
For regulatory institutions across SADC, the stakes of this distinction are rising. Digitalisation, financial innovation, AI-enabled decision-making and growing cross-border interdependence are increasing the complexity of the environments regulators are expected to oversee. As that complexity grows, the limitations of relying predominantly on structural compliance become more pronounced.
The implications extend beyond institutional credibility. Investor confidence, development finance and economic growth trajectories all attach, in part, to the perceived integrity of a country's regulatory environment — and that perception is shaped not by the existence of governance frameworks, but by the evidence that those frameworks work. A SADC regulatory landscape that can demonstrate governance effectiveness presents a fundamentally different proposition to development partners and long-term investors than one that can demonstrate only structural compliance.
Some SADC institutions may already be practising governance at a level their formal reporting does not fully reveal — in which case the challenge is to strengthen the evidence, not create more governance. Others may find that closer examination exposes arrangements that are sound in design but inconsistently applied in practice. Both situations require the same shift: from asking whether governance arrangements are in place, to demonstrating whether they are working.
Compliance Is the Floor
Compliance will always matter. A regulator that does not comply with its enabling legislation, reporting obligations and governance requirements has a fundamental problem. But compliance is the floor, not the destination.
A regulatory institution exercises authority that citizens, markets, and regulated entities are required to respect. That authority carries a corresponding obligation: not merely to comply with the rules governing the institution, but to demonstrate that its powers are exercised independently, transparently, consistently and effectively.
The question regulators should therefore be asking is no longer simply: Are we compliant? It is the harder question: What evidence do we have that our governance is working?
For institutions entrusted with public power, that is not an assessment methodology. It is the essence of accountability — and when institutions can answer it with confidence, accountability contributes to effective governance: governance that the system, and those who depend on it, can genuinely rely on.
About the Author Jené Palmer is a Director of the CGF Research Institute. She specialises in corporate and regulatory governance, governing-body effectiveness, ethical leadership, and governance maturity assessment, and advises public, private, and non-profit institutions on strengthening governance effectiveness and accountability across southern Africa.