Lessons from the Field: Governance, Accountability, and the Balance Between Control and Autonomy
COMING SOON — A Practitioner’s Perspective on Effective Entity Management
This preview introduces a forthcoming paper exploring how corporate parents and their subsidiaries can work together more effectively. Drawing on firsthand experience managing information security across multinational organizations with parent-subsidiary relationships, the full paper will examine practical approaches, implementation challenges, lessons learned, and best practices for building an effective entity management environment.
Introduction: Why the Parent–Subsidiary Relationship Matters
A corporate organization can own many businesses and still struggle to manage them as a coherent enterprise. Acquisitions bring new technologies, established business practices, management cultures, regulatory obligations, and operating priorities. Although these businesses may share a common parent, they do not automatically share a common approach to governance, risk management, or accountability.
The challenge is not simply to establish policies and require subsidiaries to follow them. It is to develop an operating relationship in which the parent company can exercise appropriate oversight while allowing each subsidiary the flexibility needed to operate its business successfully.
Too much decentralization can leave the parent without adequate visibility into enterprise-wide risks, inconsistent practices, duplicated investments, and gaps in accountability. Excessive centralization can create a different set of problems: unnecessary bureaucracy, resistance from subsidiary management, and requirements that fail to account for legitimate local business or regulatory needs.
Effective entity management requires a deliberate balance between enterprise-wide control and subsidiary-level autonomy.
That balance must be supported by clear responsibilities, documented decision-making authority, consistent standards, structured communication, and meaningful performance measures.
My experience managing information security within a multinational organization provides a practical perspective on these challenges. The organization consisted of 19 subsidiaries operating in 13 countries, acquired over a seven-year period. Each subsidiary brought its own technology environment, processes, management practices, risk profile, and business priorities.
The work required more than establishing technical security controls. It required developing a framework through which the parent and its subsidiaries could establish common expectations, coordinate decisions, evaluate capabilities, and manage differences constructively.
These experiences form the foundation for the broader discussion presented in this forthcoming paper.
1. Define the Relationship Before Trying to Manage It
One of the fundamental requirements for effective entity management is clarity about the respective roles of the parent company and its subsidiaries.
The parent generally establishes enterprise strategy, defines group-wide priorities, oversees significant risks, establishes minimum requirements, and determines how performance and compliance will be evaluated.
Subsidiaries remain responsible for operating their businesses, serving customers, managing day-to-day activities, delivering financial results, and meeting applicable local obligations.
Some responsibilities necessarily cross organizational boundaries. Enterprise risk management, information security, regulatory reporting, shared services, and major investment decisions may require coordinated action by both levels of the organization.
The important question is not whether the parent or subsidiary should always make a particular decision. It is who has the authority to decide, who is responsible for implementation, who must be consulted, and who is accountable for the result.
Without these distinctions, corporate oversight can become inconsistent. Different subsidiaries may interpret the same requirement differently, while the parent may assume that a responsibility has been addressed when no entity has clearly accepted ownership.
A well-designed relationship makes decision rights explicit. It documents which matters are controlled centrally, which remain local, and which require joint decisions or formal escalation.
This clarity is particularly important following acquisitions, when existing practices and expectations may differ substantially from those of the acquiring organization.
2. Establish Common Governance Without Assuming Every Entity Is Identical
A multinational group needs a consistent governance framework, but consistency does not necessarily mean uniformity.
During my experience managing information security across the organization, one important initiative involved consolidating policies and standards over a two-year period. The objective was to establish a more coherent framework across entities with different operating environments and requirements.
A useful approach is to distinguish four categories of policies and standards:
- Mandatory group-wide requirements. These establish common expectations that every applicable subsidiary must satisfy.
- Group-wide requirements permitting local adaptation. These establish a common objective or minimum standard while allowing approved differences in implementation.
- Parent-specific requirements. These apply to the parent company’s own operations and responsibilities rather than automatically applying to every subsidiary.
- Subsidiary-specific requirements. These address particular business processes, technologies, operating conditions, or regulatory obligations that do not apply uniformly across the group.
This distinction provides a practical foundation for governance. It helps prevent two common mistakes: allowing subsidiaries to disregard legitimate enterprise-wide requirements and imposing unnecessary uniformity where differences are justified.
Exceptions must be handled through a documented process. Each exception should identify the requirement involved, the reason for the deviation, the associated risk, the person or authority accepting that risk, any compensating measures, and the date for review.
A policy is not effective simply because it has been published. Management must also determine whether the policy is understood, implemented, monitored, and producing the intended result.
The broader lesson extends beyond information security. Finance, legal, compliance, human resources, technology, and operations can all benefit from distinguishing enterprise-wide requirements from legitimate local variations.
3. Build Communication Into the Governance Structure
Formal policies establish expectations, but productive relationships require communication.
A parent company cannot manage a diverse group effectively if its only interaction with subsidiaries consists of issuing directives, collecting compliance reports, and escalating failures.
Subsidiary managers need opportunities to explain operational realities, identify implementation problems, propose alternatives, and share practices that may benefit other entities. The parent, in turn, needs a reliable way to communicate priorities, explain the reasoning behind requirements, and understand emerging risks.
One practical mechanism is an enterprise council or working group that includes representatives from the parent and its subsidiaries.
In my information security work, establishing an Information Security Council was one of the initial initiatives for improving coordination. Such a council can provide a recurring forum for discussing priorities, aligning expectations, sharing knowledge, and coordinating decisions that affect multiple entities.
For this type of structure to work, its purpose and authority must be clear. Participants should understand which matters the council can decide, which require executive approval, and which are advisory.
Regular group-wide meetings should be supplemented by individual discussions with subsidiaries where business circumstances or risks warrant more detailed attention.
Communication should also work in both directions. Subsidiaries must have a defined way to raise concerns and request decisions without relying exclusively on informal relationships or personal influence.
The goal is to develop shared responsibility rather than mere compliance with instructions. A subsidiary that understands the purpose of a requirement and has participated appropriately in its implementation is better positioned to support the broader enterprise objective.
4. Coordinate Resources, Technology, and Shared Capabilities
Acquisitions frequently create overlapping capabilities. Different subsidiaries may purchase similar products, maintain separate service arrangements, or operate tools that provide inconsistent levels of protection or oversight.
Without an enterprise-wide view, the parent may not know what resources exist, whether they are being used effectively, or where significant gaps remain.
An inventory of tools, services, personnel, and capabilities is an important starting point.
In the information security environment, evaluating existing tools and services can reveal duplicated investments, unused products, incomplete implementations, inconsistent capabilities, and opportunities to improve visibility across the group.
However, centralization should not be an automatic objective.
Some capabilities may be more effective when delivered centrally or through shared services. Others may need to remain local because of business requirements, regulatory obligations, operational dependencies, or the need for immediate local decision-making.
The appropriate question is whether a particular arrangement improves business performance, risk management, consistency, or cost effectiveness.
A sound evaluation considers the total cost of ownership, operational effectiveness, implementation requirements, service dependencies, and the consequences of reducing local capabilities.
Shared services should have defined responsibilities, service expectations, reporting mechanisms, and accountability. Otherwise, centralization can merely transfer an existing problem to a different organizational unit.
The objective is not to centralize everything. It is to make informed decisions about which capabilities should be shared, which should be controlled centrally, and which should remain within individual subsidiaries.
5. Make Accountability Measurable
Governance requires evidence that responsibilities are being fulfilled.
A parent company should be able to determine whether subsidiaries are meeting applicable requirements, whether identified risks are being addressed, and whether investments are producing their intended benefits.
This requires defined responsibilities, measurable objectives, consistent reporting, and an appropriate review cycle.
Useful measures may include policy implementation, unresolved findings, remediation progress, outstanding exceptions, significant risk exposures, and the effectiveness of shared services.
The measures should be relevant to the decisions management needs to make. Collecting large volumes of information is not a substitute for meaningful oversight.
It is also important to distinguish between documented compliance and actual effectiveness. A subsidiary may have adopted a policy without implementing the necessary procedures or controls. A report may indicate that an activity is complete without establishing that the underlying risk has been reduced.
The parent needs sufficient information to evaluate both implementation and results.
Accountability must exist at both levels. The parent is responsible for establishing a workable framework, providing appropriate direction, resolving enterprise-level issues, and making decisions within its authority. Subsidiary management is responsible for executing its obligations, reporting accurately, addressing deficiencies, and escalating matters that require broader attention.
When accountability is clear and supported by evidence, governance becomes a management tool rather than an administrative exercise.
6. Recognize the Challenges of Integration
Even a well-designed framework takes time to implement.
Subsidiaries differ in maturity, staffing, technology, management practices, and available resources. A requirement that is relatively easy for one entity may be difficult for another. Local managers may also perceive group-wide standards as unnecessary interference with established operations.
Acquisition history creates additional complexity. Each newly acquired business may introduce another set of systems, policies, service providers, and assumptions about who has authority to make decisions.
These differences cannot be resolved simply by publishing a common policy.
Management must assess the starting position of each entity, identify material gaps, establish priorities, and determine an appropriate implementation path. Where immediate uniformity is impractical, a documented plan can establish interim safeguards, responsibilities, milestones, and a target state.
The parent must also distinguish between legitimate differences and avoidable noncompliance. Flexibility should not become an excuse for leaving significant risks unmanaged, and central authority should not become an excuse for ignoring local realities.
This is where communication, documented exceptions, risk assessment, and measurable accountability become especially important.
Experience also matters. What works in theory may require adjustment when applied across multiple countries, business models, and organizational cultures. Effective entity management is therefore an ongoing discipline, not a one-time integration project.
7. A Practical Model for Parent–Subsidiary Relationship Development
The principles described above can be organized into seven stages. Together, they provide a starting point for organizations seeking to improve their entity management environment.
Stage 1 — Assess the organization. Understand each subsidiary’s business objectives, governance structure, operational maturity, risk exposure, regulatory obligations, and existing capabilities.
Stage 2 — Define governance and decision rights. Establish what the parent controls, what subsidiaries control, which decisions are shared, and how disagreements or unresolved issues are escalated.
Stage 3 — Establish common requirements. Define group-wide policies, minimum standards, reporting expectations, and the circumstances in which local adaptation is permitted.
Stage 4 — Build communication and collaboration. Establish councils, recurring meetings, escalation channels, and opportunities for subsidiaries to influence decisions that affect their operations.
Stage 5 — Coordinate capabilities and investment. Evaluate which tools, services, resources, and expertise should be centralized, shared, or retained locally.
Stage 6 — Measure implementation and accountability. Monitor compliance, risk exposure, remediation, exceptions, performance, and the effectiveness of investments.
Stage 7 — Review and improve the relationship. Use results, experience, and feedback to refine governance, address gaps, and adapt to changes in the organization.
These stages are intended to be iterative rather than strictly sequential. Changes in business strategy, acquisitions, regulatory obligations, and risk exposure may require the organization to revisit earlier decisions.
The model also provides a practical basis for assessing progress. Rather than asking only whether policies exist, management can evaluate whether decision rights are understood, communication is functioning, responsibilities are being met, and the relationship is delivering measurable value.
Conclusion: Governance Is a Relationship, Not Just a Set of Rules
Effective parent–subsidiary management requires more than ownership, organizational charts, policies, and periodic reports. It requires a clearly defined working relationship that connects enterprise objectives with the responsibilities and operating realities of individual entities.
The parent must establish appropriate direction, minimum requirements, risk oversight, and accountability. Subsidiaries must retain the ability to manage their businesses while fulfilling their obligations to the broader organization. Both levels must communicate, resolve differences, and work toward common objectives.
My experience managing information security across 19 subsidiaries in 13 countries reinforced the practical importance of this challenge. Establishing a council, consolidating policies and standards, and evaluating shared capabilities provided concrete ways to address the complexities of a diverse corporate environment.
These initiatives also illustrate a broader principle: the methods used to manage information security can inform the design of parent–subsidiary relationships across many other corporate functions.
The central management challenge is to achieve consistency without unnecessary uniformity, oversight without needless interference, and autonomy without sacrificing accountability.
That balance does not happen automatically. It must be designed, communicated, documented, measured, and continually improved.
Coming Soon: A More Detailed Practitioner’s Paper
This preview introduces the principles behind an effective parent–subsidiary management environment. The forthcoming paper will expand on the practical experience, governance mechanisms, implementation considerations, and lessons learned from working within a multinational organization of independently operating subsidiaries.
Future material will explore how to define decision rights, establish enterprise-wide standards, manage exceptions, coordinate shared capabilities, measure accountability, and develop a productive working relationship between corporate leadership and subsidiary management.
The objective is to move beyond general governance concepts and examine the practical questions that corporate leaders, entity managers, risk professionals, and operating executives must address when managing complex corporate groups.
More to come: Additional analysis, practical examples, and recommendations for developing an effective, sustainable parent–subsidiary operating model.
This is an introductory preview of a work in progress. The detailed paper will distinguish firsthand experience and observations from broader recommendations and supporting research.