Part 1 of Governance Beyond Compliance — building accountable leadership, resilient organisations and healthy cultures. First published on LinkedIn, 9 April 2026.
Seven governance vulnerabilities every board chair should know — and watch for
Key takeaways
- Governance failure in a small NFP rarely begins with bad intent — seven vulnerabilities can take hold without it.
- They range from role ambiguity and filtered board information to outsourcing, psychosocial risk, mission masking weak controls, and systematic staff attrition.
- The article closes with a practical checklist for board chairs.
There is a pattern I have observed across multiple not-for-profit organisations in Australia. It does not begin with fraud, negligence, or malicious intent. It begins with something far more ordinary — and far more dangerous.
It begins with ambiguity.
Ambiguous roles. Ambiguous accountability. Ambiguous escalation pathways. Ambiguous controls. Over time, ambiguity settles into culture. And once ambiguity becomes culture, governance stops being structural and starts being personal — dependent on who is in the room rather than on systems and documented obligations that function regardless of personality.
That is when institutions become fragile.
After four decades of working across NFP, faith-based, and educational organisations in Australia and internationally — including serving as Company Secretary under ACNC obligations — I have identified seven governance vulnerabilities that recur with remarkable consistency in small to medium Australian NFPs. None of them require bad intent to take hold. All of them are preventable.
1. Small size does not reduce governance duty
The ACNC’s governance standards are principles-based and scaled to the charity’s size and activities. But scaling to size does not mean exemption from accountability. Smallness may explain limited resourcing. It does not excuse the absence of accountability, lawful operation, or responsible financial management.
The board of a small NFP carries the same foundational duties as the board of a large one: act with reasonable care and diligence, act honestly and fairly in the charity’s best interests, disclose conflicts, and ensure the organisation’s affairs are managed responsibly. These duties do not diminish with headcount.
2. Role ambiguity is not a cosmetic problem
AICD guidance on NFP governance emphasises clear roles, clear delegations, and a clear separation between the board’s oversight function and management’s operational function. When that boundary blurs — when a CEO begins making governance decisions that belong to the board, or when a board chair begins managing staff — power becomes informal. Accountability weakens.
In a small NFP, role ambiguity is often tolerated because everyone knows and trusts each other. That trust is an asset. But it is not a substitute for documented delegations and clear boundaries. When the trusted person leaves, the ambiguity that trust was masking becomes immediately visible and immediately dangerous.
3. Boards can become dependent on filtered information
AICD guidance places a specific responsibility on the chair to ensure the board receives relevant, accurate, timely, and sufficient information — both financial and non-financial. In a small organisation, there are fewer formal reporting channels and a greater tendency to rely on a single management voice as the primary source of board intelligence.
The risk is that material issues — compliance exposure, staff concerns, financial stress, conduct matters — are filtered before they reach the board. The board cannot fulfil its duty if it is denied sight of material risk. The governing principle is institutional duty over managerial comfort.
4. Outsourcing can create false reassurance
Many small NFPs outsource critical functions — payroll, HR, IT, finance, legal compliance — to manage cost and access expertise. This is sensible. But outsourcing a function does not transfer the board’s accountability for that function.
Organisations that assume their outsourced provider is managing compliance on their behalf — without active board oversight of that assumption — are carrying risk they cannot see and therefore cannot manage.
5. Psychosocial risk is governance risk — not merely an HR issue
Safe Work Australia identifies poor organisational change management, lack of role clarity, and poor support as psychosocial hazards. PCBUs — which includes NFP organisations — must eliminate or minimise these risks so far as is reasonably practicable.
Boards that treat staff distress as a personality issue — rather than a psychosocial governance risk requiring active oversight — will find themselves managing the consequences of that misclassification long after the presenting symptoms first appeared. Psychological distress in a workforce is a governance signal. It deserves a governance response.
6. Mission can mask weak controls
Small NFPs often run on goodwill, commitment, and a genuine belief in the cause. These are strengths. But they can create a culture where governance weakness is tolerated for too long, because people trust each other and assume that commitment to purpose will compensate for the absence of documented processes and robust internal controls.
Weak delegations, poor records, and undocumented decision pathways are not less dangerous in a mission-driven organisation. They are more dangerous — because the culture that enables them is also the culture that makes them hardest to see and hardest to name.
7. Systematic staff attrition is an organisational failure
When staff turnover is high, persistent, and concentrated within a particular leadership tenure, it is tempting to frame the issue as a management style problem. That framing is insufficient. Systematic staff attrition implicates the board, the CEO, and the HR function simultaneously and in different ways.
The governance question for board chairs is not simply: why are people leaving? It is: do we have independent, unfiltered visibility into the pattern — and are we asking the right questions of the right people to get an honest answer?
What to watch for: a practical checklist for board chairs
The shortest synthesis of these seven vulnerabilities: watch for anything that makes the organisation less legible to its own board.
- Unclear role boundaries between chair, board, CEO, and managers — assumed rather than documented
- Delegations that exist in practice but not on paper
- Complaints or concerns handled personally rather than through a defined, logged pathway
- Board papers that are selective, late, or consistently reassuring without substantive evidence
- Outsourced critical functions without clear board visibility over access and obligations
- Overdependence on one or two people for institutional memory
- Staff voice absent from governance sightlines
- CEO using organisational size to justify non-compliance with WorkSafe, Fair Work, ACNC, or ASIC obligations
- Board lacking the knowledge or resolve to hold the CEO accountable to documented governance standards
None of these warning signs require bad intent to appear. They require only the accumulation of ambiguity over time — and a board culture that has not yet learned to name what it is seeing.
Dennis Chew is a Corporate Governance specialist, Company Secretary, and Director of Operations professional with forty years of experience across NFP, faith-based, educational, and corporate organisations in Australia, Malaysia, New Zealand, and Hong Kong.
Next: Part 2 — From Ambiguity to Architecture
All articles in Governance Beyond Compliance
Working through a governance challenge? Dennis is available for board and non-executive director roles, interim executive engagements and advisory conversations. Get in touch or see Governance & Leadership.