Governance Without a Boardroom

The reality

A founder runs a 35 person business at AED 17M (USD 4.6M) and has nobody who can ask "are you sure?" with consequence. The accountant signs the financials the founder hands over. The lawyer reviews the contracts the founder selects. The senior team reports up to the founder. Nobody sits across from the founder once a quarter and asks where the business is exposed, where the founder's judgment is showing strain, and what is not being said. The business is not ready for a formal board with paid non-executive directors and quarterly board packs. The business is also not safe being run with the founder as the only check on the founder's own thinking. Most UAE service founders skip this category entirely until a crisis (a regulatory issue, a major client loss, a senior departure) forces it. The cost of skipping is the cost of finding out the business needed governance only when something has already gone wrong.

Read this if

• The founder is the only person who reviews the founder's biggest decisions before they happen
• There is no quarterly forum where the financials, the operational risks, and the strategic direction are challenged by somebody who is not on the founder's payroll
• The senior team is competent but cannot challenge the founder because they report to the founder
• The founder cannot name three risks the business is currently carrying that nobody outside the founder's head has reviewed
• A regulatory inspection, audit, or due diligence event would expose gaps the founder has been carrying alone
• The business is at the size (15-50 people, AED 5M-50M (USD 1.4M-13.6M)) where a formal board feels heavy but the absence of any governance is starting to feel exposed

What success looks like

When light-touch governance is in place:

• The founder has a defined "governance group" of two or three people outside the founder's reporting line who review the business quarterly
• The quarterly governance review covers financials, operational risk, strategic direction, and the founder's own state
• The senior team has a path to surface concerns to the governance group without going through the founder
• The business has a written register of the top five risks, reviewed quarterly, with named owners and mitigations
• A continuity plan exists (who runs the business if the founder is unavailable for a month) and has been pressure-tested
• The founder can name the three things the governance group has surfaced in the last year that the founder would not have surfaced alone

The framework

Light-touch governance has four layers. None of them require a formal board. All of them require named people and a regular cadence.

Layer 1: The governance group

Two or three people outside the founder's reporting line who meet with the founder quarterly. The group can be: a senior advisor on retainer, a former operator from a similar industry, a fractional CFO who has the financial picture, a peer from another business at the next stage. The point is that the group has full visibility, asks hard questions, and is not paid by the founder for daily delivery.

The group is not a board. There is no fiduciary duty, no formal voting, no equity. The group's value is challenge, perspective, and the knowledge that the founder cannot keep avoiding hard topics for another quarter.

The behaviour to adopt this week: name the candidates for the group. Two to three names. Schedule the first quarterly review.

Layer 2: The quarterly review

A 90 minute meeting once a quarter. A standing agenda: 20 minutes on financials, 20 minutes on the risk register, 20 minutes on strategic direction (what was promised last quarter, what shipped, what did not), 20 minutes on the founder's own state (energy, focus, the one thing the founder is avoiding), 10 minutes on actions for the next quarter.

The meeting produces a one-page summary. The summary is shared with the senior team. The senior team understands that the governance group exists, what it reviews, and what came out of the last meeting.

The behaviour to adopt this week: write the standing agenda. Schedule the first quarterly meeting 60 days from now. Invite the candidates.

Layer 3: The risk register

A single page listing the top five to seven risks the business is currently carrying. Each risk has a name (loss of major client, founder incapacity, regulatory inspection, key person departure, cash flow squeeze), a likelihood rating, an impact rating, an owner, and a mitigation in progress.

The register is reviewed at every quarterly governance meeting. Risks that have been mitigated drop off. New risks are added. The founder's mental list of "things that could go wrong" becomes a written list with named owners.

The behaviour to adopt this week: write the first version. Five risks. Each with a name, an owner, and a sentence on the mitigation. The register is rough on the first draft. It improves quarterly.

Layer 4: The continuity plan

A written plan for what happens if the founder is unavailable for two weeks, four weeks, or three months. Two weeks: the cofounder or operations lead runs day-to-day operations under defined authorities. Four weeks: the governance group convenes weekly, the operations lead has expanded authority, key clients are informed. Three months: a defined succession plan kicks in.

The plan is shared with the senior team. The cofounder or operations lead has access to the bank accounts, the key contracts, and the client list under a defined trigger. The plan is pressure-tested at least once a year (the founder takes a two week trip with phone off, the team runs on the plan, the founder reviews what worked and what did not).

The behaviour to adopt this week: write the two week version. The four week and three month versions can wait until the next quarterly review.

A founder you might recognise

A founder runs a 38 person logistics business in Dubai South. AED 19M (USD 5.2M) last year. Through 2024 and 2025 he ran the business with no governance other than his cofounder. In Q4 2025 he had three things go wrong in one month: a major client moved to a competitor (he had not noticed the relationship cooling), a senior operations lead resigned (he had not seen the burnout), and a regulatory inspection found gaps (he had not maintained the documentation).

In Q1 2026 he set up a governance group of three: a former GCC logistics operator, a fractional CFO, and a peer founder from a parallel business at the next stage. The group met for the first time in February 2026 with a 90 minute quarterly review. The first risk register listed five risks (key client concentration, senior team burnout, regulatory documentation, founder bandwidth, cash flow seasonality). Each had an owner and a mitigation.

By the second quarterly meeting in May 2026, three of the five risks had been actively mitigated. The senior team had been briefed on the governance structure. The founder had run a two week phone-off trip in April using the continuity plan, and the operations lead had run the business cleanly. The cost of the governance group was AED 24,000 (USD 6,540) for the year, all in. The cost of not having it had been visible in Q4 2025.

Working through it

1. Name the governance group candidates. Two to three people outside the founder's reporting line. A senior advisor, a former operator, a fractional CFO, a peer founder. Reach out and propose the structure.

2. Schedule the first quarterly review. 90 minutes. 60 days out. Standing agenda: financials, risks, strategic direction, founder state, actions.

3. Write the first risk register. Five risks. Each with a name, owner, and mitigation. Rough is fine. The register improves with each review.

4. Write the two week continuity plan. Who runs day-to-day operations. Who has access to bank accounts and key contracts. How key clients are informed. The two week version is the minimum viable plan.

5. Brief the senior team. Senior team needs to know the governance group exists, what it reviews, and what came out of the last meeting. The team feeling the lift is part of the value of the structure.

Common mistakes

• Skipping governance because "we are not big enough yet." The right time for light-touch governance is at 15 to 50 people. Waiting until a formal board is needed means the business has already absorbed the cost of running without one for years.
• Treating the governance group as advisors. Advisors give input on questions the founder asks. The governance group asks the questions the founder is not asking. The roles are different and the seating is different.
• Building the structure and skipping the founder state agenda item. A governance review that does not check the founder's energy, focus, and avoidance is a review that misses the most important risk in the business.
• Writing the risk register and never reviewing it. A register that does not get updated quarterly becomes a museum piece. The review is what makes it operational.
• Skipping the continuity plan because "I am not going anywhere." Founder incapacity is the risk most underweighted by the founder. A two week test of the plan in a calm quarter is much cheaper than discovering the gaps in a crisis.

Self-assessment

Y or N for each.

1. Does the business have a named governance group of two to three people outside the founder's reporting line?
2. Is there a quarterly review with a standing agenda covering financials, risks, strategic direction, and founder state?
3. Is there a written risk register with the top five risks, owners, and mitigations, reviewed quarterly?
4. Is there a written continuity plan covering two weeks, four weeks, and three months of founder unavailability?
5. Has the continuity plan been pressure-tested at least once in the last year?
6. Has the senior team been briefed on the governance structure and what it produces?
7. Can the founder name three things the governance group has surfaced in the last year that the founder would not have surfaced alone?

Five or more "yes" answers means light-touch governance is doing the work it is supposed to do. Three or four is the band where the structure exists but the discipline has not taken hold. Two or fewer means the business is being run with the founder as the only check on the founder, and the next major surprise is the cost of finding out that was not enough.