Corporate Governance, Accountability and the Board

Introduction and Context

Corporate governance is the system by which companies are directed, controlled and held accountable. It allocates authority among shareholders, the board of directors, executives, employees and other stakeholders, while establishing mechanisms for decision-making, supervision, transparency and remedy. Corporate compliance is one practical expression of governance: it translates legal duties, regulatory expectations and ethical standards into policies, controls and responsible conduct.

The board occupies the central position in this system. It does not normally manage every operational matter, but it remains responsible for the company’s direction, oversight and accountability. A board may delegate functions; it cannot simply delegate away its responsibility to exercise appropriate supervision. This distinction is fundamental to understanding corporate personality, fiduciary duties, committees, compliance officers and group-wide accountability.

This chapter uses general common-law and international governance principles. The precise rules vary by jurisdiction, company type, listing status and sector. Students should therefore consult the applicable companies legislation, securities rules, corporate governance code and case law in the relevant jurisdiction.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain separate corporate personality and its consequences for authority and liability.
2. Distinguish the powers of the company, the board, officers and agents.
3. Analyse directors’ fiduciary, statutory and care-based duties.
4. Explain valid delegation and the limits of delegated authority.
5. Evaluate the roles of the board, committees and senior compliance personnel.
6. Apply the three-lines model to compliance and risk oversight.
7. Assess independence, access and accountability requirements for compliance officers.
8. Analyse governance challenges in corporate groups, subsidiaries and parent companies.
9. Identify ethical weaknesses in governance arrangements and propose practical controls.

1. Corporate Personality and the Allocation of Authority

1.1 The company as a separate legal person

Incorporation creates a legal person distinct from its shareholders, directors and employees. The company can own property, enter contracts, incur debts, sue and be sued. Shareholders generally enjoy limited liability: their financial exposure is ordinarily limited to the amount unpaid on their shares or the amount they have agreed to contribute.

Separate personality produces several important consequences:

• Company property belongs to the company, not directly to shareholders or directors.
• Company debts are ordinarily not personal debts of directors or shareholders.
• The company continues despite changes in ownership or management.
• The company acts through human decision-makers and authorised agents.
• Corporate records, approvals and contracts must demonstrate that the company—not merely an individual—made the relevant decision.

Separate personality is not an absolute shield. Courts and regulators may impose personal liability where legislation provides for it, where a director commits a personal wrong, where a person gives a personal guarantee, or where the corporate form is used for fraud or evasion. The exceptional doctrine commonly described as “piercing” or “lifting” the corporate veil is jurisdiction-specific and should not be treated as a general remedy for poor management.

1.2 Corporate capacity and authority

A company’s constitutional documents and applicable legislation establish its legal capacity and governance arrangements. Authority concerns the power of a particular person or body to bind the company.

Three forms of authority are especially important:

An employee may have authority to negotiate but not sign. A chief executive may have authority to enter ordinary-course contracts but not dispose of a major asset. A compliance officer may investigate conduct but lack authority to waive a legal requirement. Internal limits are essential, but they may not always protect the company against an innocent third party who reasonably relies on apparent authority. The company may then have internal remedies against the unauthorised employee.

1.3 The board as the company’s governing organ

The board normally exercises the company’s central management and oversight powers, subject to legislation, the constitution, shareholder reservations and the limits of the company’s objects where those remain legally relevant. Shareholders own shares; they do not ordinarily manage the company’s daily affairs. Shareholder approval is required for matters specified by law or constitutional arrangements, such as certain major transactions, changes to capital or amendments to constitutional documents.

A sound authority framework should identify:

• matters reserved to shareholders;
• matters reserved to the board;
• matters delegated to committees;
• matters delegated to management;
• signature and approval thresholds;
• escalation requirements;
• reporting and record-keeping duties.

A delegation matrix is useful, but it should not be confused with a substitute for judgment. Authority should be accompanied by competence, information, resources and accountability.

2. Directors’ Duties and Accountability

Directors occupy a position of trust and influence. Their duties arise from statute, common law, equity, the company’s constitution, listing rules, sector regulation and general principles of ethical conduct. Although terminology differs between jurisdictions, the following duties are widely recognised.

2.1 Duty to act within powers

Directors must use their powers for proper purposes and within the authority granted by law and the constitution. A decision may be invalid or expose directors to liability if a power is used for an ulterior purpose—for example, issuing shares primarily to manipulate voting control rather than to raise capital legitimately.

This duty has two dimensions: the director must possess the relevant power, and the power must be used for the purpose for which it was conferred. Good intentions do not automatically cure misuse of power.

2.2 Duty to act in the company’s interests

Directors must act in good faith in what they honestly regard as the company’s interests. The company’s interests are not necessarily identical to the immediate interests of a dominant shareholder, a director, a lender or management. Depending on the legal framework, directors may also be required to consider long-term consequences, employees, creditors, customers, environmental effects and other stakeholder interests.

The duty is collective and individual. A director should not passively support a decision merely because the majority favours it. Each director must bring an independent mind to board deliberations, while respecting valid collective decisions once made.

2.3 Duty to avoid conflicts of interest

A conflict occurs when personal, family, financial or other interests may interfere with objective corporate judgment. Conflicts may be actual, potential or perceived. Examples include:

• awarding a contract to a company owned by a director’s relative;
• using confidential corporate information for personal investment;
• serving on boards of competing companies;
• receiving gifts or benefits from a supplier;
• pursuing a corporate opportunity personally.

Effective conflict management requires prompt disclosure, recording in minutes or a conflicts register, independent evaluation, and—where appropriate—withdrawal from discussion and voting. Disclosure alone may be insufficient where the conflict is severe.

2.4 Duty not to make unauthorised profits

A director must not exploit the office for undisclosed personal gain. The rule may apply even where the company could not itself have taken the opportunity, and even where the company suffers no measurable loss. The justification is preventative: fiduciaries should not be placed in a position where personal interest conflicts with duty.

Remedies may include repayment of profits, compensation, rescission of a transaction, injunctions, disqualification or regulatory sanctions. The availability of relief for properly authorised conduct depends on local law and the quality of disclosure and approval.

2.5 Duty of care, skill and diligence

Modern standards usually combine an objective element—the care reasonably expected from a person performing the role—with a subjective element reflecting the director’s actual knowledge, experience and expertise. A financial expert, for instance, may be expected to identify accounting warning signs that a non-specialist might not recognise.

The duty does not require directors to predict every failure or become experts in every subject. It does require informed oversight. Directors should read materials, ask questions, challenge unexplained assumptions, understand major risks and obtain independent advice where appropriate.

2.6 Duty to exercise independent judgment

Directors may consider advice and shareholder wishes, but they should not surrender their judgment. Automatic approval of management proposals, failure to read board papers and dependence on a dominant director may constitute governance failures. Independent judgment does not mean opposition for its own sake; it means reasoned evaluation.

2.7 Accountability for corporate misconduct

Directors may face consequences through several channels:

• civil claims by the company or shareholders;
• regulatory enforcement;
• criminal liability under specific legislation;
• disqualification from directorship;
• employment or professional sanctions;
• reputational and market consequences.

Board accountability is strengthened by accurate minutes, documented challenge, appropriate dissent, timely escalation and a clear audit trail showing how conclusions were reached.

3. Delegation Without Abdication

Boards cannot perform every operational task. Delegation is therefore necessary. It enables specialised committees and executives to act efficiently while allowing the board to focus on strategy, risk and oversight.

A valid delegation normally requires:

1. a lawful source of power to delegate;
2. a clearly defined mandate;
3. a competent delegate;
4. appropriate resources and information;
5. reporting and escalation arrangements;
6. monitoring by the delegating body;
7. periodic review of the delegation.

The board should distinguish between delegation of execution and delegation of judgment. Management may prepare a compliance programme; the board may remain responsible for approving the risk appetite and monitoring whether the programme is effective. A committee may review financial reporting; the full board may retain responsibility for the integrity of published accounts.

A useful principle is: delegation transfers authority to act, but oversight responsibility remains with the delegating body unless the law expressly provides otherwise. The board should not approve a delegation merely because it is convenient. It should assess whether the delegate has independence, competence and access to information.

Delegations should be documented in terms of reference or written mandates. These should specify purpose, scope, decision rights, reserved matters, reporting frequency, quorum, conflicts procedures, records and termination. “The committee may deal with compliance” is too vague to create reliable accountability.

4. Board Oversight and Committee Architecture

4.1 Core board responsibilities

Although governance codes differ, boards commonly oversee:

• strategy and business objectives;
• corporate purpose and ethical culture;
• risk appetite and principal risks;
• financial reporting and internal controls;
• legal and regulatory compliance;
• executive appointment, remuneration and succession;
• information security and resilience;
• stakeholder and sustainability matters;
• crisis management and significant transactions.

Oversight requires more than receiving reports. A board should assess whether information is timely, accurate, sufficiently independent and capable of revealing bad news. A dashboard showing only green indicators may demonstrate reporting weakness rather than organisational health.

4.2 Common board committees

Committees support the board; they do not eliminate the board’s accountability. Committee reports should identify matters considered, unresolved concerns, dissent, management responses and matters requiring full-board attention.

4.3 Information quality and board challenge

Board information should be relevant, balanced and comprehensible. Effective papers identify the decision required, legal constraints, assumptions, alternatives, risks, affected stakeholders and proposed controls. Directors should be cautious about “paper compliance,” where a large volume of material obscures rather than improves understanding.

A practical board question is: What information would we expect to receive if this control were failing? This encourages attention to negative indicators, near misses, whistleblowing, customer complaints, overdue remediation and regulatory correspondence.

5. The Three-Lines Model

The three-lines model clarifies how responsibilities for governance, risk and control are distributed. It is a model of roles, not a rigid organisational chart.

First line: management and operational control

Operational managers own risks arising from their activities. They design and operate procedures, authorise transactions, train staff and correct failures. The first line cannot transfer ownership of operational risk to compliance or internal audit.

Second line: risk, compliance and specialist oversight

Second-line functions develop frameworks, advise management, monitor compliance, test selected controls and escalate concerns. They may include legal, compliance, risk, information security, data protection and health and safety functions. Their role is oversight and challenge, but they should not routinely perform the operational activities they are expected to monitor.

Third line: internal audit

Internal audit provides independent and objective assurance on governance, risk management and controls. It evaluates whether the first and second lines are designed and operating effectively. Internal audit should have unrestricted access to records, personnel and the audit committee, subject to lawful confidentiality constraints.

The board and executive management sit above these lines as governing and directing bodies. External assurance providers, regulators and stakeholders remain outside the model but may provide additional assurance.

A common failure is role confusion. If compliance designs a procedure, approves every transaction under that procedure and later assures the board that the procedure works, its independence is compromised. Conversely, internal audit should not assume management responsibility for fixing controls.

6. Compliance Officer Independence and Accountability

A compliance officer must be sufficiently independent to report inconvenient information. Independence does not mean isolation from management; it means freedom from improper influence and clarity about the officer’s mandate.

Important safeguards include:

• direct or functionally direct access to the board or an appropriate committee;
• a documented reporting line to a senior executive and a board committee;
• authority to investigate and obtain relevant information;
• protection from retaliation;
• adequate budget, staffing and expertise;
• involvement in significant regulatory and product decisions;
• private meetings with non-executive directors;
• transparent appointment, evaluation and removal processes;
• a duty to escalate material concerns.

The officer is accountable for performing the compliance role competently, maintaining accurate records, protecting confidential information and escalating significant breaches. The officer is not personally responsible for every violation committed by the organisation merely because the title exists. Personal liability depends on applicable law, the person’s actual conduct, knowledge, participation and failure to discharge a specific duty.

Independence can be weakened by compensation controlled entirely by business units, unclear reporting, exclusion from strategic decisions, inadequate resources or a culture that treats compliance as a barrier to commercial success. The board should periodically assess whether the compliance function can challenge senior management in practice, not merely on paper.

7. Corporate Groups and Cross-Entity Accountability

A corporate group may contain a parent company, subsidiaries, associates, joint ventures and special-purpose entities. Each incorporated company is generally a separate legal person. Group structure therefore does not automatically make the parent liable for every subsidiary obligation.

Nevertheless, group governance creates substantial practical and legal risks. A parent may exercise strong control over finance, technology, human resources, compliance or branding. It may issue group policies, appoint directors or require central reporting. Such control can create expectations that the parent has assumed responsibility, especially where it gives advice, supervises a dangerous activity or publicly represents that group-wide controls exist.

Group compliance should address:

• which entity owns each legal obligation;
• whether a group policy is mandatory or guidance only;
• local legal differences and conflicts of law;
• data transfer and confidentiality constraints;
• reporting from subsidiaries to the parent;
• escalation of subsidiary breaches;
• board composition and reserved matters;
• related-party transactions;
• intercompany services and pricing;
• investigations and document preservation.

A group policy should not obscure legal responsibility. Each subsidiary board must understand its own duties and retain sufficient authority to comply with local law. “The parent approved it” is not necessarily a defence for a subsidiary director.

Parent companies should avoid creating a false assurance environment. If a parent advertises a unified compliance system, but does not provide resources, monitoring or escalation, the gap between representation and reality can increase litigation, regulatory and reputational exposure.

8. Ethics, Culture and Speak-Up Governance

Formal controls cannot replace ethical culture. Culture concerns the behaviours that are rewarded, tolerated and punished. A company may have an extensive code of conduct yet still encourage misconduct through unrealistic sales targets, retaliation against whistleblowers or bonuses linked exclusively to short-term results.

Board oversight of culture may include analysis of:

• whistleblowing volumes and substantiation rates;
• employee-survey results;
• staff turnover in high-risk functions;
• disciplinary consistency;
• customer complaints;
• repeat control failures;
• override and exception data;
• regulatory findings;
• incentive structures.

Low reports do not necessarily demonstrate an ethical culture. They may indicate fear, lack of awareness or lack of trust. A speak-up system should offer confidentiality, multiple reporting channels, impartial investigation, anti-retaliation protection and feedback where legally permissible.

Ethical governance requires attention to conflicts between legality and legitimacy. A transaction may be technically lawful but inconsistent with fairness, transparency or the organisation’s stated values. Boards should ask not only “Can we do this?” but also “Should we do this, and can we explain it honestly to affected stakeholders?”

9. Technology and AI in Governance

Technology can strengthen governance through automated monitoring, regulatory change management, access controls, continuous auditing and data analytics. Artificial intelligence may help identify unusual transactions, conflicts, bribery indicators or inconsistent disclosures.

However, technology creates new accountability questions. Boards should understand:

• the source and quality of training or operational data;
• false positives and false negatives;
• explainability and documentation;
• human review and override controls;
• privacy and data-protection obligations;
• cybersecurity and model manipulation;
• responsibility for vendor systems;
• records supporting regulatory decisions.

An algorithm does not become accountable merely because it is sophisticated. A human governance owner should be identified, the system’s intended use documented and material decisions subject to proportionate review. AI may support compliance judgment but should not silently replace legal analysis or board responsibility.

10. Illustrative Case: Meridian Foods Group

Background

Meridian Foods Group consists of a listed parent company and a wholly owned subsidiary, Meridian Imports Ltd. The parent’s board approves a group anti-bribery policy. The subsidiary operates in a country where customs delays are common. Its commercial director instructs a local agent to make “facilitation payments” to customs officials. The subsidiary compliance manager raises concerns but reports to the commercial director, who controls the manager’s salary and performance evaluation.

The parent receives quarterly compliance reports stating that no material breaches have occurred. The reports are prepared by the subsidiary’s finance department and are not independently tested. The parent audit committee assumes that the group policy is operating effectively.

Problem

A journalist later publishes evidence of payments. The subsidiary claims that the parent is responsible because the parent imposed the group policy. The parent argues that the subsidiary is a separate legal person and that the parent board did not know about the payments.

Analysis

Separate personality means the subsidiary and parent are distinct entities, but it does not resolve all issues. The parent may face exposure depending on applicable anti-bribery laws, evidence of control, representations made to regulators and the adequacy of its supervision. The subsidiary’s directors may have breached duties by authorising or tolerating improper payments. The commercial director may have acted outside internal authority, but that does not necessarily prevent liability to third parties or regulators.

The compliance function was structurally weak. Reporting to the commercial director created a conflict because the officer was expected to challenge the same executive who controlled employment conditions. The quarterly certification process tested paperwork rather than effectiveness. The parent audit committee failed to ask how the conclusion had been reached and whether local management had incentives to suppress bad news.

Approach and solution

The group should:

1. preserve documents and conduct an independent investigation;
2. protect the compliance manager and provide direct access to the parent audit or compliance committee;
3. suspend or review the agent relationship and relevant payments;
4. assess self-reporting and remediation duties under applicable law;
5. test high-risk subsidiaries through independent monitoring;
6. revise group policies to state entity ownership, minimum standards and escalation rules;
7. review incentive systems and disciplinary consistency;
8. provide board training on group compliance and anti-bribery risk;
9. establish risk-based testing rather than relying on self-certification;
10. report material findings to both the subsidiary and parent boards.

Outcome

For this illustrative case, assume the investigation confirms repeated payments and concealment by management. The parent replaces the local compliance reporting line, disciplines responsible executives, terminates the agent, reports to relevant authorities where required and introduces independent testing. The parent board also records that group oversight does not replace subsidiary directors’ duties, while recognising that the parent must monitor risks created by its own group-wide representations and systems.

Learning points

The case demonstrates that separate legal personality is not a substitute for governance. Effective group compliance requires clear responsibility, independent escalation, reliable information and active board challenge. It also shows why a compliance officer’s formal title is inadequate if practical independence is absent.

11. Governance Challenges and Best Practices

Common challenges

• excessive concentration of authority in a dominant executive;
• passive or poorly informed directors;
• unclear delegation and committee mandates;
• conflicts of interest that are disclosed but not managed;
• compliance functions without resources or independence;
• fragmented group structures;
• misleading “zero breach” certifications;
• excessive reliance on dashboards and automated tools;
• incentives that reward results without regard to conduct;
• failure to investigate near misses.

Recommended practices

A mature governance system should:

1. maintain an authority and responsibility map;
2. review board and committee terms of reference annually;
3. document conflicts and recusals;
4. provide directors with targeted legal and risk training;
5. require management to identify limitations and uncertainty in reports;
6. preserve direct access from compliance and internal audit to independent directors;
7. use risk-based compliance testing;
8. align incentives with ethical and sustainable performance;
9. evaluate subsidiaries according to local risk rather than uniform paperwork;
10. record decisions, dissent and follow-up actions;
11. test whistleblowing and investigation processes;
12. review whether remediation is completed and effective.

Chapter Summary

Corporate governance allocates authority, responsibility and accountability across the company. Separate corporate personality protects the distinction between the company and the people connected with it, but it does not excuse personal wrongdoing, breach of duty or failures imposed by legislation. The board governs through informed judgment, supervision and lawful delegation.

Directors must act within powers, pursue proper purposes, avoid conflicts, protect corporate interests, exercise independent judgment and apply appropriate care, skill and diligence. Delegation is necessary but does not normally eliminate the board’s oversight responsibility. Committees assist the board, while the three-lines model separates operational ownership, specialist oversight and independent assurance.

Compliance officers require practical independence, resources, access and protection from retaliation. In corporate groups, each entity remains legally distinct, yet parent companies and subsidiary boards must address the risks created by control, representations and shared systems. Ethical culture, speak-up arrangements, reliable information and responsible technology are essential to accountability. Effective governance is therefore not merely a structure of documents; it is a continuing practice of informed challenge, transparent escalation and responsible decision-making.

Key Terms

Separate corporate personality: The legal identity of a company as distinct from its shareholders, directors and employees.

Limited liability: The principle that shareholders’ liability is generally limited to their agreed contribution.

Actual authority: Authority expressly or impliedly given to an agent by the company.

Apparent authority: Authority that the company represents to outsiders as existing.

Fiduciary duty: A duty arising from a relationship of trust, loyalty and confidence.

Proper purpose: The legally appropriate purpose for which a corporate power is exercised.

Conflict of interest: A situation in which personal interests may interfere with objective corporate judgment.

Corporate opportunity: A business opportunity connected with the company that a fiduciary may be prohibited from exploiting personally.

Duty of care: The obligation to exercise appropriate competence, diligence and attention.

Delegation: The transfer of authority to another person or body to perform specified functions.

Reserved matter: A decision that cannot be delegated and must be taken by a specified governing body.

Board committee: A smaller board-created body assigned defined oversight responsibilities.

Three-lines model: A framework distinguishing operational management, specialist oversight and independent assurance.

Compliance function: A function that advises, monitors and escalates legal and regulatory risk.

Internal audit: An independent assurance function evaluating governance, risk management and controls.

Corporate group: A parent company and one or more legally distinct related entities.

Whistleblowing: Reporting suspected wrongdoing through an internal or external reporting channel.

Risk appetite: The level and type of risk an organisation is willing to accept in pursuing objectives.

Accountability: The obligation to explain decisions, accept responsibility and face consequences where appropriate.

Ethical culture: Shared organisational expectations about acceptable conduct and responsible decision-making.

Review Questions

Short Answer Questions

1. What is meant by separate corporate personality?
2. Distinguish actual authority from apparent authority.
3. Why does delegation not normally eliminate board oversight responsibility?
4. What is the principal role of internal audit in the three-lines model?
5. Identify two safeguards supporting compliance officer independence.

Long Answer Questions

1. Explain the principal fiduciary and care-based duties of directors and illustrate how they may be breached.
2. Discuss how a board should design and monitor an effective delegation framework.
3. Compare the functions of the audit committee, risk committee and compliance function.
4. Explain the legal and governance challenges created by parent–subsidiary relationships.
5. Evaluate the relationship between ethical culture, incentives and corporate accountability.

Analytical / Application Questions

1. A director approves a contract with a company owned by a close relative but says the price is commercially reasonable. Analyse the governance and legal issues, including disclosure, recusal and possible remedies.
2. A compliance officer reports to the chief commercial officer and is excluded from board meetings. Assess the weaknesses in this arrangement and propose a revised reporting structure.
3. A parent company introduces a group-wide AI system to monitor bribery risks, but subsidiaries cannot explain its alerts or data sources. Advise the board on accountability, assurance, privacy and human oversight.

Multiple Choice Questions with Answers

Question 1

Which statement best describes separate corporate personality?

A. Company property is owned directly by shareholders.

B. The company is a legal person distinct from its shareholders and directors.

C. Directors are automatically liable for all company debts.

D. A company cannot sue or be sued in its own name.

Correct Answer: B. The company is a legal person distinct from its shareholders and directors.

Question 2

Which example most clearly illustrates apparent authority?

A. A director receives a private instruction from a shareholder.

B. An employee acts secretly outside all assigned duties.

C. The company presents a manager as authorised to contract, and an outsider reasonably relies on that representation.

D. A committee discusses a matter but reaches no decision.

Correct Answer: C. The company presents a manager as authorised to contract, and an outsider reasonably relies on that representation.

Question 3

What is the best description of the board’s responsibility after delegating a function?

A. The board has no further responsibility.

B. The board retains appropriate oversight and monitoring responsibility.

C. The delegate automatically becomes a director.

D. The delegation is valid only if shareholders manage the function.

Correct Answer: B. The board retains appropriate oversight and monitoring responsibility.

Question 4

Which is a core feature of a fiduciary conflict-of-interest rule?

A. Conflicts are acceptable if they are profitable.

B. Disclosure is never relevant.

C. Personal interests must not improperly interfere with corporate judgment.

D. Only criminal conflicts require management.

Correct Answer: C. Personal interests must not improperly interfere with corporate judgment.

Question 5

In the three-lines model, operational managers primarily belong to which line?

A. First line

B. Second line

C. Third line

D. External assurance line

Correct Answer: A. First line

Question 6

What is the principal role of internal audit in the three-lines model?

A. To own all operational risks

B. To provide independent and objective assurance

C. To approve every management transaction

D. To replace the board

Correct Answer: B. To provide independent and objective assurance

Question 7

Which arrangement most supports compliance officer independence?

A. Salary and promotion controlled solely by the sales director

B. No access to records or employees

C. Direct or functional access to an appropriate board committee

D. A prohibition on escalating concerns

Correct Answer: C. Direct or functional access to an appropriate board committee

Question 8

Which statement about a corporate group is generally correct?

A. A parent and subsidiary are always one legal person.

B. Subsidiary directors have no independent duties.

C. Each incorporated entity is generally legally distinct, although control may create governance and legal risks.

D. Group policies eliminate all local legal requirements.

Correct Answer: C. Each incorporated entity is generally legally distinct, although control may create governance and legal risks.

Question 9

Which board practice best improves the quality of compliance oversight?

A. Accepting all management reports without challenge

B. Focusing only on the absence of reported breaches

C. Requesting evidence of testing, limitations, near misses and unresolved issues

D. Delegating all compliance decisions without monitoring

Correct Answer: C. Requesting evidence of testing, limitations, near misses and unresolved issues

Question 10

Why can an AI compliance system not replace governance accountability?

A. AI systems cannot process any compliance data.

B. The system itself becomes the legal director.

C. Human owners remain responsible for appropriate use, oversight, explainability and escalation.

D. Automated systems are always unlawful.

Correct Answer: C. Human owners remain responsible for appropriate use, oversight, explainability and escalation.