The first three posts in this series worked through the architecture of the Enterprise Readiness Operating Model™ itself: how value lives inside structure, how discipline keeps that structure functioning, and how decisions actually move through an organization once judgment is required. This post begins the second phase of the series, which examines the ten enterprise domains where that model is applied in practice. Governance is the first domain, and it earns that position because every other domain depends on it.
Most GovCon owners already have a compliance function. Contracts require it, and the firms that survive their first few years of federal work have usually built reasonably strong systems for meeting external reporting and audit obligations. Governance is a different question. Compliance tells you what the rules are. Governance determines who runs the organization when you are not the answer to every question.
Compliance tells you what the rules are. Governance determines who runs the organization when you are not the answer to every question.
What Governance Actually Includes
In many founder-led GovCon businesses, governance exists, but it resides in one person rather than within the organization. The founder knows which decisions require their sign-off and which do not, even though that boundary was never written down. The founder remembers why a particular client relationship gets handled a certain way, even though no policy documents the reasoning. That arrangement can work well for years. It stops working the moment the founder is unavailable, whether because of a health event, a competing priority, or simply the ordinary demands of running a growing company.
A mature governance domain covers more ground than most owners initially expect, and it is worth walking through each piece individually rather than treating governance as a single checkbox.
Board or Advisory Structure
The first question is whether the business has any outside governance input at all. Many founder-led GovCon companies have none, or an informal group of trusted contacts the owner calls when something feels important, with no defined role, meeting cadence, or expectation of candor. That is different from a formal board or advisory board, where an outside perspective is built into the business’s operating rhythm rather than summoned only when the owner already suspects something is wrong. A real advisory structure gives major decisions a venue to be tested before they are executed, not just explained afterward. This does not require a large or expensive board. It requires a defined group with a defined purpose that meets on a defined schedule.
Decision Rights and Authority Matrix
Every business has an implicit answer to who can approve what, and in most founder-led companies that answer lives entirely in the owner’s head. A written authority matrix makes the implicit explicit: which roles can approve which categories of spending or commitments, and at what dollar threshold the decision must escalate. Without it, every decision defaults to the owner regardless of size, which slows the business down and quietly signals to leadership that they are not actually trusted to run their own areas. With it, the organization can keep moving when the owner is unavailable, because authority does not disappear along with the person who usually held it.
Corporate Documents and Formalities
Some owners assume their corporate documents are in order because they were drafted correctly at formation. Bylaws, operating agreements, a current cap table, and the minutes or resolutions that are supposed to reflect major company decisions often have not been touched since. The gap between what the documents say and how the business actually operates widens every year it goes unreviewed. This matters more than it appears on the surface because these documents are usually the first thing an outside party asks to see, whether that party is a bank, an investor, an acquirer, or a court. Documents that reflect decisions everyone remembers making are not the same as documents that were actually updated when those decisions were made.
Delegation of Authority in Writing
Leadership below the owner needs to know what they are actually empowered to decide, and in the absence of a written delegation, they typically default to guessing based on how the owner has reacted to similar situations in the past. That guessing produces two failure patterns, both of which are costly. Some leaders escalate everything, out of caution, which defeats the purpose of having leadership at all. Others act beyond their real authority, out of confidence, which creates exposure the owner does not discover until after the fact. Formal delegation converts the owner’s trust in their leadership team into an operating structure that others can actually rely on, rather than a private understanding whose boundaries only the owner fully knows.
Succession and Continuity Planning
Succession is usually framed as a question about the eventual sale of the business, but the more immediate version is far simpler: what happens to decision-making authority if the owner is unreachable for a week? A surprising number of GovCon businesses have no answer to that question, even though it has nothing to do with a transaction and everything to do with an owner taking a vacation, recovering from a medical procedure, or simply being on a plane during a moment when a client needs an answer. Continuity planning at this level is not dramatic. It is the practical work of naming who acts and with what authority when the person who usually decides is unavailable.
Policy Infrastructure
Most GovCon businesses have a reasonably well-developed set of policies written to satisfy a contracting officer, an auditor, or a DCAA reviewer. Far fewer have a comparable set of policies governing how the company actually makes internal decisions day-to-day. These are different bodies of work. A compliance policy exists to demonstrate that the business meets external requirements. Internal policy exists to provide leadership with a consistent basis for how decisions are made, escalated, and resolved, regardless of who happens to be in the room when a question comes up.
Ethics and Conflict-of-Interest Governance
This piece carries more weight in GovCon than in almost any other industry, given how directly organizational conflicts of interest, personal relationships with contracting officers, and outside business interests can affect both contract eligibility and enterprise value. A business without formal ethics and conflict-of-interest governance relies on the owner’s personal judgment to catch every situation in which a relationship or outside interest could compromise a contract or a bid. That judgment may be sound today. It is not a system, and it does not transfer to the next person who runs the company.
Reporting and Oversight Cadence
A leadership team can meet every week and still lack real governance discipline if nothing discussed in those meetings is documented or followed through to resolution. Cadence on its own is just a calendar habit. What makes cadence part of governance is its connection to accountability: a decision raised in a meeting should have an owner, a deadline, and a record of whether it actually happened. Without that connection, regular meetings create the appearance of oversight without the substance.
What Weak Governance Costs
A business can operate profitably for years with weak governance and show no visible symptoms because the founder compensates for the gap simply by being present and the person everyone eventually checks with. The cost shows up later: during a period of rapid growth that outpaces the founder’s personal capacity, during a health event or extended absence, or during a due diligence process where a buyer’s advisors ask a direct question the company has never had to answer in writing, such as who has authority to bind the company to a contract above a certain size. What felt like ordinary internal operating flexibility reads as an undocumented risk from the outside. Buyers discount for it. Successors inherit it as confusion rather than clarity. And the founder who built the company through judgment and presence often does not see the gap, because they have always been the mechanism that closed it.
This series will work through the remaining nine domains one at a time, examining how structure, discipline, and decision flow each show up within them. Governance had to come first because every other domain depends on a layer that defines who actually has the authority to decide. The next post moves to the domain most GovCon owners already sense is fragile even when they cannot fully name why: People.
This post is part of Building the Transferable Enterprise, a 13-part series working through the Enterprise Readiness Operating Model domain by domain.
