Drama in the boardroom: When board governance goes wrong

What The Traitors can teach Guernsey boards about compliance reports and management information (MI).

Anyone who has watched The Traitors knows how it goes. The clues are on the table, the faithful are in the room, and the traitor still survives because nobody asks the right question.

Boardrooms work the same way. Your compliance report is all green. Your board signs it off in five minutes. So why are regulators still issuing fines?

Board governance failures rarely begin with a scandal. They begin with a nod. In this article we look specifically at Guernsey in terms of what the regulator, the Guernsey Financial Services Commission (GFSC), expects of boards, how bias and complacency creeps in, and how a simple sniff test can keep your board on the right side of the regulator.

What the regulator expects from Guernsey boards

The Guernsey regulator's Finance Sector Code of Corporate Governance (Code) is clear: compliance with the Code 'must be owned by the board and senior management and cannot be delegated'.

Under the GFSC's Fiduciary Rules and Guidance 2021 (Rules), the board must ensure effective policies, procedures and controls, supervise staff, keep responsibility for outsourced functions at all times and evaluate its compliance with the Code.

The 'four-eyes' criterion raises the bar. At least two people must genuinely direct the business, and both must be able to 'detect and resist any imprudence, dishonesty or other irregularities'.

On financial crime, the Money Laundering Compliance Officer (MLCO) monitors and reports, but ultimate responsibility stays with the board. A compliance report is a tool for oversight, not a transfer of responsibility.

Unconscious bias and complacency in the boardroom

• Confirmation bias: Good news gets airtime; warning signs get skimmed.
• Authority bias: The board defers to a trusted compliance officer, provider or consultant, and stops testing.
• Group think: As at the round table, everyone votes with the room because nobody wants to be the lone challenger.
• Green dashboard complacency: Green ratings may mean testing has stopped, not that controls work.
• Normalised repeat findings: The same issues return each year and start to feel routine.
• Remediation fatigue: Once a project is 'largely complete', nobody asks whether the fix worked.

The regulators judges what the board did with the information in front of it. Receiving a report is not oversight.

Faithful or traitor? The sniff test for compliance reports and MI

The traitors in this story are rarely people. They are pieces of information that look trustworthy but mislead: a green rating with no testing behind it, a backlog figure that leaves out high-risk clients, or remediation that has never been retested.

Faithful information is accurate, complete and backed by evidence. Before accepting any report, ask:

• Does it smell too good? If everything is green, what was tested and what was not?
• Does the story add up? Does it match last quarter and the regulator's last visit?
• Who says so, and how do they know? Is the conclusion based on independent testing or self-assessment?
• What is missing? Traitors hide in exceptions, overdue reviews and repeat findings.
• Would it survive the round table? Could it stand up if a regulator questioned it line by line?

Unlike the TV show, you do not get to wait for the final episode. In regulation, the reveal comes in an enforcement notice.

Guernsey enforcement: What board governance failures cost

Guernsey's regulator, the GFSC, draws its powers mainly from the Financial Services Business (Enforcement Powers) (Bailiwick of Guernsey) Law, 2020, and the sector laws (see the enforcement powers overview). Its published public statements share one theme: boards had the information and did not act on it.

• Artemis Trustees Limited (24 June 2022): A £450,000 penalty for serious, systemic failings, including ignoring red flags and adverse media, with file review actions outstanding since 2016.
• Mr Robert Archibald Gilchrist Sinclair (20 January 2022): A personal penalty of £196,000 and a 5.6-year ban from acting as a controller, director, partner, manager, MLRO or MLCO.
• Equiom (Guernsey) Limited (19 July 2024): A £455,000 penalty  with aggravating factors including a revolving-door board with the firm appointing 20 directors and having 20 directors resign in just over a five year period, so nobody owned the remediation required after regulatory visits in 2017 and 2021[RP1.1][RG1.2].
• Fides Corporate Services Limited (28 February 2024): Aggravating factors including where the firm 'took a tick-box approach to reviewing compliance', and advice from consultants and compliance staff was 'not adequately considered and acted upon'.

The clues were on the table. The boards had them. The failure to challenge and act is what led to enforcement.

Round-table questions every Guernsey board should ask

1. What did compliance monitoring test this period, and what did it not test?
2. Which findings are repeats, and why did the last fix fail?
3. Has 'completed' remediation been retested?
4. How big is the periodic review backlog, and how much is high risk?
5. Is our MI consistent across committees, and does it show trends?
6. How have we independently checked what our outsourced providers tell us?
7. Is compliance properly resourced, with direct access to the board?
8. Would our minutes show a regulator what we challenged and decided?

Red flags that a traitor is hiding in your board pack

• Reports are 'noted' with no questions minuted.
• The same findings keep coming back.
• MI is mostly narrative, with little consistent data.
• Outsourced or group functions go unchecked.
• Director turnover means no one owns remediation.
• The breaches register is suspiciously short.

Key takeaways for Guernsey boards

• Compliance belongs to the board. It cannot be delegated.
• Regulators want proof that the board challenged compliance reports and MI, not just that it received them.
• Like the faithful at the round table, boards find the truth by asking good questions and applying a sniff test.
• Directors can be fined and banned personally.

How the Collas Crill Regulatory and Compliance team can help Guernsey boards

• Review board effectiveness against the Guernsey Code of Corporate Governance.
• Sharpen compliance reporting and MI so board packs surface key risks and repeat findings.
• Test compliance monitoring to prove controls and remediation work in practice.
• Train directors on regulatory duties, personal accountability and asking the right questions.
• Prepare for regulatory visits and deliver remediation that lasts.

Want help separating the faithful from the traitors in your board pack? Contact a member of the Regulatory and Compliance team. A conversation now costs far less than a regulator's findings later.