The governance framework has four parts. In establishing or refining it, the organisation discloses what it is trying to achieve through governance, overall and specifically, and how, so that it is credible, trustworthy and sustainable; builds or refines an integrated framework in which, where an oversight board exists, a number of its members are fully independent and between them bring competence in risk and opportunity, finance and audit, nominations and remuneration, each of those areas being chaired by an independent member, supported by short reporting lines, responsibilities that are clearly mapped, KPIs that work, strategy, planning and policy, systems and controls that secure accountability, record-keeping and reporting, training and ongoing improvement, resources for setting and watching over vision, values and ethical standards, and enough resource for compliance monitoring (topics such as cyber security, protection of data, bribery, corruption, fraud and the laundering of money); identifies and sorts governance risks and opportunities, flagging those specific to ESG; fosters a culture of good governance, dealing with the barriers and incentives to change and providing ways to raise concerns such as a whistleblowing line; and has significant harms audited by independent third parties, above all where the organisation itself may have committed serious violations. In evaluating governance risks and opportunities it quantifies them (effect, likelihood and magnitude on or from communities and the environment), rates inherent and residual levels as high, medium or low where that helps, decides and records its strategies within a defined appetite for risk and reward, limits board members' terms and reviews the board's performance regularly, sometimes through independent reviewers. Its desired outcomes and programmes take in board diversity and executive pay, the fight against fraud, bribery, corruption, abuse of markets and the laundering of money, privacy of data, engagement with shareholders and other parties, ethics with its training and codes, independence and integrity of board and leadership, openness and disclosure, how well risk and opportunity are managed, resource use including energy, water, waste and circularity, and strategies to identify and cut emissions. For accountability and reporting it picks the governance topics to disclose, including those interested parties want, in the light of its sector and business and by methods such as due diligence, brainstorming and market research; states its governance objectives and discloses the processes and results of pursuing its ESG objectives; reports impartially, meaning factually, truthfully, accurately and completely about its governance without hiding facts; makes its claims, reports and disclosures accurate, prompt and mindful of interested parties' concerns; seeks their views before, during and after reporting, partners and supervisory functions included; checks that actual outcomes match the intended ones and the programmes meant to deliver them; keeps organisational memory and learning alive; explains to interested parties why it reached its outcomes and decisions; and sets the timing of risk and opportunity disclosures by reporting frequency and by the nature and consequences of the matter, disclosing at once anything urgent and vital that could cause significant loss or opportunity for interested parties. The IWA's table of example governance actions shows the kinds of measure available.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.