The Role of Governance in Modern Organizations

Corporate governance is the system of rules, practices, and structures by which a company is directed, monitored, and held accountable. It sits at the intersection of leadership, risk, and trust defining who gets to make decisions, how those decisions are checked, and what happens when something goes wrong. For any organization

operating in India today, governance is no longer a discretionary “good practice” borrowed from global textbooks. Large parts of it are legal obligations, spelled out in the Companies Act, 2013, SEBI's Listing Obligations and Disclosure Requirements (LODR) Regulations, and the Prevention of Sexual Harassment (POSH) Act, 2013.

This piece looks at what governance actually means in 2026, the four pillars that hold it up, and critically what Indian law specifically requires companies to do, not just aspire to.

Why Role of Governance Matters in 2026

Governance expectations have shifted meaningfully in the last few years. Institutional investors now run structured ESG and governance due diligence before committing capital, not as a checkbox exercise but as a genuine input into valuation. Regulators SEBI chief among them for listed entities have grown more willing to act on governance lapses, not just accounting fraud. And employees, especially in younger workforces, increasingly treat how a company handles ethical concerns internally as a signal of whether it's a place worth staying. The cost of getting governance wrong has also become more visible. A delayed or mishandled whistleblower complaint doesn't stay contained to HR anymore it can surface in board minutes, media coverage, and regulatory filings within the same quarter. For listed companies specifically, governance failures increasingly show up as SEBI enforcement actions, not just reputational stories. This is part of why governance and ESG reporting have become so tightly linked a company's environmental and social commitments carry little credibility without the governance backbone to enforce them consistently.

The Four Pillars of Modern Governance

Most governance frameworks — whether OECD principles, SEBI's regulatory architecture, or internal codes of conduct rest on four consistent pillars:

1. Transparency. Stakeholders — shareholders, employees, regulators get timely, accurate information about decisions that affect them. This includes financial disclosures, but also disclosure of related-party transactions, conflicts of interest, and material risks.

2. Accountability. Decisions have identifiable owners. When something goes wrong, there's a clear chain of responsibility rather than a diffusion of blame across committees and departments.

3. Board Oversight. Independent directors and functioning committees audit, risk, nomination — provide a check on management rather than simply ratifying its decisions. This is where governance moves from paper policy to practiced discipline.

4. Ethical Culture. Formal structures only work if the culture underneath them supports honest reporting. This is the pillar most often underinvested in — companies write policies but don't build the psychological safety for employees to actually use them.

The first three pillars are largely structural and can be audited on paper. The fourth is cultural, harder to measure,

and usually where governance quietly breaks down even in companies with technically compliant policies.

Governance Requirements Under Indian Law

Global governance principles are a useful frame, but Indian companies operate under specific statutory obligations that go well beyond “best practice.” Three sit at the center of most governance programs.

Companies Act, 2013 — Section 177 and the Vigil Mechanism

Section 177 of the Companies Act, 2013, read with the Companies (Meetings of Board and its Powers) Rules, 2014, requires certain companies to establish a vigil mechanism a formal channel through which directors and employees can report genuine concerns about unethical behaviour, actual or suspected fraud, or violation of the company's code of conduct. This mechanism must provide adequate safeguards against victimisation of the person who raises the concern, and in appropriate or exceptional cases, allow direct access to the chairperson of the audit committee.

The obligation applies to:

• All listed companies

• Companies that accept deposits from the public

• Companies that have borrowed money from banks and public financial institutions in excess of ₹50 crore

The audit committee is responsible for overseeing the vigil mechanism's functioning.

SEBI LODR Regulation 22 — Vigil Mechanism for Listed Entities

Regulation 22 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, applies specifically to listed entities and mirrors much of the Companies Act obligation, with its own compliance expectations: a whistleblower policy covering directors and employees, protection against victimisation, and direct access to the audit committee chairperson in exceptional circumstances. For listed companies, this sits alongside not instead of the Section 177 obligation, meaning audit committees are effectively the

compliance anchor for whistleblower governance under both frameworks simultaneously.

POSH Act — the Internal Committee Requirement

The Prevention of Sexual Harassment (POSH) Act, 2013, requires any workplace with ten or more employees to constitute an Internal Committee to receive and inquire into complaints of sexual harassment. The Act sets a 90-day timeline for completing the inquiry from the date the complaint is received, extendable in specific circumstances with reasons recorded in writing. Unlike the vigil mechanism requirements, POSH compliance isn't gated by listing status or company size beyond the ten-employee threshold it applies broadly.

Requirement	Applies To	Oversight Body	Core Obligation
Vigil Mechanism — Companies Act S.177	Listed companies; public-deposit- accepting companies; companies with bank/FI borrowings above ₹50	Audit Committee	Enable reporting of genuine concerns; protect against victimisation
Vigil Mechanism — SEBI LODR Reg. 22	All listed entities	Audit Committee	Whistleblower policy; direct access to Audit Committee chairperson in exceptional cases
POSH Internal Committee	Any workplace with 10+ employees	Internal Committee	Receive and inquire into harassment complaints within 90 days

Audit Committee Oversight — Governance in Practice

The audit committee has quietly become one of the busiest bodies in Indian corporate governance. Beyond its traditional financial oversight role reviewing statements, evaluating internal controls, engaging with auditors it now also oversees the vigil mechanism under both the Companies Act and SEBI LODR, making it the practical nerve center connecting financial governance and ethics governance.

For this oversight to be more than a formality, audit committees need visibility into vigil mechanism metrics: how many concerns were raised, how they were categorized, how quickly they were resolved, and whether any patterns suggest a systemic issue rather than isolated incidents. Companies that treat these as routine reporting line items rather than genuine board-level discussion points — tend to be the ones caught flat-footed when a concern that was raised internally resurfaces later as a regulatory or media issue.

How Whistleblower Mechanisms Strengthen Governance

A well-functioning whistleblower mechanism does something governance frameworks can't do on paper alone: it surfaces problems while they're still small, internal, and fixable. Every major governance failure that eventually becomes public usually had an earlier, quieter internal warning that either wasn't raised, wasn't heard, or wasn't acted on. The independence of the reporting channel matters enormously here. Employees are considerably more likely to report a genuine concern through a channel they trust to be confidential and free of internal politics which is a large part of why many companies choose to outsource their whistleblower hotline rather than route it entirely

through an internal HR or legal function. An external, independent channel signals that the mechanism exists to surface problems, not to manage them quietly.

Common Governance Failures and What They Cost

While every governance failure has its own specifics, a few patterns recur often enough to be worth naming directly:

• Delayed escalation — a concern is raised but sits unresolved for months, allowing a contained issue to compound.

• Retaliation, explicit or implicit — even where formal victimisation protections exist on paper, informal retaliation (being sidelined, excluded from projects, subtly managed out) discourages future reporting.

• Concealed related-party dealings — weak disclosure discipline around related-party transactions remains one of the more common triggers for regulatory scrutiny of listed companies.

• Audit committees as a formality — committees that meet the compositional requirements on paper but don't substantively engage with vigil mechanism data.

Editorial note: this section is intentionally kept at the pattern level rather than citing specific named companies or regulatory orders, since none were verified for this brief. If named case studies are wanted here, source and fact check them first SEBI's enforcement order archive and stock exchange disclosures are the right primary

sources.

The consequences of these failures compound rather than stay isolated: SEBI enforcement action, reputational damage that affects investor confidence and hiring, and in the more serious cases — leadership and board turnover forced by the fallout rather than chosen proactively.

What is the vigil mechanism?

The vigil mechanism is a formal reporting channel, required under Section 177 of the Companies Act, 2013 and SEBI LODR Regulation 22 for applicable companies, that allows directors and employees to report genuine concerns about unethical conduct or fraud, with safeguards against victimisation and in exceptional cases direct access to the audit committee chairperson.

Is corporate governance mandatory in India?

Core elements of governance are legally mandatory for many Indian companies, not just aspirational. Listed companies, companies accepting public deposits, and companies with significant bank borrowings must maintain a vigil mechanism under the Companies Act. Listed entities have parallel obligations under SEBI LODR.

Workplaces with ten or more employees must maintain a POSH Internal Committee. Beyond these specific statutory requirements, broader governance practices (board composition, disclosure quality) are shaped by a mix of Companies Act provisions, SEBI regulations, and stock exchange listing requirements.

Who is responsible for governance in a company?

Ultimate responsibility sits with the board of directors, with the audit committee typically holding direct oversight of the vigil mechanism and financial governance specifically. In practice, effective governance requires this responsibility to be distributed the board sets policy and oversees outcomes, but day-to-day functioning depends on management implementing controls and employees actually using the reporting channels available to them.

Closing Thought

Governance frameworks read cleanly on paper. Whether they function in practice usually comes down to a handful of operational questions: is the vigil mechanism actually independent, does the audit committee see real data, and would an employee with a genuine concern trust the channel enough to use it. Getting the legal structure right is the starting point building a mechanism people actually use is the harder, more consequential part.