Entity & Corporate Governance Management in a Connected GRC Program

Corporate governance is often treated as a legal or board-administration function.

Legal entity records are maintained.
Board materials are prepared.
Committee charters are updated.
Officer and director records are tracked.
Subsidiary filings are completed.
Delegations of authority are approved.
Policies are reviewed.
Meeting minutes are stored.
Regulatory filings are submitted.
Governance calendars are maintained.

All of that work matters.

But corporate governance becomes more powerful when it connects to risk, compliance, audit, privacy, cyber, third-party risk, ESG, AI governance, SOX, regulatory change, and executive reporting.

A legal entity may own a regulated business activity.
A subsidiary may have local filing obligations.
A board committee may oversee risk, audit, cyber, ESG, compliance, or privacy.
An officer may have delegated authority over contracts, controls, certifications, or regulatory responses.
A governance policy may connect to controls and evidence.
A filing deadline may create a compliance issue.
A board decision may create a remediation commitment.
A corporate structure change may affect risk ownership, reporting, vendors, data, or regulatory obligations.

When those records are disconnected, governance becomes harder to prove.

The company may know that a board meeting occurred, but not which risks were discussed.
It may know that a subsidiary exists, but not which obligations apply to it.
It may know that an officer was appointed, but not which delegations or certifications changed.
It may know that a committee charter was approved, but not whether its oversight responsibilities connect to actual risk reporting.
It may know that a filing was submitted, but not whether late or missing filings create issue-management workflows.

That is where Connected GRC changes the model.

In a Connected GRC program, Entity & Corporate Governance Management is not just a legal entity database or board calendar. It is a connected workflow that links entities, ownership structures, directors, officers, committees, charters, policies, delegations, obligations, filings, risks, issues, evidence, and reporting.

The goal is not to make governance administrative.

The goal is to make governance traceable, accountable, and connected to the risk and compliance operating model.

What is Entity & Corporate Governance Management in Connected GRC?

Entity & Corporate Governance Management in Connected GRC is the process of managing legal entities, corporate structures, directors, officers, board and committee governance, ownership records, charters, delegations, filings, obligations, policies, evidence, issues, and governance reporting through connected workflows.

A connected entity and corporate governance program should help answer:

• What legal entities exist?
• Who owns each entity?
• Which jurisdictions apply?
• Which directors and officers are appointed?
• Which board or committee oversees which risk areas?
• Which charters, bylaws, policies, and delegations apply?
• Which filings are due?
• Which obligations apply to each entity?
• Which risks, controls, vendors, assets, or processes are tied to each entity?
• Which governance approvals are required?
• Which issues or exceptions remain open?
• Which evidence proves governance actions were completed?
• Which governance records support audits, regulatory inquiries, financing, M&A, or board reporting?

A disconnected entity-management process can show that records exist.

A connected governance process can show how legal structure and governance responsibilities support risk oversight, compliance execution, and accountability.

That is the difference.

Why entity and corporate governance become disconnected

Entity and governance records become disconnected because they sit across several teams.

Legal may own entity records.
Corporate secretarial teams may own board and committee records.
Finance may own tax, treasury, statutory reporting, and SOX implications.
Compliance may own regulatory obligations.
Risk may own enterprise risk reporting.
Internal audit may review governance controls.
Cyber teams may report to the board or risk committee.
Privacy may track entity-specific data obligations.
ESG teams may manage sustainability oversight and reporting.
Procurement may manage entity-level vendor contracts.
Business leaders may own local operations and regulated activities.

Each team needs part of the governance record.

But often, those records are separate.

Common symptoms include:

• entity records maintained separately from risk and compliance obligations
• board and committee charters disconnected from actual oversight workflows
• director and officer changes not linked to authority, certification, or filing updates
• ownership structures not linked to regulated activities
• filings tracked manually
• governance evidence stored in folders
• delegations of authority not linked to controls or approvals
• committee decisions not linked to issues or remediation commitments
• regulatory changes not routed to the right entity owner
• subsidiaries not connected to vendors, contracts, assets, or data processing
• governance reporting assembled manually
• audit evidence reconstructed after the request arrives

Governance work may be happening.

But disconnected governance work is hard to defend and harder to use.

Connected GRC helps close that gap.

The Entity & Corporate Governance Connected GRC map

Entity and governance records should connect to the broader GRC program.

This map is what turns corporate governance from recordkeeping into connected oversight.

1. Start with the legal entity inventory

A connected governance program begins with a clean entity inventory.

A legal entity record should include:

• entity legal name
• entity type
• jurisdiction
• registration details
• tax identifiers, where applicable
• ownership structure
• parent entity
• subsidiary relationships
• business unit
• operating status
• directors
• officers
• local responsible owner
• regulatory status
• key filings
• governance documents
• obligations
• risks
• open issues
• evidence

SmartSuite’s product catalog describes Entity & Corporate Governance Management as managing legal entities, governance, and compliance with a centralized platform for corporate structure and oversight.  

That is the foundation.

The entity record should not be only legal metadata.

It should connect to the risks, obligations, controls, filings, policies, contracts, vendors, data, assets, and business activities tied to that entity.

A legal entity is often the anchor for accountability.

If the anchor is disconnected, accountability becomes harder.

2. Connect entities to ownership and corporate structure

A corporate structure is more than a chart.

It can affect:

• reporting obligations
• regulatory exposure
• board oversight
• tax and finance workflows
• contract authority
• data-processing responsibilities
• vendor relationships
• ESG reporting
• local employment obligations
• statutory filings
• litigation exposure
• M&A diligence
• SOX scope
• internal audit planning
• risk ownership

A connected corporate structure should show:

• parent entities
• subsidiaries
• ownership percentages
• jurisdiction
• operating status
• business activity
• reporting relationships
• board or management oversight
• entity-level risks
• entity-level obligations
• entity-level issues
• material contracts
• regulated activities

This matters because structure changes can create GRC changes.

A new entity may create filing obligations.
A subsidiary closure may require offboarding, tax, records, and contract steps.
An acquisition may create new compliance obligations.
A reorganization may change risk ownership.
A new jurisdiction may create privacy, employment, ESG, or regulatory requirements.

Entity structure should not sit apart from GRC.

It should be part of the connected data model.

3. Connect entities to obligations

Different entities may have different obligations.

Those obligations may come from:

• corporate law
• securities regulation
• tax requirements
• employment rules
• privacy laws
• industry regulation
• financial reporting requirements
• ESG disclosure requirements
• licensing requirements
• registration requirements
• local filings
• board or committee requirements
• contractual commitments
• customer commitments
• internal governance standards

A Connected GRC approach links Entity & Corporate Governance Management to Regulatory Change Management, Control Framework & Regulatory Libraries, and Compliance Management.

That helps answer:

• Which obligations apply to this entity?
• Which jurisdiction created the obligation?
• Who owns compliance?
• Which policy or control satisfies it?
• What evidence is required?
• What filings are due?
• Which issues remain open?
• Which regulatory changes affect the entity?

The G20/OECD Principles emphasize that corporate governance frameworks should support transparency, accountability, supervision, and enforcement.   In practice, that requires knowing which obligations apply and who is responsible for them.

An entity obligation without an owner is a future issue.

4. Connect entities to filings and deadlines

Entity governance often involves recurring filings and deadlines.

Examples include:

• annual reports
• beneficial ownership filings
• director or officer updates
• registered agent renewals
• business licenses
• local statutory filings
• tax-related filings
• subsidiary reports
• securities filings
• committee or board approvals
• entity dissolutions
• foreign qualification renewals
• corporate register updates
• governance certifications
• local regulatory submissions

A connected filing record should include:

• entity
• jurisdiction
• filing type
• owner
• due date
• reviewer
• approver
• status
• evidence
• submission date
• renewal date
• issue, if late or incomplete
• related obligation

This is where Regulatory Inquiries, Regulatory Change Management, and Issues Management can connect.

A missed filing is not only an administrative problem.

It can create compliance, legal, reputational, and operational risk.

The filing workflow should not depend on one person’s calendar.

It should be governed with ownership, evidence, and escalation.

5. Connect board and committee records to oversight responsibilities

Boards and committees provide oversight.

But oversight is hard to prove if meeting records, charters, risk reports, decisions, and action items are disconnected.

A connected board or committee record should include:

• committee name
• charter
• members
• chair
• responsibilities
• meeting schedule
• agenda
• materials
• minutes
• decisions
• action items
• issues escalated
• risks reviewed
• reporting received
• evidence
• next review date

The G20/OECD Principles describe the board’s role in guiding corporate strategy, monitoring management performance, and overseeing areas such as risk management systems, compliance, and governance practices.  

That oversight should connect to the actual GRC workflows being overseen.

For example:

• Audit committee → SOX, internal audit, financial reporting controls, external audit, deficiencies
• Risk committee → enterprise risk, risk appetite, KRIs, top risks, mitigation plans
• Cyber committee or board oversight → cyber risks, incidents, vulnerabilities, third-party cyber exposure
• ESG committee → sustainability metrics, disclosure readiness, supplier evidence, assurance
• Privacy or data governance committee → privacy incidents, DPIAs, DSARs, AI data use, vendor privacy risk
• Compensation committee → executive compensation governance, policies, approvals, disclosures, issues

A committee record should not just show that a meeting occurred.

It should show what oversight happened and what actions followed.

6. Connect governance charters to actual work

Committee charters define oversight responsibilities.

But charters can become disconnected from the work they describe.

A connected charter should link to:

• committee responsibilities
• risks overseen
• reports reviewed
• policies owned
• controls reviewed
• issues escalated
• management certifications
• regulatory obligations
• meeting cadence
• evidence requirements
• annual review date
• approval history

For example, if a committee charter says the committee oversees enterprise risk, the committee record should connect to enterprise risk reports, risk appetite exceptions, major issues, incidents, and decisions.

If a charter says the committee oversees cyber risk, the record should connect to cyber risk reports, incidents, vulnerabilities, third-party cyber exposure, and remediation.

A charter without workflow connection becomes a governance artifact.

A charter connected to reports, decisions, and issues becomes operating oversight.

7. Connect directors and officers to roles, authority, and filings

Director and officer records are not only contact records.

They can affect authority, governance, certifications, filings, delegations, signatures, board composition, independence, committee membership, and regulatory disclosures.

A connected director or officer record should include:

• person
• entity
• role
• appointment date
• resignation date
• committee membership
• authority level
• independence status, where relevant
• filing requirements
• certification responsibilities
• delegations
• training or attestation
• conflicts or disclosures, where relevant
• approval history
• evidence

SEC Regulation S-K Item 407 includes corporate-governance disclosure requirements, including director independence disclosures in relevant proxy or information statements.   Public-company requirements vary based on facts, listing standards, and filing context, but the broader point is stable: director and officer records should be accurate, current, and connected to governance workflows.

When an officer changes, several workflows may need updates:

• bank authority
• contract approval rights
• filing records
• board minutes
• delegation matrix
• management certifications
• policy approvers
• regulatory contacts
• risk owners
• evidence owners

Connected GRC helps make those downstream impacts visible.

8. Connect delegations of authority to controls and contracts

Delegation of authority is a governance control.

It defines who can approve what.

Delegations may cover:

• contracts
• spending
• hiring
• financial approvals
• policy approvals
• regulatory submissions
• entity actions
• vendor approvals
• risk acceptance
• issue closure
• incident escalation
• settlement authority
• data-processing approvals
• AI use-case approvals
• ESG disclosure approval
• SOX certifications

A connected delegation record should include:

• authority type
• threshold
• role
• entity
• business unit
• approver
• effective date
• policy source
• control mapping
• exceptions
• evidence
• issue history

This is where Policy Management, Control Framework & Regulatory Libraries, Contract Lifecycle Management, and Issues Management connect.

Delegations should not remain buried in a policy document.

They should connect to the workflows where approvals happen.

If someone approves outside authority, the exception should be visible.

9. Connect governance policies to controls

Corporate governance policies may include:

• code of conduct
• delegation of authority policy
• board governance policy
• related-party transaction policy
• conflict of interest policy
• insider trading policy
• disclosure policy
• records retention policy
• subsidiary governance policy
• committee charter governance
• ethics and compliance policy
• risk management policy
• cybersecurity governance policy
• ESG governance policy
• AI governance policy
• privacy governance policy

A Connected GRC approach links Entity & Corporate Governance Management to Policy Management and Control Framework & Regulatory Libraries.

That helps answer:

• Which policy governs this entity or board process?
• Which control enforces the policy?
• Who owns the policy?
• Which attestations are required?
• Which exceptions exist?
• Which issues show the policy may not be working?
• Which evidence proves governance?

A governance policy should not stop at publication.

It should connect to the control or workflow that makes it real.

10. Connect governance decisions to issues and remediation

Boards and committees often make decisions that create follow-up actions.

Examples include:

• approve remediation funding
• request additional risk analysis
• direct management to update a policy
• require a control improvement
• approve risk acceptance
• approve entity restructuring
• approve a filing
• approve a disclosure
• request vendor escalation
• require cyber remediation status
• approve crisis communications strategy
• direct ESG evidence improvements
• approve AI governance requirements

A connected board or committee decision should include:

• decision
• meeting
• approving body
• owner
• due date
• evidence required
• related risk
• related issue
• related policy
• related control
• status
• closure evidence

This is where governance becomes actionable.

A decision should not remain only in minutes.

If the decision creates work, that work should become a tracked action or issue.

Connected GRC helps preserve the line from oversight to execution.

11. Connect entity management to regulatory change

Regulatory change may affect specific entities.

A new or changed requirement may apply only to:

• a jurisdiction
• a subsidiary
• a licensed entity
• a public company entity
• a regulated business unit
• a data-processing entity
• a financial services entity
• an operating entity
• a holding company
• an entity with employees in a region
• an entity with vendor relationships in a region

A Connected GRC approach links entity records to Regulatory Change Management.

That helps answer:

• Which entities are impacted by the change?
• Which obligations changed?
• Which policies need updates?
• Which controls need updates?
• Which filings are required?
• Which owners must act?
• Which evidence is required?
• Which issues were opened?

Regulatory change should not be applied generically across the company if only certain entities are affected.

Entity mapping makes regulatory impact assessment more precise.

12. Connect entity records to regulatory inquiries

Regulatory inquiries may ask for entity-specific evidence.

Examples include:

• governance structure
• board minutes
• committee charters
• officer records
• regulatory filings
• ownership records
• policy approvals
• control evidence
• risk reports
• subsidiary records
• decision history
• remediation commitments
• committee oversight evidence

A Connected GRC approach links entity records to Regulatory Inquiries.

That helps answer:

• Which entity is in scope?
• Which obligations apply?
• Which governance records support the response?
• Which evidence was submitted?
• Who approved the response?
• Which issues or commitments remain open?
• What prior response history exists?

A governance inquiry should not trigger a search across board folders, legal drives, filing portals, and emails.

The connected entity record should help assemble the evidence trail.

13. Connect corporate governance to enterprise risk

Corporate governance supports risk oversight.

A connected governance model should link board and committee oversight to enterprise risks.

That includes:

• risk appetite
• top enterprise risks
• risk movement
• major incidents
• control failures
• audit findings
• regulatory changes
• cybersecurity risk
• privacy risk
• third-party risk
• operational resilience
• ESG risk
• AI governance risk
• SOX and financial reporting risk
• compliance issues
• major remediation plans

A Connected GRC approach links Entity & Corporate Governance Management to Enterprise Risk Management.

This helps answer:

• Which governing body oversees this risk?
• When was the risk last reviewed?
• Which materials were reviewed?
• Which decisions were made?
• Which issues were escalated?
• Which remediation commitments were approved?
• Which evidence supports oversight?

Governance is not the same as management.

But governance records should show how oversight occurred.

That is especially important when risk becomes material.

14. Connect governance to SOX and financial reporting oversight

Corporate governance and SOX often intersect.

Boards and audit committees may oversee financial reporting, internal controls, external audit, internal audit, deficiencies, remediation, and management certifications.

A Connected GRC approach links entity governance to SOX Management, SOX Compliance, Internal Audit Management, and Compliance Assessments & Testing.

This helps answer:

• Which entity is in SOX scope?
• Which officers certify?
• Which controls apply?
• Which deficiencies exist?
• Which remediation is overdue?
• Which audit committee materials were reviewed?
• Which decisions were made?
• Which evidence supports oversight?

SOX reporting should not be disconnected from governance records.

Audit committee oversight, deficiency reporting, remediation status, and management certification all belong in the connected governance story.

15. Connect governance to cyber, privacy, AI, and ESG oversight

Modern boards and committees increasingly oversee risk domains that were once treated as operational.

These may include:

• cybersecurity
• privacy
• AI governance
• ESG and sustainability
• operational resilience
• third-party risk
• regulatory change
• crisis management
• ethics and compliance

SEC cybersecurity disclosure rules require public companies to provide disclosures about cybersecurity risk management, strategy, governance, and incidents.   More broadly, this reflects a larger trend: governance bodies need structured visibility into domain risks, not ad hoc updates.

A Connected GRC model should link governance oversight to:

• cyber risk dashboards
• major cyber incidents
• privacy incidents
• AI use-case risk
• ESG disclosure readiness
• third-party risk exposure
• critical service resilience
• major vulnerabilities
• regulatory changes
• remediation commitments

This does not mean the board manages these domains.

It means oversight records should connect to the reports, issues, decisions, and evidence that show governance occurred.

16. Connect governance to conflicts, related parties, and attestations

Corporate governance often involves conflict and related-party oversight.

A connected workflow may track:

• conflict disclosures
• related-party transactions
• director independence records
• committee member disclosures
• officer attestations
• code of conduct acknowledgments
• policy exceptions
• approval records
• recusals
• evidence
• issues

A connected record should include:

• person
• entity
• role
• disclosure type
• affected decision or transaction
• reviewer
• approval status
• recusal, if applicable
• evidence
• follow-up issue

Conflict and related-party records are sensitive.

They need confidentiality and access controls.

But they also need traceability.

A governance program should be able to show that disclosures were made, reviewed, and handled appropriately.

17. Connect entity and governance records to M&A and restructuring

M&A and restructuring create governance complexity.

A transaction may create:

• new entities
• new directors and officers
• new obligations
• new filings
• new contracts
• new data-processing activities
• new vendors
• new systems
• new policies
• new risks
• new internal controls
• new ESG or regulatory reporting
• entity dissolution actions
• integration issues

A Connected GRC approach helps link entity management to risk and compliance due diligence.

It can help answer:

• Which entities were acquired?
• Which obligations apply?
• Which filings are due?
• Which directors and officers need appointment or resignation?
• Which policies need adoption?
• Which controls need integration?
• Which risks and issues were identified?
• Which evidence supports completion?
• Which governance approvals are required?

Entity governance should not be an afterthought in M&A.

It is part of integration risk.

18. Connect governance evidence to audits and assurance

Governance evidence may include:

• entity records
• board minutes
• committee materials
• charters
• policies
• approvals
• filings
• officer appointments
• director records
• delegations of authority
• conflict disclosures
• attestations
• regulatory submissions
• issue remediation
• risk reports
• management certifications
• audit committee materials

A Connected GRC approach links governance evidence to Internal Audit Management, Regulatory Inquiries, Compliance Assessments & Testing, and Evidence Management.

That helps answer:

• What evidence proves governance occurred?
• Which entity does it relate to?
• Which obligation does it support?
• Who approved it?
• What period does it cover?
• Which issue or decision does it support?
• Which audit or inquiry relies on it?

Governance evidence should not be scattered across board portals, email, legal drives, and filing systems without connection to obligations and decisions.

Connected GRC preserves the evidence trail.

19. Build dashboards that show governance readiness, not just records

Corporate governance dashboards should not only show entity counts or filing calendars.

They should show readiness, ownership, obligations, issues, and decisions.

A connected governance dashboard should include:

The dashboard should answer:

• Which entities need attention?
• Which filings are late?
• Which governance records are incomplete?
• Which committees have pending actions?
• Which issues require escalation?
• Which decisions need approval?

That is entity and corporate governance reporting in Connected GRC.

How Connected GRC changes the governance conversation

A disconnected governance conversation sounds like this:

“The entity records are maintained, board meetings are documented, committee charters are updated, and filings are being tracked.”

A connected governance conversation sounds like this:

“Three subsidiaries have filings due this month, one entity lacks a confirmed officer record after the reorganization, the audit committee has two open remediation actions tied to SOX deficiencies, a regulatory change affects two licensed entities, and one delegation exception requires executive approval before a vendor contract can proceed.”

The second conversation is more useful.

It connects entities, filings, officer records, committee oversight, SOX remediation, regulatory change, delegations, contracts, and executive decisions.

That is what Entity & Corporate Governance Management should do in Connected GRC.

Where to start improving Entity & Corporate Governance Management

Organizations do not need to connect every governance workflow at once.

Start where governance records are hardest to use.

Start with the entity inventory if records are scattered

Create a central entity record with ownership, jurisdiction, directors, officers, filings, obligations, evidence, and issues.

Relevant links:

• Entity & Corporate Governance Management
• Enterprise Risk Management
• Regulatory Change Management
• Regulatory Inquiries

Start with filing calendars if deadlines are risky

Connect filings to entities, jurisdictions, obligations, owners, due dates, evidence, and escalation.

Relevant links:

• Regulatory Change Management
• Issues Management
• Evidence Management in GRC
• Compliance Management

Start with board and committee governance if oversight evidence is manual

Connect committees to charters, responsibilities, risk reports, decisions, action items, issues, and evidence.

Relevant links:

• Enterprise Risk Management
• Internal Audit Management
• SOX Management
• GRC Dashboards

Start with delegations if approval authority is unclear

Connect delegation matrices to policies, contracts, controls, exceptions, issues, and approvals.

Relevant links:

• Policy Management
• Contract Lifecycle Management
• Control Framework & Regulatory Libraries
• Issues Management

Start with governance evidence if audits or inquiries are painful

Connect minutes, approvals, filings, charters, policies, attestations, and decisions to obligations and source records.

Relevant links:

• Evidence Management in GRC
• Regulatory Inquiries
• Internal Audit Management
• Compliance Assessments & Testing

Start with regulatory impact if entities face different requirements

Map obligations and regulatory changes to affected entities, policies, controls, filings, and owners.

Relevant links:

• Regulatory Change Management
• Control Framework & Regulatory Libraries
• Policy Management
• Enterprise Risk Management

The best starting point is where governance records currently exist but do not drive action.

Common Entity & Corporate Governance Management mistakes to avoid

Mistake 1: Treating entity management as a static database

Entity records change when directors, officers, ownership, jurisdictions, obligations, filings, business activities, or structures change.

Entity management should be active.

Mistake 2: Separating governance records from risk oversight

Board and committee records should connect to the risks, issues, decisions, and evidence they oversee.

Mistake 3: Tracking filings without issue escalation

Late or missing filings should trigger issue management, ownership, evidence, and escalation.

Mistake 4: Letting delegations live only in policy documents

Delegations should connect to approvals, controls, contracts, exceptions, and evidence.

Mistake 5: Ignoring entity-specific obligations

Not every obligation applies to every entity.

Entity mapping helps make compliance more precise.

Mistake 6: Keeping governance evidence in disconnected folders

Minutes, charters, approvals, filings, attestations, and decisions should connect to obligations, issues, and reporting needs.

Mistake 7: Reporting governance activity instead of governance readiness

Meeting counts and filing calendars are useful, but leaders also need open issues, overdue actions, regulatory impacts, governance gaps, and decisions needed.

A practical test for your entity and governance workflow

Pick one material legal entity.

Then ask whether your current GRC model can quickly show:

• entity owner
• jurisdiction
• parent entity
• subsidiary relationships
• directors
• officers
• operating status
• regulated activities
• applicable obligations
• upcoming filings
• overdue filings
• governing documents
• board or committee oversight
• policies that apply
• delegations of authority
• contracts tied to the entity
• vendors tied to the entity
• data-processing activities tied to the entity
• SOX or audit relevance
• open governance issues
• remediation owners
• evidence of approvals
• executive decisions needed

If answering those questions requires legal entity tools, board portals, filing calendars, email, spreadsheets, contract repositories, risk registers, audit files, and policy folders, the governance workflow is not connected enough.

That is common.

It is also the opportunity.

Final thought

Entity & Corporate Governance Management should not be a disconnected legal recordkeeping function.

It should be part of the Connected GRC operating model.

That means linking entities to ownership, ownership to obligations, obligations to filings, filings to evidence, boards to oversight, committees to risks, decisions to issues, delegations to controls, and governance actions to reporting.

Connected GRC gives entity and governance management that structure.

It helps legal teams maintain accurate entity records.

It helps corporate secretarial teams connect governance activity to action.

It helps compliance teams map obligations by entity.

It helps risk teams connect board oversight to enterprise risk.

It helps finance and SOX teams maintain governance evidence.

It helps internal audit review governance controls.

It helps executives understand where governance requires decisions.

That is the practical value of Entity & Corporate Governance Management in a Connected GRC program.

It turns legal structure and governance records into accountable oversight.