Safety Norms: Corporate Governance and Business Administration

1Purpose, Scope, and Safety Principles

These norms exist to prevent harm in the everyday work of governing and administering a company. In this context, harm includes unlawful decisions, unmanaged conflicts of interest, loss or leakage of confidential information, unsafe conditions during meetings and site visits, misstated records, and failures to respond to incidents. They apply to directors, officers, company secretaries, managers, administrative staff, students completing coursework or internships, and external advisers who handle governance or administrative tasks.

Four principles guide these norms. Decisions must be lawful and documented. Authority must match competence. Information must be protected in proportion to its sensitivity. Problems must be escalated early rather than hidden. Where this document says must, the rule is mandatory under company policy or applicable law. Where it says should, the item is recommended good practice that the organization may adapt. Corporate statutes, listing rules, constitutional documents, and software manuals are jurisdiction-dependent or vendor-specific, so verify current versions with competent authorities or qualified counsel before relying on them.

2Roles, Competence, and Accountability

Accountability must be written down. The board of directors oversees strategy, risk, and executive performance. Each director must act in good faith, exercise reasonable care, and disclose personal interests. The chair manages board proceedings. The company secretary or governance administrator maintains statutory registers, circulates agendas and papers, and records minutes. Executives run operations and report on risk. Administrative staff handle bookings, filings, and document control under the secretary's direction.

Competence gaps are treated as risks. A person who lacks a required skill must seek training, advice, or supervised participation rather than acting alone.

• Directors must complete a documented induction covering duties, delegated authorities, and the conflict of interest procedure before attending their first board or committee meeting.
• Only individuals named in the delegation of authority may sign contracts, approve payments, or submit filings for the company, and only up to the limit stated in that delegation.
• Staff must not perform work that requires a professional license or registration, such as certain accounting, legal, or regulatory filings, unless they hold that qualification or are supervised by someone who does.
• The company secretary must confirm and record each director's appointment profile and completion of mandatory training at appointment and at each scheduled review.

3Realistic Hazards and Risk Assessment

Governance work does not carry the physical danger of a plant or laboratory, but its hazards are real and can be severe. Common hazards include conflicts of interest that distort decisions, insider information used improperly, weak internal controls that allow fraud or error in payments, misleading board papers, intrusion into board portals and email, personal data exposure in employee files, inadequate minutes that cannot support a decision, and physical hazards in meeting rooms, server closets, and archive storage.

Score each hazard for likelihood and consequence on a three-level scale of low, medium, and high. Every high-rated risk must have a named owner, a documented control, and a review date set by the board or audit committee. Repeat the assessment when a major transaction, system change, restructuring, or regulatory development occurs.

• Conflict of interest: high consequence where a director votes on a related party contract. Control: written disclosure before the agenda item is considered and a recorded abstention where the constitution or law requires it.
• Insider information: high consequence where restricted deal details circulate. Control: a maintained insider list and restricted access to project folders.
• Payment fraud: high likelihood where one person can create a vendor and approve its invoices. Control: segregation of duties and dual approval above a defined threshold.
• Data exposure: medium to high where board packs are sent as unprotected email attachments. Control: a secure portal with access logging.
• Physical hazards: low to medium in meeting rooms and archives. Control: trip-free walkways, unobstructed exits, and heavy filing cabinets anchored to walls.

4Preventive Controls and Safe Working Practices

Prevention relies on layered controls: clear authority, documented process, independent review, and verified records. No single person should be able to initiate, approve, and record a significant decision without a second check.

Visits to operating facilities require the same discipline as the office. The visitor must complete the host site's safety induction, wear any required protective equipment, stay with an escort in restricted areas, and identify the nearest fire exit and assembly point on arrival.

• Confirm quorum and record it at the start of every board and committee meeting. Minutes must note each director who declared an interest.
• Directors with a material interest must declare it in writing before the meeting. They must not vote on that matter unless the constitution and applicable law allow it and the disclosure is minuted.
• Circulate board papers within the notice period set by the governing documents. Late papers must be flagged on the agenda, and the chair must decide whether the item proceeds.
• Record each decision with its resolution wording, the vote or consensus reached, and the material information considered. The chair must review draft minutes before circulation.
• Approve payments and contracts only under the delegation of authority. Any approval above the threshold requires a second authorized signatory who was not involved in preparing the transaction.
• Apply information barriers to restricted matters. Use project code names in non-restricted documents.
• Staff must not sign documents, certify statements, or give legal, tax, or accounting opinions unless authorized in writing.
• Use the standard agenda template and a decision log that tracks actions, owners, and due dates. Hold private sessions with the auditors or independent directors when concerns arise.

5Equipment, Environment, Information, and Safeguards

Governance teams rely on laptops, meeting technology, document storage, and physical rooms. Each needs routine care and clear rules. Equipment and data controls should be reviewed with the company's information technology and privacy functions, which hold the current configuration standards.

Hygiene and environmental controls apply to shared spaces as well. Keep kitchens and breakout areas clean, report water leaks or mold to facilities promptly, and dispose of toner cartridges and batteries through approved recycling routes.

• Company devices must use full disk encryption, automatic screen lock, and current security updates. Personal devices may access board materials only through approved applications that block local download where the company requires it.
• Board portals must use multi-factor authentication and role-based access. Access must be revoked on the day a director or staff member leaves the role.
• Video conferencing must use a company-approved platform with waiting rooms and host controls. Recording confidential sessions is prohibited unless the chair and legal counsel approve it in writing.
• Printed board papers must be numbered, collected after meetings, and destroyed with a cross-cut shredder or a contracted destruction service.
• Personal data in employee, shareholder, or director files must be collected and retained only as permitted by the data protection law of the relevant jurisdiction. Verify requirements with a qualified privacy professional.
• Meeting rooms must keep emergency exits clear, maintain adequate lighting, and route cables to prevent trips. Seating and screen height should follow the workplace ergonomics policy.
• Archive rooms must not exceed the floor load ratings supplied by the building manager, and tall shelving must be anchored.

6Incident, Near-Miss, Emergency, and Escalation Procedures

An incident is any event that causes or could cause loss, data breach, injury, or regulatory exposure. A near miss is an event that could have caused harm but did not. Both must be reported. Anyone who reports in good faith must not face retaliation.

Escalation moves upward when a matter is unresolved within its stated timeline, involves a director or senior officer, or threatens solvency, reputation, or legal standing. This document is educational guidance and does not replace emergency services or formal legal advice.

• Report suspected fraud, data breach, misleading statements, or workplace injury to the company secretary and the designated compliance or risk officer within the time set by company policy, normally as soon as the person becomes aware.
• For a suspected personal data breach, first contain the exposure by recalling the email or revoking access, then notify the privacy officer immediately. Regulator notification deadlines are jurisdiction-dependent.
• Escalate suspected misconduct involving a senior officer to the audit committee chair or an independent director, never to the person implicated.
• In a fire, medical event, or building threat, follow the building emergency plan, call local emergency services, and move to the assembly point. Do not attempt firefighting beyond the level the company has trained you to perform.
• Designated first aid and fire wardens must hold current training from a recognized provider. Verify local requirements with the building or safety authority.
• Record every incident and near miss in the incident register with time, location, people involved, immediate action taken, and the named owner.

7Records, Training, Monitoring, and Review

Records prove that governance took place. Retention periods are set by corporate, tax, employment, and privacy law in each jurisdiction, so confirm them with qualified advisers. Training keeps people competent as laws and systems change.

Continuous improvement requires measuring whether controls work, not just whether they exist. Useful indicators include late paper circulation, unresolved declarations of interest, overdue access revocations, and open corrective actions.

• Maintain registers of directors, interests, shareholders, and delegations of authority. Update them within the period required by law or company policy after any change.
• Keep signed minutes, resolutions, and supporting papers in a controlled repository with version history.
• Complete induction and refresher training on conflicts, information security, privacy, and incident reporting. Keep attendance records for each participant.
• The audit or governance committee must review control testing results, incident logs, and near-miss trends at each scheduled meeting.
• Review these norms at least once each year and after any significant incident, legal change, or restructuring.

Implementation checklist

• Confirm the delegation of authority covers every person who approves payments or signs contracts.
• Collect written conflict of interest declarations before each meeting agenda is issued.
• Verify quorum and record all declarations at the start of every meeting.
• Circulate board papers within the required notice period using a secure portal.
• Apply dual approval to payments and contract changes above the approved threshold.
• Revoke access to board materials on the day a role ends.
• Log all incidents and near misses in the register and escalate within policy timelines.
• Confirm that the emergency plan, exit routes, and assembly points are current and posted.
• Check retention and privacy requirements with a qualified adviser before deleting or disclosing records.
• Schedule the annual norms review and record its outcome in the governance file.