Testing governance is useful when it makes risk visible, creates a clear decision or prevents something important being missed. It becomes a problem when the machinery for governing testing consumes more effort than the testing it is supposed to govern.
If teams are preparing status for one forum, reformatting it for another and then attending a third meeting to explain why the first two disagree, the control system has become its own delivery stream. Testing governance has a natural tendency to reproduce when nobody is watching.
If you want an independent view of which controls are earning their keep, get onto us and we can review the governance against the actual risks and decisions.
Map every control to a decision
Take each report, approval, meeting, gate and mandatory artefact and ask what decision it changes. Who reads it? What can that person do differently because it exists? What happens if the control disappears?
If nobody can answer, stop treating longevity as evidence of value. Processes survive for years because deleting them feels riskier than continuing them, especially when the person who invented them has left and everyone assumes they knew something important. The test is similar to asking how much testing documentation is really needed: keep what supports a decision and lose the rest.
Remove duplicate approvals
Multiple teams reviewing the same evidence can make sense where they bring genuinely different expertise or accountabilities. It does not make sense when three groups independently confirm that the same test completion percentage is still 94 per cent.
Look for sequential approvals that cannot realistically change the outcome. If approval B always follows approval A because nobody wants to reopen the discussion, approval B is decoration with a calendar invite.
Separate evidence from permission
Testing should produce evidence and explain risk. Governance should decide what to do with that evidence. When every test artefact needs ceremonial approval before anybody can use it, teams start optimising documents for approvers instead of information for decisions.
If approving the test approach takes longer than executing the test, the control may have become the product.
Likewise, a test lead should not need six signatures to say a critical journey has not been tested. The fact should be visible immediately. The decision about whether to accept it belongs with whoever owns the release risk.
Use heavier controls where consequence is heavier
A reversible low-risk web change does not need the same ceremony as a one-way data migration affecting millions of records. Governance that cannot distinguish consequence from routine change creates queues without creating confidence.
Keep strong gates for decisions where independence, legal obligations, safety, material financial exposure or irreversible change justify them. Let routine work move with lighter evidence and clear ownership.
Kill reports that only feed other reports
Trace where every status field goes. If a team spends Friday updating a dashboard so PMO can copy the numbers into another dashboard so a board pack can show one traffic light, work out whether the board actually needs the underlying information in that form.
Senior people usually need fewer measures with more interpretation: what is risky, what changed, what is unknown and what decision is required.
Measure the cost of governance
You do not need a new KPI programme. For a few weeks, estimate how much senior and delivery time is spent preparing, attending and servicing test governance. Compare that with what those controls actually catch or change. A meeting that exists to prepare for another meeting is not assurance. It is calendar middleware.
The aim is not zero governance. It is enough governance to make accountability and risk clearer without building a second organisation whose main product is evidence that the first organisation has meetings.