Examples of governance models vary sharply by organization type. A publicly traded corporation runs on a board-and-committee structure shaped by SEC rules and stock exchange listing standards. A nonprofit typically uses a policy board that sets direction while an executive director runs operations. A university or hospital splits authority between a lay board and a professional body. A technology-heavy organization layers in a framework like COBIT or the NIST Cybersecurity Framework. Each model answers the same underlying question — who decides what, and who answers for it — in a way that fits the organization’s legal setting and mission.
What Every Governance Model Has in Common
Before the examples diverge, they share a spine. Articles of incorporation and bylaws establish the chain of authority and spell out who can do what. Roles are separated: directors set strategy and oversee management, officers run daily operations, and committee members handle specialized areas like audit or compensation. Decision rules specify which actions take a simple majority and which require a supermajority, usually reserved for mergers, charter amendments, or removing directors. Reporting lines carry verified data upward so the governing body can act on it.
Underneath those structures sit the fiduciary duties that make them legally meaningful: the duty of care, which requires informed decisions, and the duty of loyalty, which requires putting the organization’s interests ahead of personal gain.1Cornell Law Institute. Duty of Loyalty The models below are different arrangements of these same parts.
Corporate Example: Shareholder-Primacy vs. Stakeholder
The clearest contrast in corporate governance is between two philosophies of who the company serves.
The shareholder-primacy model traces its legal roots to Dodge v. Ford Motor Co. (1919), where the Michigan Supreme Court held that a corporation exists primarily for the profit of its shareholders and that directors cannot redirect those profits toward other goals at shareholders’ expense.2Justia. Dodge v Ford Motor Co In practice, the board answers to shareholders, reporting lines emphasize margins and stock performance, and executive compensation ties to shareholder returns.
The stakeholder model widens the lens. Leadership weighs the interests of employees, customers, suppliers, and the broader community alongside financial returns. Organizations in this camp often adopt Environmental, Social, and Governance (ESG) reporting standards, pulling data on carbon footprints, workforce diversity, and supply chain practices into board-level decisions. Shareholders still vote and still elect directors, but the formal decision-making framework accounts for a wider set of outcomes.
Neither model exists in pure form at most companies. Shareholder-focused boards still consider reputational risk and employee retention, and stakeholder-oriented companies still have to deliver returns. The model determines which considerations get formal weight when the board faces a hard call.
Public Company Example: Mandatory Committees and SOX Controls
Public companies layer specific structural requirements on top of whichever philosophy they follow. The NYSE requires listed companies to maintain three independent board committees — audit, compensation, and nominating/corporate governance — each composed entirely of independent directors within one year of listing.3NYSE. NYSE Listed Company Manual Section 303A
The audit committee carries the heaviest load. Under SEC rules implementing Section 301 of the Sarbanes-Oxley Act, it must oversee the independent auditor, establish procedures for handling accounting complaints, and have authority to hire outside advisors with company funding.4U.S. Securities and Exchange Commission. Standards Relating to Listed Company Audit Committees
Sarbanes-Oxley also governs internal controls. Section 404 requires management to assess and report on the effectiveness of internal controls over financial reporting, with an independent auditor attesting to that assessment.5U.S. Securities and Exchange Commission. Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control Over Financial Reporting Requirements Quarterly Form 10-Q filings go to the SEC with personal certification by the CEO and CFO.6U.S. Securities and Exchange Commission. Exchange Act Reporting and Registration
The criminal backing is real. Under 18 U.S.C. § 1350, a CEO or CFO who knowingly certifies a false financial report faces up to $1 million in fines and 10 years in prison. If the false certification is willful, the penalties jump to $5 million and 20 years.7Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports Prosecutors don’t have to prove the statements were actually fraudulent, only that the officer knew the certification didn’t meet the law’s requirements when signed.
Nonprofit Examples: Policy Boards and Advisory Boards
Nonprofits operate on different legal rails, but the structural choices still come down to who decides and who advises.
The Policy Board Model
Most nonprofits use some version of a policy board. The board sets long-term direction and broad goals; day-to-day operations run through an executive director. The board decides what the organization should accomplish, and the executive director figures out how. Oversight runs through annual review of IRS Form 990, which requires disclosure of executive compensation, program expenses, and the compensation of key employees earning above $150,000 from the organization and related entities.8Internal Revenue Service. Form 990 Part VII and Schedule J Reporting Executive Compensation Individuals Included
The Advisory Board Model
Some nonprofits add an advisory board alongside the governing board. Advisory members provide specialized expertise in fundraising, technology, or program design but hold no formal legal authority. Legal responsibility stays with the governing board, which carries three fiduciary duties: care, loyalty, and obedience. The duty of obedience is unique to nonprofits and requires board members to keep the organization focused on its stated tax-exempt mission rather than drifting into unrelated activities.
Those duties have teeth. A 501(c)(3) organization cannot allow its income or assets to benefit insiders like board members, officers, or key employees.9Internal Revenue Service. Inurement/Private Benefit – Charitable Organizations10Office of the Law Revision Counsel. 26 USC 4958 – Taxes on Excess Benefit Transactions11Internal Revenue Service. Intermediate Sanctions – Excise Taxes The organization itself can lose exempt status.12Internal Revenue Service. How to Lose Your 501(c)(3) Tax-Exempt Status
Shared Governance: Universities and Hospitals
Some organizations can’t concentrate authority in a single board without undermining their core mission. Universities and hospitals both split decision-making between a lay board and a professional body.
Universities
In a university, the board of trustees holds fiduciary and financial authority. A faculty senate controls academic standards, curriculum design, and tenure decisions. That split reflects the reality that trustees rarely have the subject-matter expertise to evaluate whether a chemistry department’s tenure criteria are rigorous. The governance model formalizes the division so administrators can’t override professional academic judgment, while the board retains control over budgets and institutional strategy.
Hospitals
Hospitals follow a parallel structure. A hospital board manages the financial and administrative side; a medical staff executive committee governs clinical standards and credentialing. The Joint Commission, which accredits most U.S. hospitals, requires that medical staff bylaws define the structure, functions, and accountability relationships between the medical staff and the governing body.13The Joint Commission. Medical Staff Governance – Medical Staff Policies Versus Organizational Policies When organizational policies apply to medical staff activities, there must be evidence that the medical staff participated in reviewing and approving those policies. Administrators cannot unilaterally dictate clinical practice, and the medical staff cannot operate outside institutional accountability.
IT Governance Examples: COBIT and NIST CSF 2.0
Digital operations create governance problems that traditional board structures weren’t designed to handle. Two frameworks dominate, and many organizations use them together.
COBIT
COBIT, maintained by ISACA, provides a structured approach to managing technology assets and aligning IT activities with business objectives.14ISACA. COBIT Control Objectives for Information Technologies It organizes governance into specific domains that assign clear accountability for data protection, system security, and technology investment decisions. COBIT is designed to integrate with other standards and regulations specific to an organization’s industry rather than prescribe a single approach, which is why it scales from small businesses to global enterprises.
NIST Cybersecurity Framework 2.0
The NIST Cybersecurity Framework 2.0, released by the National Institute of Standards and Technology, added a dedicated Govern function that didn’t exist in earlier versions. This function requires organizations to establish, communicate, and monitor their cybersecurity risk management strategy at the leadership level. It breaks down into categories covering organizational context, risk management strategy, and clearly defined roles, responsibilities, and authorities for cybersecurity decisions.15National Institute of Standards and Technology. The NIST Cybersecurity Framework (CSF) 2.0
The framework uses a tier system to help organizations characterize how mature their cybersecurity governance practices are. Tiers aren’t a one-size-fits-all maturity ladder; they help an organization compare its current state against its target state based on its own risk appetite and mission requirements. Pairing COBIT’s IT management structure with NIST’s cybersecurity governance covers both operational technology risks and information security.
Choosing Among the Examples
The right model depends on three things: what the law requires, what the mission demands, and who the organization is accountable to. A public company doesn’t get to opt out of independent audit committees or Section 404 certification. A 501(c)(3) can’t adopt a structure that lets insiders capture its assets without triggering excise taxes and risking exempt status. A university that collapses faculty authority into the trustees’ hands undermines the academic judgment that accreditation depends on.
Within those constraints, the models are tools, not identities. A corporation can commit to stakeholder considerations without abandoning shareholder accountability. A nonprofit can run a policy board and add an advisory board for specialized input. A hospital can adopt NIST CSF 2.0 on top of its shared clinical governance. The useful question isn’t which model is best in the abstract, but which arrangement puts the right decision in the right hands for your organization — and documents it clearly enough that nobody has to guess.