Corporate Governance Code

Governance codes exist to raise the standard of governance across a whole market without writing every rule into law. A code states principles that listed companies apply or explain against, which gives boards flexibility while keeping them publicly answerable. For an owner or investor, the code is a benchmark: it shows what good governance looks like locally and where a specific company deviates. Many codes now name risk oversight and resilience as explicit board duties.

Codes are issued by regulators and exchanges: in the Gulf, the UAE Securities and Commodities Authority (SCA) code for listed companies and the Saudi CMA regulations for companies listed on Tadawul are the reference points. Companies report against the code in their annual corporate governance statement. A practical example: a code expects a stand-alone board risk committee, and a mid-size company explains instead how its combined audit and risk committee covers the duty. That explanation, if honest, is the mechanism working.

The recurring mistake is reading the code as a compliance checklist, where a formally correct answer replaces actual oversight. Apply-or-explain assumes boards think, choose and justify, not that they tick boxes. A company can be fully compliant on paper and still learn about its fragility from a single outage. In the ERGP programme, codes and regulatory expectations are covered in module M5, on regulation.