Governance does not come from the bottom up

Here is a situation we have seen more than once. A company hires a good compliance officer. Reports go out on time. The risk register is tidy. Then an inspector from the Insurance Diwan sits with the board, asks three questions, and the room goes quiet. Not because the answers were bad. Because the board had never read what it signed.

Governance does not come from the bottom up. However good the staff are, their effect stays limited while the top leadership does not see its own legal responsibility clearly and cannot ask the right questions.

The responsibility is personal

Iraqi law is explicit. The Insurance Business Regulation Law no. 10 of 2005 puts solvency and the accuracy of supervisory reports on the board. The Anti-Money Laundering Law no. 39 of 2015 reaches the leadership when reporting and control fail. The Companies Law no. 21 of 1997 defines what board members owe shareholders and the state. These are not duties a board can delegate away by hiring well.

Ten questions before you sign

A board does not need to become a compliance department. It needs ten questions it asks every time a supervisory report comes to the table:

1. Who prepared this, and who checked it?
2. Which regulator receives it, and by what date?
3. What changed since the last one, and why?
4. Which numbers tie back to the audited accounts?
5. What did the last inspection say about this area, and is it closed?
6. Which risks in the register moved this quarter, and who owns the response?
7. What did the AML reporting officer flag, and what happened next?
8. Which committee reviewed this before it reached us?
9. What would an inspector ask about this page?
10. What are we committing to by signing?

If the management cannot answer three of these in the room, the report is not ready, whatever the deadline.

Why leaders need their own room

Most training in this market is built for staff: technical, long, and about forms. Leaders rarely get a programme built for them. So they approve reports they do not read, sit through risk discussions they do not steer, and discover the size of their legal exposure at the first infraction.

That is why we run a separate two-day executive programme for board members, authorised directors and general managers of insurance companies: no lectures, moderated discussion, cases from the Iraqi market, a simulated Diwan inspection, and a leader's toolkit to take home. The staff programme comes a week later. The order is deliberate: the leaders first, so that when their people return trained, they find a board that understands them and backs them.