In Depth | September 2026
Scaling without losing control: the operating model challenge in high-growth regulated firms
Growth versus control: the inherent tension
Compliance, risk and governance teams are still too often characterised as the “departments of no”: bureaucratic functions that inhibit innovation, slow decisions and create barriers to change.
The same perception frequently shapes firms’ relationships with their regulators. Instead of asking what stronger governance might enable, the internal conversation becomes: “What does the regulator want us to do now—and at what cost?”
This framing creates a false choice between growth and control.
There has been no shortage of commentary suggesting that if a control function is perceived as obstructive, the function itself has failed. There may be some truth in that. Risk, compliance and governance leaders need to communicate clearly, understand the commercial context and help the business navigate risk rather than simply identify it.
But responsibility does not sit with the control functions alone. They can provide insight, challenge and direction; they cannot make a leadership team value or act on them.
The inherent view held by a firm’s senior leaders matters. If governance, risk and compliance are regarded primarily as regulatory costs, the organisation will almost inevitably underinvest in them or engage them too late. If they are seen as part of the infrastructure for sustainable commercial success, they can help the firm move faster with greater confidence.
This is why the opening message in the FCA’s recent review of good and poor practice among high-growth firms[1] is significant. The regulator begins by recognising that rapidly growing firms can increase choice, improve access and services, support innovation and contribute to economic growth.
The FCA is not positioning growth as the problem. The risk arises when expansion moves ahead of the governance, risk management and control frameworks needed to support it.
That distinction matters.
Growth exposes the operating model
Growth rarely causes a regulated firm’s operating model to fail overnight. More often, it reveals gaps that have been widening quietly.
Governance may still be designed for a smaller and simpler organisation. Formal accountabilities may no longer reflect where decisions are actually made or where regulatory responsibilities sit. Management information may describe yesterday’s business. Critical individuals may be expected to run the organisation, maintain control and deliver its transformation simultaneously.
The FCA’s findings bring this challenge into sharp focus. Between July 2025 and March 2026, it engaged with 15 high-growth firms across asset management, wealth management and payments. It assessed whether their governance, risk management and control arrangements were developing in step with their growth.
In the stronger firms, governance, risk management, technology and organisational capability evolved alongside the business. In weaker examples, growth had moved ahead while structures, policies, management information and control resources remained anchored to an earlier stage.
For boards, the question is therefore not simply whether the firm has governance and controls. It is whether those arrangements still fit the firm the business has become—and the one it intends to become next.
That question needs to be considered through three connected lenses: governance, accountability and change capacity.
What the FCA’s findings are really signalling
The FCA identified a series of weaknesses that will be familiar to many growing organisations.
Governance that follows rather than anticipates growth
Board and committee structures had not always kept pace with the scale and complexity of the business. In some cases, the scope, frequency and format of meetings were no longer effective.
The instinctive response to growth is often to add more governance: another committee, another report or another approval stage. This can create an appearance of control while making accountability less clear and decisions more cumbersome.
Scalable governance is not necessarily more governance. It is governance redesigned around the decisions, risks and responsibilities that now matter.
Responsibilities concentrated among too few people
High-growth firms frequently depend on a small number of founders, specialists or long-serving executives. Those individuals may carry institutional knowledge, key external relationships and decision-making authority that have never been distributed or documented.
This dependency becomes most visible during periods of stress, rapid change or unexpected absence. Without credible succession planning, cross-training and knowledge transfer, a firm can discover that apparently robust processes are sustained by individual memory and personal intervention.
Insufficient independent challenge
As the business evolves, the board’s composition and collective knowledge must evolve with it.
A board that was appropriate at authorisation may not have the experience required to challenge a more complex product set, a changing customer base, significant outsourcing arrangements or the introduction of automation and AI.
Independent challenge is not an abstract governance virtue. It is one of the mechanisms through which assumptions are tested before they become exposures.
Control functions that no longer reflect the firm’s complexity
Risk and compliance teams that were adequate for an earlier stage of the firm’s development can become overwhelmed as products, customers, jurisdictions, third parties and regulatory obligations multiply.
Underinvestment tends to make these functions increasingly reactive. They become dependent on manual intervention and individual effort, addressing issues after commercial decisions have already been made.
This also creates an unhealthy organisational dependency on the control functions. Risk management becomes something performed by a specialist team rather than understood and applied across the firm.
A scalable model requires both appropriate control-function capacity and wider risk capability throughout the organisation.
Policies, controls and management information that lag behind change
When a business model, target market or operating environment changes, the supporting policies and controls must change with it.
Outdated management information is particularly dangerous because it can give the board the comfort of regular reporting without the substance of effective oversight. The test is not whether information is available. It is whether it enables leaders to identify emerging risks, make decisions and act in time.
Weak oversight of technology and third parties
Technology, automation, AI and outsourced services can all help a firm scale. They also introduce dependencies and concentrations that may not be immediately visible.
Where ownership is unclear or technical understanding is concentrated among a few people, an incident can expose conflicts, gaps in accountability and delays in decision-making. The risks may be known, but not sufficiently understood to support an effective response.
Notably, the FCA found examples of stronger firms choosing to delay expansion into new regulated activities until their controls over the existing business were more robust. That is not a rejection of growth. It is evidence of growth discipline: recognising that the ability to execute safely is itself a strategic constraint.
The three gaps that emerge during growth
Taken together, the FCA’s observations point to three operating-model gaps.
The governance gap
This emerges when oversight follows growth instead of anticipating it.
Existing structures may be stretched beyond their original purpose, while new governance is layered on without removing or redefining what came before. The result can be greater complexity, duplicated oversight and slower decisions—without a corresponding improvement in control.
The accountability gap
This arises when formal responsibilities no longer reflect where decisions are made or where obligations sit in practice.
Reporting lines may look clear on an organisation chart while real authority operates through informal relationships, founder influence or cross-functional groups. Decisions can then fall between committees or be taken collectively without clear individual ownership.
The capacity gap
This appears when the same critical people are expected to run, control and transform the organisation.
Growth programmes rarely take place in isolation. Firms may simultaneously be implementing regulatory change, replacing technology, launching products, integrating acquisitions and responding to operational incidents.
AI may increase productivity and improve access to information, but it does not remove the human limits on judgement, attention and organisational absorption. Change capacity remains a finite control resource.
“Change capacity remains a finite control resource”
What a scalable operating model looks like
There is no single operating-model blueprint for a high-growth firm. Proportionality matters. But scalable organisations tend to share several characteristics.
Their governance is reviewed when there are material changes in scale, complexity, ownership, products, customers or risk—not solely according to the annual governance calendar.
Decision rights, responsibilities and escalation thresholds are explicit. People understand not only who owns an issue but which decisions can be delegated, which require challenge and when escalation is mandatory.
Management information is designed around the decisions the board and executive team need to make. Its relevance, accuracy and timeliness matter more than its volume.
Independent challenge develops alongside the firm. Board skills and experience are periodically assessed against the future business model, not just current operations.
Investment in risk and control capability is linked to forward growth scenarios. This includes specialist resources, systems and data, but also education and the embedding of risk ownership across the organisation.
The executive team maintains a visible view of change capacity, interdependencies and competing demands. Strategic initiatives are sequenced according to the organisation’s ability to absorb them safely.
Finally, the firm systematically reduces its reliance on key individuals through succession planning, cross-training, documented knowledge and tested contingency arrangements.
The board must govern the transition, not just the destination
Boards naturally focus on the destination: the new market, product, platform, customer segment or revenue target.
Their equally important role is to govern the transition.
That means testing whether the growth plan includes the operating-model investment, organisational capability and sequencing necessary to deliver it. It means asking whether the firm can absorb the planned change while continuing to serve customers, manage risk and remain operationally resilient.
It also means recognising that a decision to slow, sequence or postpone expansion can sometimes be evidence of strong commercial judgement—not a failure of ambition.
The central lesson from the FCA’s findings is not that growth requires more bureaucracy. It is that sustainable growth requires the operating model to develop deliberately rather than retrospectively.
Firms whose leaders accept that governance, risk and compliance contribute to commercial success will be better placed to make informed decisions, respond to disruption and pursue opportunities with confidence.
Those that continue to see control primarily as a constraint may grow quickly. But they are likely to discover that the cost of catching up is significantly greater than the cost of keeping pace.
Five Questions for the Board
1. Where has the business changed faster than its governance or control environment?
2. Which decisions, relationships or processes depend disproportionately on one or two individuals?
3. Do formal accountabilities reflect where decisions are actually made and where regulatory responsibilities sit?
4. What evidence demonstrates that the firm’s risk, compliance, technology and operational capacity can support its next stage of growth?
5. What would the organisation be prepared to sequence, slow or postpone if it lacked the capacity to deliver the change safely?
This article responds to the FCA’s “High-growth firms: good and poor practice” publication of 10 August 2026.
This publication is provided for general information only and does not constitute legal or regulatory advice.
[1]High-growth firms: good and poor practice | FCA