What Are Board Decision Rights?
Decision rights define, for every category of decision, who proposes it, who analyses its impact, and who holds final approval. Written down, they become a delegation of authority framework covering reserved matters the board cannot delegate, financial thresholds attached to roles rather than named individuals, operational authorities exercised within limits, and escalation triggers that push a decision back up. Left undefined, they become the single most common reason a board either interferes in management or fails to govern at all. The GCC BDI Board Effectiveness Review 2025 found 91 percent of respondents agree boards should concentrate on policy and strategy and leave daily operations to management, while also finding the principle is not consistently followed, which frustrates executives and dilutes the board’s influence. A corporate governance assessment that scores the delegation framework is the fastest way to locate where the lines are blurred.
The evidence suggests the gap is widespread rather than exceptional. EY’s 2026 boardroom analysis found many organisations still operate fragmented delegation policies that struggle to keep pace with complex, multi-jurisdictional operations, leaving boards and audit committees less able to maintain comprehensive oversight. Analysis of delegation practice in UAE companies published in 2026 reported that 49 percent of organisations lack formal materiality thresholds, which is a control gap an auditor or regulator will find. Several of the boardroom red flags that precede governance failure are symptoms of exactly this: decisions taken at the wrong level, and nobody able to say which level was correct. The cost is concrete. A board that cannot say which decisions require its approval tends to approve everything, filling the agenda with operational matters management should have handled, or to approve nothing of substance, waving proposals through without deliberation. Both weaken the board, and under the personal liability provisions in UAE and Saudi company law, both create exposure a documented framework would have prevented.
What Is the Legal Basis in the GCC?
Narrower than commonly assumed, and worth stating precisely. No single article of UAE law mandates a delegation of authority document as such. The obligation arises from a combination: the SCA Governance Code and the Commercial Companies Law together require boards of listed public joint stock companies to define and document reserved matters and governance frameworks. Article 154 of the Commercial Companies Law reserves specific categories to the board, including loans exceeding three years, asset pledges, mortgages, debt forgiveness and arbitration, and the personal liability provisions mean directors and managers who commit the company outside their lawful authority carry direct legal risk. Read together, a maintained framework functions as a legal safeguard rather than an optional policy. Saudi Arabia’s CMA regulations separately require the board to separate its functions and authorities from those of senior management.
Component | What it must specify |
|---|---|
Reserved matters | Decisions the board cannot delegate, including the statutory categories and any the board chooses to retain |
Financial thresholds | Approval limits in currency values, assigned to roles rather than individuals, calibrated by entity |
Operational delegation | What management may decide within limits, and what documentation each decision requires |
Escalation protocol | The triggers that move a decision up, and who is notified when they fire |
Review cycle | At minimum annual, triggered automatically by restructuring, new entities, leadership change or regulatory update |
Enforcement is where most frameworks fail. A matrix that exists only as a policy is not a control. Approval limits belong inside the systems where spending actually happens, so an approval attempted at the wrong level triggers a workflow exception rather than a conversation. The corporate secretary maintains the framework, revises it after structural change and keeps the register of powers of attorney current, which is the difference between a document and an operating control.
There is also a live trigger for review. The UAE’s Federal Decree-Law No. 20 of 2025, effective 1 January 2026, substantially amended the Commercial Companies Law, introducing re-domiciliation provisions allowing companies to migrate between emirates or between mainland and free zone without losing legal personality, expanded private placement options for private joint stock companies, and new shareholder arrangement tools including drag-along and tag-along rights. Any company that has undertaken or is planning an entity migration or structural reorganisation should be testing whether its thresholds, signatory rights and reserved-matter definitions still match the new structure.
Why Is the Gap Wider in Family Businesses?
Because the informal decision-making that served a founder efficiently becomes a liability once outside capital, new jurisdictions or a generational transition arrives. A documented 2026 case study of a UAE family enterprise operating across real estate, logistics and private investments described the starting position precisely: no formal board structure, strategic decisions taken through informal consultation, inconsistent documentation and uncodified authority. The remedy was structural. Capital allocation above defined thresholds, entry into new jurisdictions and changes to ownership structure were ring-fenced for board approval. Operational decisions were delegated within limits with documented escalation. Simple majority governed routine matters while supermajority applied to capital and structural change, and deadlock provisions gave the chair a casting vote with defined escalation pathways. That is what codified authority looks like in practice, and it connects directly to the work of separating family emotion from business decisions. Composition compounds it. The GCC BDI found board appointments still shaped largely by relationships rather than a skills matrix. Combine relationship-driven composition with an informal authority framework and the board neither oversees effectively nor stays clear of management. The authority gap becomes a trust gap, and the trust gap becomes strategic, which is the same structural problem behind the independence a board claims but cannot evidence.
How Should a Board Close the Gap?
Start with a gap assessment comparing the existing framework against the current organisational structure, entity map, regulatory requirements and risk appetite. That typically surfaces authority gaps, thresholds that no longer reflect commercial reality, missing materiality definitions and powers of attorney requiring revocation or renewal. Draft a revised framework, approve it at board level, embed it in the relevant operational systems, and communicate it with documented training. Then formalise the review cycle rather than leaving it to memory. A board evaluation run alongside will show whether the board’s agenda and decision process actually changed, and the governance competencies directors need to hold the line between oversight and execution are learnable rather than instinctive.
How MEIoD Supports Boards
MEIoD works with boards and family enterprises across the GCC to build the decision-rights architecture that effective oversight depends on.
- CG Assessment: a structured governance review covering the delegation framework, reserved matters documentation, authority thresholds and escalation protocols.
- Board Evaluations: an independent assessment of whether the decision process, agenda structure and authority boundaries support oversight or produce operational interference.
- Corporate Directors Program: builds the competencies directors need to know where their authority begins and ends.
- The New Shareholder & Stakeholder Dynamic (13 October 2026, 6:00 PM UAE, virtual): examines how shareholder expectations are reshaping board decision authority.
A board that cannot say which decisions belong to it is not governing. The authority framework is where that starts. Contact MEIoD, and we will build the decision-rights architecture around it.
FAQ
What is a delegation of authority framework?
A document defining which decisions the board reserves to itself, which are delegated to management within financial thresholds and operational limits, and what triggers escalation back to the board. It converts the board’s governance role into an enforceable operational control.
Is a delegation of authority document legally required in the UAE?
No single article mandates the document itself. The requirement arises from the SCA Governance Code and the Commercial Companies Law together requiring listed public joint stock companies to define and document reserved matters, from Article 154 reserving specific categories to the board, and from personal liability provisions affecting anyone who commits the company outside their lawful authority.
What happens when decision rights are unclear?
The board either micro-manages, filling its agenda with operational approvals, or rubber-stamps management proposals without genuine deliberation. Both weaken governance and both create personal exposure for directors under UAE and Saudi company law.
How often should the framework be reviewed?
At least annually, and automatically on any material change including restructuring, a new entity, a leadership change or a regulatory update. The UAE’s Federal Decree-Law No. 20 of 2025, effective 1 January 2026, introduced re-domiciliation and shareholder arrangement provisions that give affected companies a direct reason to review now.
How do you make a framework actually work?
Embed approval limits in the systems where spending happens, so an approval at the wrong level triggers a workflow exception rather than a conversation. Assign thresholds to roles rather than named individuals. Keep the powers of attorney register current. Then train against it and audit compliance.
