“Who decides?” and “What’s the worst that happens?” — that’s it.
Every framework I’ve worked with eventually reduces to those two questions wearing different costumes. Ownership and consequence. Get clear on those and most of the rest of a governance programme writes itself; skip them and no amount of policy documentation will save you.
Save yourself the consultancy bill and start there. (More on this in next month’s essay.)