1. Regulatory and governance context
Luxembourg’s financial sector operates within a supervisory environment that has grown progressively more demanding in its expectations of boards and conducting officers. The CSSF’s outcomes-based approach to supervision, applied across UCITS ManCos, AIFMs, credit institutions, and the broader PFS universe, places increasing weight on whether governance arrangements are genuinely effective, rather than merely formally compliant.
This gradual change has concrete implications. Substance requirements under AIFMD, UCITS V, and their Luxembourg implementing frameworks are not satisfied by the existence of governance documents alone. The CSSF expects evidence that boards actually exercise oversight: that delegations are monitored, that risk appetite is set and enforced, that conducting officers have genuine authority and access to information, and that the three lines of defence produce independent assurance rather than coordinated documentation.
Against this backdrop, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) has published Corporate Governance: Guiding Principles for Board Oversight (2026). COSO is a private-sector body. Its publications are not law, regulation, or supervisory guidance. They carry no binding authority in Luxembourg. They do, however, represent internationally recognised thought leadership on governance, risk management, and internal control, and the conceptual architecture they offer aligns closely with the direction of travel in European financial supervision.
This article analyses the framework’s most significant elements through a Luxembourg lens.
2. What COSO explicitly says
The COSO framework presents twelve interrelated guiding principles, organised around four thematic clusters: board foundations, purpose and culture, strategy and enablement, and leadership and resilience. COSO is explicit from the outset that these principles are not a checklist, do not set binding requirements, and do not prescribe a single governance model. They are intended to complement -not replace- applicable law, regulation, and governance standards.
Several structural features of the framework are worth noting precisely.
On governance structure (Principle 1): The framework describes the board as responsible for establishing a governance structure that clarifies roles and delegations of authority, with clear delineation of what is reserved to the board and what is delegated to management. It addresses group structures explicitly, noting that where an entity operates across subsidiaries or multiple jurisdictions, responsibilities must be cascaded with defined escalation pathways.
On board accountability (Principle 2): Fiduciary duties -care, loyalty, and good faith- are positioned as the anchor of board behaviour. The framework addresses conflicts of interest, related-party transactions, and the oversight of disclosure processes. It describes a board that actively monitors the effectiveness of its accountability mechanisms, including speak-up systems and ethics codes, rather than simply approving their existence.
On board composition and effectiveness (Principles 3 and 4): The framework describes boards that conduct structured assessments of their own effectiveness, including individual director assessments, and that use the results to drive concrete change, in agenda design, committee structure, onboarding, and succession planning. Independence is addressed both formally and behaviourally: the willingness to offer dissenting views is treated as a governance attribute distinct from technical independence status.
On risk management and internal control (Principle 12): This is among the most substantive sections. The framework describes the board’s role as overseeing the approach to risk management, including how risk appetite is set, translated into policy, and monitored, rather than managing risk itself. It addresses the Three Lines Model as a coordination tool and describes the board’s role in ensuring that assurance functions have appropriate independence, authority, resources, and access. It also addresses the coherence between management monitoring, internal audit, and external audit, calling for an integrated picture rather than parallel reporting streams.
On delegation (Principle 1 and throughout): The framework is consistent on this point: delegation by the board to management does not transfer accountability. The board remains responsible for the outcomes of what it has delegated and must maintain sufficient oversight to exercise that accountability in substance.
3. Why these principles matter specifically for Luxembourg entities
Several features of the Luxembourg financial sector make the COSO framework particularly relevant.
Delegation-heavy operating models. Luxembourg ManCos and AIFMs routinely delegate portfolio management, risk management, administration, and distribution to third parties, often within the same group. The regulatory framework permits this, subject to conditions. However, the CSSF has consistently signalled, including through its supervisory priorities and in its guidance on substance, that delegation does not reduce the governance obligations of the authorised entity. Conducting officers must be capable of monitoring and challenging delegates. Boards must have visibility into how delegation arrangements are performing. The COSO framework’s treatment of delegation oversight, as an ongoing board responsibility, not a one-time contractual act, aligns directly with this supervisory expectation.
Substance and the distinction between oversight and management. One of the persistent governance challenges in Luxembourg is the risk of boards that are structurally present but functionally passive. The CSSF’s substance requirements implicitly address this by requiring conducting officers to be genuinely involved in decision-making and to have the expertise and authority to exercise oversight. The COSO framework’s insistence that governance structures must support actual oversight -through information flows, meeting cadence, agenda design, and access to management- provides a useful organising framework for entities assessing whether their governance model meets this standard.
Risk appetite as a board-owned concept. Under AIFMD and the UCITS framework, risk management is a regulated function with specific organisational requirements. In practice, however, the translation of regulatory risk management obligations into board-level governance, including the ownership and articulation of risk appetite, often remains underdeveloped. The COSO framework treats risk appetite as a strategic board decision that must be reflected in policies, processes, and incentive structures. This framing is consistent with the Three Lines Model and with what outcomes-based supervision requires in practice.
Culture and tone at the top. The CSSF, in common with other European supervisors, has increasingly incorporated culture and conduct into its supervisory assessments. The COSO framework’s treatment of culture, as something the board must actively monitor through indicators such as speak-up activity, turnover trends, and conduct data, rather than assume, reflects a level of supervisory maturity now expected of well-governed institutions.
4. Delegation, outsourcing, and board accountability: the core governance challenge
The tension between operational delegation and governance accountability is the defining challenge for many Luxembourg financial entities, and it is the area where the COSO framework offers the most useful conceptual clarity.
The framework describes a governance model in which the board sets the parameters within which management operates, delegates authority through documented thresholds and policies, and then monitors outcomes through structured reporting and assurance activities. Critically, it treats the quality of information flows from management to the board as a governance variable, one that the board itself is responsible for ensuring is adequate.
For Luxembourg entities with significant delegation chains -where portfolio management sits in one jurisdiction, distribution in another, and the authorised ManCo or AIFM in Luxembourg- this has direct operational implications. The board of the authorised entity cannot discharge its oversight responsibilities on the basis of information that is filtered, delayed, or framed by the very management it is meant to oversee. COSO describes boards that actively shape the content and format of management reporting, challenge whether information is decision-relevant, and request direct access to senior management and assurance providers when appropriate.
The framework also addresses outsourcing of governance-adjacent functions, noting that where key assurance roles such as internal audit are outsourced or co-sourced, the board must be satisfied that the provider has appropriate independence, authority, and access. This is directly relevant to Luxembourg entities that rely on group-level internal audit functions or on third-party providers, and where the question of whether that function serves the board’s oversight needs, rather than management’s comfort, deserves scrutiny.
5. Common weaknesses observed in practice
Based on observation of governance practice in Luxembourg financial entities, a number of recurring weaknesses are worth noting in light of the COSO framework. These observations are practice-based rather than supervisory findings.
Delegation frameworks that are documented but not monitored. Many entities maintain detailed delegation matrices but lack systematic processes for the board to receive evidence that delegations are operating within agreed parameters. The gap between the formal governance structure and the actual flow of information to the board is often significant.
Risk appetite statements that are not operationally connected. Risk appetite is frequently articulated at a high level of abstraction, without clear linkage to operational limits, investment guidelines, or conduct expectations. Where risk appetite is not translated into management-facing parameters, it cannot function as a governance tool.
Board assessments that are process-compliant rather than substantive. Board effectiveness reviews are increasingly common, but their quality varies considerably. Where assessments are designed to satisfy a procedural requirement rather than to produce actionable insight, they add governance documentation without improving governance outcomes.
Thin three-lines-of-defence architecture. In smaller Luxembourg entities, particularly ManCos with limited headcount, the practical independence of the second line from the first, and of the third line from both, requires deliberate structural attention. The COSO framework’s emphasis on assurance providers having genuine independence, authority, and board access is a useful diagnostic lens.
Conduct and culture oversight that is superficial. Boards that receive culture reporting consisting only of a summary of compliance training completion rates are not exercising meaningful oversight of culture. The COSO framework describes a significantly richer set of indicators -speak-up volumes and trends, exit interview themes, incentive-conduct linkages- that a serious board should be reviewing.
6. Board-level implications*
The COSO framework arrives at a moment when the substantive quality of board oversight in Luxembourg is under increasing scrutiny. Several of its principles have implications that boards should take seriously.
The governance structure must follow the risk profile, not the legal template. Many Luxembourg entities establish governance structures that reflect their authorisation category rather than their actual complexity and risk. An AIFM managing multiple strategies across multiple jurisdictions with extensive delegation chains requires governance architecture -committee structures, reporting lines, information flows, assurance coverage- proportionate to that complexity. A governance structure designed for a simpler entity will not, in practice, support the oversight that the risk profile demands.
Conducting officers face a structural challenge that governance must explicitly address. In Luxembourg, conducting officers carry personal regulatory accountability for functions they frequently do not directly manage. The governance implications of this structural tension -which COSO addresses through its treatment of information flows, access to management, and the distinction between oversight and execution- deserve explicit treatment in governance frameworks. Conducting officers should not be expected to exercise oversight on the basis of information flows designed for a different purpose.
The board’s relationship with its assurance providers needs to be genuinely independent. In entities where internal audit, risk management, and compliance are provided by group-level functions or outsourced providers, the board of the Luxembourg entity must actively assess whether those functions serve its oversight needs. This is not a matter of contractual form; it is a question of whether the board receives independent, board-level insight rather than management-filtered reporting.
Board effectiveness assessment should be treated as a governance tool, not a compliance exercise. The most valuable outcome of a board effectiveness review is an honest assessment of whether the board’s collective capabilities, working processes, and information access are genuinely fit for the oversight responsibilities it carries. In Luxembourg, where the CSSF has signalled interest in governance quality as part of its supervisory approach, this is not merely a best-practice recommendation.
* This section reflects professional opinion based on experience with Luxembourg financial entities and relevant regulatory frameworks. It does not represent the views of COSO or any supervisory authority
7. Conclusion for Luxembourg Boards and Senior Management
The COSO Guiding Principles for Board Oversight does not create obligations. Luxembourg boards and conducting officers are not required to adopt it, reference it, or report against it. Its authority is intellectual rather than legal.
That said, the framework offers something of genuine practical value: a coherent, comprehensive reference point for boards that want to assess whether their governance arrangements are genuinely effective rather than formally adequate. In a supervisory environment that increasingly asks not just whether governance structures exist, but whether they work, that distinction matters.
For Luxembourg financial entities, the most important questions the framework raises are not novel. They are: Does the board have the information it needs to exercise real oversight over what it has delegated? Is risk appetite a working governance tool or a document? Do assurance functions serve the board’s oversight needs with genuine independence? Is the board’s assessment of its own effectiveness honest and consequential?
These are questions that well-governed institutions should be able to answer with confidence. For those where the answer is less certain, the COSO framework provides a useful starting point for the conversation.
You can find the publication here.
