There is a familiar kind of programme board. The pack is accurate, the risks are logged, the status is amber, and everyone leaves without a decision having been made. Six months later the programme is in trouble and the minutes show that it was all reported at the time.
The reporting was not wrong. It just was not designed to prompt anything. A risk log that nobody is accountable for closing is a record, not a control.
Governance that actually helps tends to share a few features. It asks for decisions rather than updates. It names who is accountable for each open question and by when. And it makes the uncomfortable number visible rather than averaging it into an overall status.
That last one is where most of the value sits. A single amber status across a programme hides the fact that nine workstreams are fine and one is going to sink it.