Every group structure looks simple on paper. A holding company at the top, a handful of trading subsidiaries below it, maybe a dormant entity or two left over from a restructuring. The org chart fits on one slide. The governance framework should be straightforward.
Then you look at the actual operation. The holding company is incorporated in England. Two subsidiaries are in Ireland. One is in Delaware. There is a joint venture in the Netherlands that nobody has filed annual accounts for since 2023. A dormant subsidiary in Scotland was supposed to be struck off 18 months ago but the DS01 was never submitted. The company secretary manages all of this in a spreadsheet that has not been reconciled against Companies House since February.
This is not an edge case. This is the baseline condition I find in approximately seven out of ten governance audits for multi-entity groups. And it is not because these organisations are negligent. It is because the tools they use were never designed for multi-entity governance.
Single-entity governance is a solved problem. You have one board, one set of statutory obligations, one filing calendar, one risk register, and one compliance framework. The tooling does not need to be sophisticated because the volume is manageable and the relationships are straightforward.
Multi-entity governance introduces complexity across five dimensions that single-entity tools cannot handle:
Every jurisdiction has its own company law, its own filing requirements, its own deadline calculations, and its own penalty regime. A UK private limited company files a confirmation statement annually from its incorporation date. An Irish company files an annual return with a different deadline calculation. A Delaware LLC has different requirements again. When you manage 30 entities across six jurisdictions, you are not managing one governance framework. You are managing six, simultaneously, with no tolerance for error.
The 2026 landscape has added further complexity. The UK's Economic Crime and Corporate Transparency Act 2023 has been phasing in new requirements: identity verification for directors, enhanced PSC disclosures, and stricter requirements for registered office addresses. Ireland's Companies (Corporate Governance, Enforcement and Regulatory Provisions) Act 2024 has introduced new audit committee requirements for certain private companies. Each change cascades across every entity in the relevant jurisdiction, and the company secretary needs to know which entities are affected, what the new requirements are, and what the compliance deadline is.
Group structures are rarely clean hierarchies. They include intermediate holding companies created for tax efficiency, dormant entities retained for contractual reasons, joint ventures with complex governance arrangements, and subsidiary chains where Entity A owns Entity B which owns Entity C which holds a minority stake in Entity D. Each layer adds governance obligations. Each cross-holding creates potential conflicts of interest that need to be managed at the board level.
Visualising this structure accurately is not a nice-to-have. It is a governance requirement. Directors need to understand the group structure to discharge their duties properly. Auditors need to verify it to sign off on consolidated accounts. Regulators need to see it to assess fitness and propriety. If the only accurate representation of your group structure lives in a company secretary's head or a spreadsheet on their laptop, your governance framework has a single point of failure.
In most groups, the same individuals serve as directors across multiple entities. The CEO might be a director of 15 entities. The CFO might sit on 20 boards. This creates two governance challenges.
First, conflict of interest management. When a transaction involves two group entities and the same person is a director of both, there is a potential conflict that needs to be declared, recorded, and managed in accordance with each entity's articles of association and the applicable company law. If your system cannot show you every directorship held by an individual across the group, you cannot manage conflicts systematically.
Second, capacity assessment. Corporate governance codes increasingly require boards to assess whether directors have sufficient time to discharge their duties. If a non-executive director holds positions across eight group entities plus three external appointments, the nomination committee needs visibility of the full picture before approving a new appointment.
A governance failure in one entity can cascade across the group. A late filing by a subsidiary does not just attract a penalty for that entity. It may trigger a breach of covenant in the group's financing agreements. It may require disclosure in the parent's annual report. It may affect the group's credit rating. It may create a regulatory reporting obligation if the subsidiary operates in a regulated sector.
This cascading effect means that multi-entity governance is not the sum of individual entity governance. It is a network effect where failures propagate through the structure in ways that are difficult to predict without a comprehensive view of the group's interdependencies.
Groups that grow through acquisition face an additional challenge: every deal adds entities, and those entities arrive with their own governance history, their own filing status (which may or may not be current), their own board composition, and their own compliance obligations. The governance onboarding of acquired entities is typically the most neglected phase of post-merger integration, because the deal team moves on to the next transaction while the company secretary inherits a set of entities they know nothing about.
I have categorised the approaches I encounter in audits into four tiers, from worst to best:
Tier 4: Spreadsheet-based management. The company secretary maintains a spreadsheet with entity details, filing deadlines, and officer records. This is the most common approach for groups with fewer than 20 entities. It fails because spreadsheets have no validation, no audit trail, no automated deadline calculation, no workflow management, and no integration with anything. When the company secretary leaves, the spreadsheet goes with them or becomes undecipherable to their successor.
Tier 3: Standalone entity management software. Products like Diligent Entities or EntityKeeper provide structured entity data, corporate tree visualisation, and filing deadline tracking. This is a significant improvement over spreadsheets, but it operates in isolation. The entity management system has no connection to the risk register, no visibility of contracts associated with each entity, and no awareness of M&A activity that might affect the group structure.
Tier 2: GRC platform plus entity management integration. The organisation runs a GRC platform for risk and compliance management alongside a separate entity management tool, connected by an API integration or a manual reconciliation process. This provides both capabilities but creates the governance gap I described in detail earlier: the space between the two systems where events are not captured, risks are not generated, and the board reporting layer shows an incomplete picture.
Tier 1: Unified governance platform. A single platform that models entities, risks, controls, compliance obligations, contracts, and governance events in one data architecture. Entity events automatically generate risk entries. Filing deadlines are calculated from entity data. Board reporting draws from both entity compliance status and risk register data. There is no gap because there is no integration. The data model was designed to be unified from the start.
Based on 20 years of governance audits, here is what a Tier 1 multi-entity governance architecture requires:
Every legal entity in the group has a comprehensive digital profile: jurisdiction, entity type, registration number, incorporation date, registered office, constitutional documents, share capital structure, officer appointments (current and historical), PSC details, and compliance status. This register is the single source of truth for the group's legal structure.
Filing deadlines are calculated automatically based on entity-specific data and jurisdiction-specific rules. The system knows that UK confirmation statements are due annually from the incorporation date, that Irish annual returns follow a different cycle, and that US state filings vary by state and entity type. No manual calendar management. No reliance on the company secretary remembering which entity has which deadline.
A live, interactive corporate tree that reflects the current ownership structure, including shareholding percentages, intermediate holding relationships, and joint venture arrangements. Changes to the structure (share transfers, new entity formations, entity dissolutions) are reflected in real time. The tree is available to directors, auditors, and regulators on demand.
Every entity event that has governance implications automatically generates a risk entry in the enterprise risk register. Director resignation triggers board composition and succession risks. Approaching filing deadlines trigger compliance risks. PSC changes trigger beneficial ownership risks. The system does not wait for someone to notice the event and manually create a risk entry. The injection is automatic, immediate, and auditable.
A single dashboard that shows the governance health of the entire group: entity count by jurisdiction, filing compliance percentage, overdue filings, board composition status, open governance risks by entity, and trend data over time. This dashboard is the board's primary governance reporting tool, and it draws data from both the entity register and the risk register because they share the same data model.
If you are currently managing multi-entity governance at Tier 3 or Tier 4, the migration path to Tier 1 follows a predictable sequence:
Phase 1: Entity data cleanse. Before you can manage entities in a system, you need to know what entities you have. This means a full reconciliation of your internal records against the relevant registries (Companies House, CRO, Delaware Division of Corporations, etc.). Every audit I conduct begins with this step, and every audit discovers entities that the group did not know it still had, or entities with incorrect data on file.
Phase 2: Centralise the entity register. Migrate all entity data into a single platform with structured fields, not free-text notes. This includes historical data: past directors, past registered offices, past filings. The historical record is essential for audit purposes and for understanding the governance trajectory of each entity.
Phase 3: Activate the deadline engine. Configure jurisdiction-specific filing rules and activate automated deadline calculations and reminders. Test the engine against your known filing calendar to ensure accuracy.
Phase 4: Connect to the risk register. Define the entity events that should trigger risk generation, configure the risk templates (category, severity, control linkage, ownership), and activate Automated Risk Injection. Start with high-impact events (director changes, missed filing deadlines) and expand progressively.
Phase 5: Board reporting. Deploy the group-level governance dashboard and establish the reporting cadence. Ensure that board papers reference the dashboard and that directors are trained to interpret the data.
Multi-entity governance is not a company secretarial problem. It is a group governance problem that affects risk management, compliance, audit, M&A integration, and board effectiveness. Managing it in spreadsheets or disconnected platforms creates invisible risk that only surfaces during audits, regulatory inspections, or (worst case) enforcement actions.
The best way to manage governance across multiple legal entities is to eliminate the gap between entity management and risk management entirely. One data model. One risk framework. One board reporting channel. Automated Risk Injection connecting every entity event to every governance consequence.
That is what a governance operating system does. That is what Simplif-i was built to deliver.
Compliance, simplif-i'd.
--- Source: https://simplif-i.com/api/blog/readable/grc/manage-governance-across-multiple-legal-entities Web Version: https://simplif-i.com/blog/grc/manage-governance-across-multiple-legal-entities © Simplif-i - Unified Business Management Platform