Three years into a programme review at one private university, the academic registrar’s office made a small discovery. The institution’s hardship scholarship, a means-tested fee waiver intended for students whose family circumstances had changed mid-degree, had been awarded eleven times in the previous academic year. According to the original policy, written and approved by the senate in 2018, it should have been awarded at most three times per faculty.
The policy was clear. The eligibility criteria were documented. The approval workflow was specified in writing. The institution had a campus management system that processed scholarship applications and disbursements. None of this had prevented the rule from quietly being applied differently across faculties, by different staff, for several years running.
The scholarship was not unique. A subsequent audit identified at least nine other institutional policies that existed on paper but were not actually being enforced by the system: academic progression thresholds, financial holds, examination eligibility checks, supervisor approval requirements for postgraduate research. Each of them lived in a policy document somewhere. None of them lived in the platform.
Its governance was a description of how the university intended to operate, not a description of how it actually operated.
The gap between policy and operation
This gap shows up in almost every institution that runs operations on a campus management system. The reasons are structural.
Policies get written by committees and approved by senates. They get handed to operational teams to implement. Staff mostly enforce them correctly. But when borderline cases come up, and they always do, the decision depends on who is on duty, what precedent they remember, and which supervisor they happen to ask. Over time, precedent drifts from policy, and the institution doesn’t notice because both still look compliant when any individual case is sampled.
A policy enforced by judgement is a policy that depends on who is on duty. The institution’s governance becomes a function of its institutional memory rather than its institutional rules. When the staff who hold that memory retire, or move departments, or simply forget, the policy quietly stops applying the way it was written.
This is what people mean when they say a university’s governance has drifted. The policies haven’t changed. The enforcement has.
What embedded governance actually looks like
A policy is embedded in a system when the system, not the staff, applies the policy.
In an institution where the hardship scholarship rule is documented but not embedded, every step depends on a staff member knowing the policy, applying it correctly, and routing it manually. In an institution where the same rule is embedded, the application form filters ineligible cases before a staff member sees them, the faculty cap is enforced automatically, and every disbursement is traced to the rule that authorised it. The system does what the policy says, the same way every time.
The same principle applies across the institution.
Academic progression rules can live in a registrar’s PDF, enforced by faculty handbook readings. Or they can be encoded in the platform, so a student who fails the threshold is flagged before semester registration opens.
Financial holds can be applied manually by the finance office when they remember. Or they can block course registration the moment a student’s account goes into arrears.
Approval hierarchies can be respected by staff who happen to know the chain. Or they can be wired into the system so that the wrong person physically cannot sign off on the wrong thing.
In each case, the policy itself doesn’t change. What changes is who enforces it. When the system enforces it, the policy operates the same way every time, for every student, with every member of staff, regardless of who happens to be on duty. That is what people are reaching for when they describe their campus platform as university governance software, even if they don’t always get it.
Governance drift is governance failure
A university whose policies are not embedded in its system isn’t failing to have governance. It’s failing to have consistent governance. Those are different problems, and the second one is harder to see.
A policy that is applied correctly seventy percent of the time looks compliant in any individual case. The senate believes the policy is being followed. The operational team believes they are following it. The audit, if it happens at all, samples a handful of cases and finds them mostly in order. The thirty percent of cases that are decided differently, usually by junior staff, often during busy periods, sometimes for reasons that get justified after the fact, disappear into the institutional background.
This is governance theatre. The documentation creates the appearance of control without the reality, and most of the time nobody notices, because the appearance is the only thing being measured.
This is also how universities accumulate the kind of inconsistencies that surface years later in accreditation reviews. For Malaysian institutions in particular, where the Malaysian Qualifications Agency runs structured programme audits and the Ministry of Higher Education requires periodic compliance reporting, the cost of those inconsistencies becomes concrete. A programme that is audited and found to be applying its own progression rules unevenly across faculties has a problem that’s harder to explain than a programme that fails a check outright. Inconsistency is worse than failure because it suggests the institution isn’t aware of how it actually operates.
An institution that can demonstrate its policies are enforced by the system, not by staff memory, walks into that audit with a different kind of evidence. It isn’t showing the auditors what it intended to do. It’s showing them what actually happened, every time, for every student. The documentation matters. The enforcement matters more.
A simple institutional test
There’s a useful exercise institutions can run to find out where they actually stand. Pick three institutional policies: a progression rule, a financial enforcement rule, and an approval workflow. For each one, ask two questions. Where is this policy written, and where is it enforced?
If the answers to both questions are the same, and the system both documents the rule and applies it, the policy is embedded. If the policy is written in a handbook but enforced by staff working from memory, it is not embedded. If the policy is enforced by a workflow that nobody in the room can quite describe, the institution is operating on accumulated precedent rather than written policy, and the gap between the two is wider than anyone is comfortable admitting.
Most institutions, when they run this exercise honestly, are surprised by the answer. One institution that ran it discovered that its academic progression policy, which the senate had revised eighteen months earlier, was still being enforced under the old threshold by three of its five faculties. The new policy had been distributed. It had never been configured.
That isn’t an unusual finding. It’s the typical one.
Where this leads
The institutions that emerge from this exercise with a clear answer are the ones that have invested in embedding their governance into the platform itself. Their policies and their workflows are the same artefact, configured in one place, applied automatically, and updated when the policy is updated. They have treated the campus platform as an institutional policy management system in the literal sense: the place where the institution’s rules live and operate, not the place where its records happen to be stored.
That upfront work is real, and it’s the reason most institutions don’t do it. Translating accumulated institutional practice into configured rules inside a campus management platform is a serious project, often months long, involving the people who wrote the policies, the people who currently enforce them, and the people who will configure them into the system. It requires the institution to write down, in operational detail, what it actually does, which is a harder exercise than most universities expect. Most prefer to keep policies in policy documents because that’s what they’re used to, and because changing the documentation is easier than changing the system.
But the downstream cost of not doing it is almost always larger, and it compounds. Every year that a policy lives in writing without living in the platform, the gap between intention and operation widens by a small, untracked margin. Three years in, the institution discovers it doesn’t know how its own scholarship rules are being applied. Five years in, it discovers it has been awarding qualifications under a progression standard the senate revised before the cohort enrolled. Eight years in, the audit finding surfaces and the institution is asked, in writing, to explain how this happened in a system designed specifically to prevent it.
The policy was always there. The enforcement was always missing. The rest was theatre.
