Governance and impact risk

KPIs can smile while the programme fails

Indicators are necessary; allowing them to become the mission is dangerous. A programme optimised for 'users reached' may choose the easiest cases. A monitoring platform may report more hectares covered while excluding the least profitable territory. Strong governance asks not only whether a headline target was achieved, but who remains outside the denominator and whether someone was harmed along the way.

Islam and Cui's 2026 review identifies five interdependent dimensions: shortfall of intended positive impact; negative externalities; weak impact evidence; accountability exposure; and loss of legitimacy. A technical error can weaken evidence, create harmful decisions, trigger a legal dispute and erode public trust. Treating each risk as an isolated checkbox conceals these causal connections [R02].

Three lines of responsibility

First, management and service owners collect raw evidence, maintain quality controls and receive complaints. Second, the investment or grant committee interrogates the thesis, arbitrates trade-offs and authorises corrections. Third, independent assessment or audit tests material claims, methods and the quality of underlying data. These responsibilities can be proportionate to project size, but should not collapse into the marketing team.

A lean documentation architecture comprises an impact thesis, an investment or grant memorandum, an impact-risk register, a measurement protocol and periodic impact reviews. Original assumptions must remain dated and recoverable. Rewriting the counterfactual after a successful exit destroys the value of the evaluation.

Sustainability labels and impact evidence are not synonyms

European SFDR disclosure categories describe regulatory transparency obligations; they do not certify investor-level causal impact. In particular, an Article 8 disclosure is not an automatic impact rating [R16]. ESMA's guidelines on the use of ESG- or sustainability-related terms in fund names create separate naming and exclusion requirements. Neither compliance with naming rules nor the existence of an ESG policy substitutes for measuring additional outcomes [R17].

The dual-use boundary

Space and defence-adjacent technologies may have genuine public uses, but 'dual use' is not a positive impact conclusion. End users, intended applications, data protection, export controls, cybersecurity, surveillance risk and safeguards must be assessed for the specific use case. Civil emergency mapping and an intrusive monitoring application can share technical components while raising entirely different distributional and rights concerns.

Safeguards may require human review of automated classifications, a right to challenge, documented restrictions on data reuse, escalation procedures and authority to suspend a harmful deployment. Environmental assessment must also include material upstream effects: manufacturing, launch, orbital operations, end-of-life and debris.

When ownership changes, obligations remain

The next buyer may increase prices, discontinue free access or restrict data portability. If durable access is central to the claimed impact, exit planning needs enforceable rights, governance arrangements, pricing rules and continuing verification. The private equity manager should be able to identify what continues to work after its control ends [R07].