Governance gets a bad reputation in program delivery for a fair reason: a lot of it is designed primarily to produce a record that oversight occurred, not to actually change what the program does. That kind of governance adds time without adding protection, and people notice the tradeoff even when they can't always name it.
Governance that actually works starts from a different question. Instead of asking what needs to be reviewed, it asks what decision, if made badly, would be expensive or difficult to reverse later, and builds review specifically around those decisions rather than around a fixed calendar of checkpoints that apply the same scrutiny to everything regardless of stakes. A small configuration change and a major scope decision shouldn't go through the same process, and in too many programs, they do.
This kind of governance is faster in practice, not slower, because it stops spending review time on low-stakes decisions that didn't need it, freeing that time and attention for the handful of decisions that actually warranted scrutiny. The discipline isn't in adding more oversight. It's in being precise about where oversight is actually buying protection and removing it everywhere else.
The hardest part of building this kind of governance is usually political, not technical: it requires someone to say explicitly that a given review step isn't earning its cost, which can read as a criticism of whoever instituted it. That conversation is worth having directly rather than letting governance accumulate by default, because governance that accumulates without ever being pruned eventually becomes indistinguishable from the bureaucracy it was meant to prevent.