[yet-another-guy]

There is of course value in stopping stupid decisions, and every org should have some form of control for avoiding a director going completely crazy. But when you implement such independent compliance functions then how do you get anything done other than maintaining the status quo?

Think about developing a new automation project/feature that reduces some cost while increasing some risk in a controlled way. If you have a decision body with people who only own costs vs. people who only own risks you'll be in deadlocked forever.