operational vs governance evidence