Kemp Little have writen guidance on governance associated with use of open source software.

They've kindly agreed to let us put it on our website