CGIC cheat sheet

Agency problem: separation of ownership (shareholders) and control (managers) creates incentive for managers to pursue self-interest over shareholder value.

Board committees typically required: audit, remuneration/compensation, and nomination; audit committee members should be independent and financially literate.

OECD Principles of Corporate Governance pillars: rights of shareholders, equitable treatment, role of stakeholders, disclosure and transparency, board responsibilities.

Two-tier board (supervisory + management board) is common in Germany; unitary board with independent directors is common in UK/US.

Independence test typically fails if director is a former employee, has a material consulting contract, or has family ties to executives.

Shareholder activism and proxy contests are external control mechanisms; the market for corporate control (takeovers) disciplines underperforming managers.

Code of conduct vs. code of ethics: conduct codes govern legal/regulatory behavior; ethics codes address broader values and principles.

Separation of CEO and chair roles reduces concentration of power; a lead independent director serves when roles are combined.

Risk = likelihood × impact; inherent risk is assessed before controls, residual risk after controls; risk appetite is the acceptable residual level.

COSO ERM components: governance and culture, strategy and objective-setting, performance, review and revision, information/communication/reporting.

Risk response options: avoid, reduce/mitigate, transfer/share (insurance, hedging), and accept.

Four T's of risk treatment: tolerate, treat, transfer, terminate.

Inherent risk rating is a function of likelihood and consequence; control risk reflects the possibility controls fail to prevent/detect a problem.

Key risk indicators (KRIs) are leading metrics with thresholds; key control indicators (KCIs) monitor control effectiveness.

Risk register captures risk description, owner, likelihood, impact, score, controls, and response.

Three lines model: first line owns and manages risk; second line provides oversight/compliance; third line (internal audit) provides independent assurance.

Risk aggregation: correlated risks cannot simply be summed; diversification reduces portfolio risk but not systemic risk.

Compliance program core elements (per US Sentencing Guidelines): standards and procedures, oversight, due care in delegation, communication/training, monitoring/auditing, incentives/discipline, and remediation.

Effective compliance programs reduce organizational sentencing culpability; the program must be followed in practice, not just documented.

Compliance risk assessment should be risk-based: prioritize by likelihood and severity of regulatory breach and by business exposure.

Whistleblowing channels must allow anonymous reporting and be free from retaliation; anti-retaliation controls are a key compliance control.

Third-party/ vendor due diligence is a compliance control for bribery, sanctions, and anti-money-laundering exposure.

Sanctions screening compares counterparties against lists (e.g., OFAC SDN, EU consolidated list); false positives require documented adjudication.

Conflicts of interest must be identified, disclosed, and managed (recusal, segregation of duties, independent oversight).

Regulatory change management: track regulatory horizon, assess impact, update policies, and evidence implementation.

Audit risk model: AR = IR × CR × DR; detection risk is the only component the auditor directly controls.

Materiality: misstatements are material if they could influence users' economic decisions; performance materiality is set below overall materiality.

Audit evidence must be sufficient (quantity) and appropriate (relevance and reliability); external evidence is generally more reliable than internal.

Internal audit independence: functionally reports to the audit committee, administratively to senior management; should not perform management functions.

Assurance engagement requires a three-party relationship: practitioner, responsible party, and intended users.

Sampling risk vs. non-sampling risk: sampling risk arises from testing a subset; non-sampling risk from human error or inappropriate procedures.

Types of audit opinions: unmodified, qualified, adverse, and disclaimer; scope limitation may lead to qualified opinion or disclaimer.

Reasonable assurance is not absolute assurance; inherent limitations include judgment, sampling, and collusion.

Control testing: test of design first, then test of operating effectiveness; substantive procedures address detection risk.

Five fundamental principles (IESBA/IFAC): integrity, objectivity, professional competence and due care, confidentiality, and professional behavior.

Conceptual framework: identify threats, evaluate significance, and address threats via safeguards or elimination of the relationship/interest.

Threat categories: self-interest, self-review, advocacy, familiarity, and intimidation.

Independence has two components: independence of mind (state of mind) and independence in appearance (perception by a reasonable third party).

Confidentiality persists after the professional relationship ends; disclosure is permitted only when legally required or authorized by the client/employer.

Integrity requires being straightforward and honest; it is not compromised by unintentional error or honest disagreement of opinion.

Objectivity requires avoiding bias, conflict of interest, or undue influence of others; gifts/hospitality can create self-interest or familiarity threats.

Professional competence requires attaining and maintaining knowledge and skill at the level required; due care means acting diligently per applicable standards.

Whistleblowing is appropriate when internal escalation fails and there is a legal or ethical obligation to report a material breach.