Governance: Accountability, Structure, and the Board's Role
What governance actually is
Governance is the system of direction and control that determines how objectives are set, how performance is monitored, and who answers for outcomes. For a CGIC candidate the working definition matters less than the logic: governance allocates authority and accountability, and it must be documented so that authority can be traced.
Concepts to master
- Three lines model: management owns risk (first line), a risk/compliance function provides independent oversight (second line), internal audit gives independent assurance (third line). Audit's independence collapses if it designs or operates controls.
- Board committees: audit, risk, and remuneration committees typically need independent membership; the audit committee should have a direct line to internal audit and external auditors.
- Tone at the top vs. tone in the middle: senior commitment is necessary but insufficient; middle managers translate policy into daily behavior.
- Delegation vs. abdication: authority may be delegated; accountability generally may not.
Traps in questions
Questions often offer an attractive answer that has the board performing management work. The board oversees and challenges; it does not run operations. Another trap is confusing independence with seniority - a very senior executive is still not independent. Watch for options that place internal audit under the CFO.
Worked example / rule of thumb
An internal audit manager is asked to help implement a new procurement system by writing the approval workflow. The correct response is to decline operating responsibility and instead keep an advisory, assurance-focused role, with any design input documented and reviewed to protect independence. Rule of thumb: if the assurance provider built it, it cannot objectively assure it.