ACCA SBL cheat sheet

Mendelow matrix: plot stakeholder power against interest; high power/high interest = key players (manage closely), high power/low interest = keep satisfied, low power/high interest = keep informed, low/low = minimal effort.

Governance codes separate the roles of chair and CEO; the chair leads the board, the CEO leads management, and independence requires a majority of non-executive directors on the board.

Agency problem: managers (agents) may pursue self-interest over shareholders (principals); mitigations include performance-related pay, board monitoring and transparent reporting.

Ansoff matrix: existing/new products against existing/new markets gives market penetration, product development, market development and diversification (highest risk).

Porter's generic strategies: cost leadership, differentiation and focus; being 'stuck in the middle' with no clear advantage erodes returns.

PESTEL analyses macro-environmental factors (Political, Economic, Social, Technological, Environmental, Legal); Porter's Five Forces analyses industry attractiveness.

Culture types (Handy): power, role, task and person; a role culture relies on rules and hierarchy, a task culture on project teams.

Stakeholder salience depends on power, legitimacy and urgency; the more attributes present, the higher the priority.

Risk = likelihood x impact; a risk map plots these axes to prioritise treatment (avoid, reduce, transfer, accept).

COSO/internal control components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

Segregation of duties prevents one person controlling authorisation, custody, recording and reconciliation of the same transaction.

Fraud triangle: pressure/incentive, opportunity and rationalisation must combine for fraud to occur; removing opportunity is the strongest control lever.

TARA framework: Transfer (insurance), Avoid (exit activity), Reduce (controls), Accept (tolerate within appetite).

Ethical decision tests include the utilitarian test (greatest good), rights test (respects individuals' rights) and justice test (fairness and consistency).

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of objectives; risk tolerance is the acceptable variation around it.

Three lines model: management owns risk (first line), risk/compliance functions monitor (second line), internal audit provides independent assurance (third line).

ROCE = operating profit / capital employed; capital employed = total equity + non-current liabilities (or total assets less current liabilities).

Gross margin = gross profit / revenue; net margin = operating (net) profit / revenue; both expressed as percentages.

Current ratio = current assets / current liabilities; quick ratio excludes inventory from current assets.

Gearing = debt / (debt + equity) or debt/equity depending on convention; high gearing increases financial risk and interest sensitivity.

Asset turnover = revenue / capital employed; ROCE can be decomposed as operating margin x asset turnover (DuPont link).

Interest cover = operating profit / finance cost; a falling ratio signals reduced ability to service debt.

NPV discounts future cash flows at the cost of capital; accept if NPV > 0. IRR is the discount rate giving NPV = 0; accept if IRR > cost of capital.

The balanced scorecard uses four perspectives: financial, customer, internal process, and learning and growth; KPIs should be specific and measurable.

Big data characteristics: volume, velocity, variety, veracity and value; analytics maturity runs descriptive, diagnostic, predictive to prescriptive.

Cloud models: IaaS (infrastructure), PaaS (platform), SaaS (software); shared responsibility shifts security duties to the provider for SaaS.

Ransomware encrypts data and demands payment; mitigations include offline backups, patching, least-privilege access and user awareness.

Phishing exploits human behaviour via deceptive messages; technical controls (email filtering, MFA) plus training reduce success rates.

The diffusion of innovation curve: innovators, early adopters, early majority, late majority and laggards; the 'chasm' sits between early adopters and early majority.

Disruptive innovation starts in low-end or new markets and improves until it displaces incumbents; sustaining innovation improves existing products for current customers.

Data protection principles include lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality and accountability.

Automation and AI shift controls from manual checks to input validation, algorithm oversight and exception reporting; data quality (garbage in, garbage out) determines output reliability.

Use the report structure: purpose, findings/analysis, conclusion, recommendations; recommendations must be specific, owned and time-bound.

Professional scepticism means questioning information and evidence rather than accepting it at face value, especially from interested parties.

The 'so what?' test: every point made should link to a consequence and a recommended action for the decision-maker.

Audience adaptation: executives need conclusions and decisions first (pyramid principle), while technical readers need method and detail.

Materiality determines what to include; omit immaterial detail and highlight items that could change a decision.

Ethical communication requires accuracy, balance (presenting both favourable and unfavourable information) and no misleading omission.

A recommendation should state the action, the rationale (linked to analysis), the responsible owner and the expected impact or timing.

Conflict of interest must be disclosed and managed; independence in appearance matters as much as independence in fact.