GIA Cert Governance Foundations cheat sheet

Governance is the system of rules, practices, and processes by which an organisation is directed and controlled; it allocates rights and responsibilities among board, management, and shareholders.

Agency theory holds that separating ownership from control creates conflicts of interest; governance mechanisms (monitoring, incentives, disclosure) are designed to reduce agency costs.

Stakeholder theory broadens accountability beyond shareholders to employees, customers, creditors, regulators, and communities affected by the entity.

Stewardship theory assumes managers are trustworthy custodians; it justifies empowering management and emphasising long-term value over tight monitoring.

Principal frameworks: OECD Principles of Corporate Governance (shareholder rights, equitable treatment, disclosure, board responsibilities) and national codes issued on a comply-or-explain or rules-based basis.

Comply-or-explain requires a statement of deviation with reasons; rules-based regimes (for example statutory listing rules) mandate compliance and prescribe penalties for breach.

The governance chain runs from owners (shareholders) through the board to management and staff; each link carries delegated authority and a corresponding duty to account upward.

Separation of the roles of chair and chief executive is a structural control against concentration of power; combined roles require a designated senior independent director as counterbalance.

Governance codes typically address board composition, independence, committees, risk oversight, remuneration, audit, and shareholder engagement; deviations must be disclosed and explained.

The board's core duties are to set strategy, appoint and oversee senior management, approve risk appetite and financial plans, and account to shareholders for stewardship of assets.

Independent non-executive directors have no material business, employment, family, or advisory relationship with the company; independence tests usually include a tenure cap (commonly around nine to twelve years).

Mandatory or recommended committees: audit (financial reporting, external and internal audit, controls), remuneration (executive pay), and nomination (board composition, succession); risk committees are common in financial services.

The audit committee should comprise independent non-executives, include at least one financial expert, and meet the external auditor without management present at least annually.

Chair leads the board, sets agendas, and promotes constructive challenge; the CEO leads management and executes strategy; the company secretary supports governance and board information flows.

Board effectiveness depends on an appropriate mix of skills, experience, diversity, and independence, matched to a skills matrix reviewed during nomination and succession planning.

Board evaluation - internal self-assessment or externally facilitated review - should occur at least annually, with outcomes feeding director development and committee composition.

A quorum, conflict-of-interest recusal rules, and a schedule of reserved matters (decisions retained by the board) define the formal boundary between board and management authority.

Directors owe fiduciary duties of loyalty and care plus statutory duties: act within powers, promote company success, exercise independent judgement, avoid conflicts, and declare interests.

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of objectives; risk tolerance sets quantified limits within that appetite.

The three lines model: first line (operational management owns and manages risk), second line (risk and compliance functions set frameworks and monitor), third line (internal audit provides independent assurance).

COSO Internal Control - Integrated Framework has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

COSO ERM aligns risk with strategy and performance across governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting.

Control types: preventive (authorisation, segregation of duties, access limits), detective (reconciliations, exception reports), and corrective (remediation, incident response); key controls are those whose failure would materially affect objectives.

Segregation of duties separates authorisation, custody of assets, recording, and reconciliation so no single person controls an entire transaction cycle.

Risk registers record each risk's description, owner, inherent and residual rating, controls, and treatment plan; heat maps plot likelihood against impact.

The board approves risk appetite and receives regular risk reporting; management operates the framework; internal audit evaluates design and operating effectiveness of controls.

Emerging and principal risks (cyber, climate, conduct, supply chain) require horizon scanning and scenario analysis, with escalation triggers defined in advance.

Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational damage from failure to comply with applicable laws, regulations, and codes of conduct.

A compliance programme typically comprises a risk assessment, policies and procedures, training, monitoring and testing, a whistleblowing channel, and remediation tracking.

The compliance function is part of the second line; it advises, monitors, and reports, but must not own operational risk decisions that belong to the business.

Tone at the top - demonstrated by board and executive behaviour - is the strongest predictor of ethical culture; codes of conduct translate values into expected behaviours.

Whistleblowing arrangements must allow confidential or anonymous reporting, protect reporters from retaliation, and provide independent investigation and escalation to the audit committee.

Conflicts of interest are managed by identifying, recording in a register, disclosing, and where necessary recusing or divesting; gifts and hospitality policies set approval thresholds.

Market abuse, insider dealing, bribery, sanctions, and data protection are common high-priority regulatory areas requiring specific controls, monitoring, and breach reporting.

Regulatory change management tracks new rules, assigns impact assessment and implementation owners, and evidences compliance through a regulatory obligations register.

Breach reporting duties often require notification to regulators within fixed timeframes (for example data protection breaches without undue delay), with root-cause analysis and remedial action.

Accountability requires that decision-makers answer for outcomes to those affected; transparency supplies the information stakeholders need to hold them to account.

Shareholder rights include voting on directors, auditors, and remuneration, receiving timely information, participating in general meetings, and approving major transactions.

The annual report is the principal accountability vehicle: strategic report, governance statement (including code compliance), directors' remuneration report, and audited financial statements.

Materiality governs disclosure: information is material if omitting or misstating it could influence stakeholder decisions; sustainability and climate disclosures increasingly fall within this test.

Engagement mechanisms include investor roadshows, proxy voting and stewardship codes, annual general meetings, employee voice arrangements, and customer and community consultation.

Stakeholder mapping assesses each group's interest, influence, and legitimate expectations to prioritise engagement and disclosure effort.

Integrated reporting connects strategy, governance, performance, and prospects, explaining how value is created or eroded over time across multiple capitals.

Transparency has limits: commercially sensitive information, personal data, and legally privileged material may be withheld, but withholding should be justified and consistently applied.

Two-way dialogue - not one-way reporting - converts stakeholder feedback into board agenda items, risk assessments, and policy revisions.

Internal audit provides independent, objective assurance on governance, risk management, and controls; it reports functionally to the audit committee and administratively to the CEO.

External audit expresses an opinion on whether financial statements are true and fair (or present fairly); it is appointed by shareholders and must be independent of management.

The audit opinion types are unmodified (clean), qualified, adverse, and disclaimer; key audit matters disclose the areas of highest assessed risk and judgement.

Auditor independence safeguards include rotation of the engagement partner (commonly five to seven years), restrictions on non-audit services, and audit committee approval of fees.

Internal audit planning is risk-based: an audit universe is assessed for risk, and the plan allocates coverage, with the plan approved by the audit committee.

Findings are rated by severity and tracked to closure; overdue high-severity actions escalate to the audit committee with agreed remediation dates and owners.

Performance monitoring uses KPIs and KRIs linked to strategic objectives, with defined thresholds, reporting cadence, and escalation routes to the board.

Assurance mapping consolidates evidence from management, compliance, internal audit, and external audit to show the coverage and reliability of assurance over each principal risk.

The audit committee reviews financial reporting judgements, the effectiveness of internal control and internal audit, and the external auditor's independence and performance.

A policy framework defines a hierarchy: board-approved policies (mandatory, enterprise-wide), management standards and procedures (how to comply), and guidance (recommended practice).

Each policy needs an owner, scope, approval authority, review cycle, version control, and effective date; annual review is a common minimum, with trigger reviews after incidents or regulatory change.

Delegation of authority schedules state monetary and decision limits for each role and committee; matters outside limits escalate to the next level up to the board.

Board and committee processes include an annual agenda cycle, papers issued in advance (commonly five to seven working days), minutes recording decisions, and an action log.

The company secretary maintains the statutory registers, manages meeting logistics, advises on governance, and ensures decisions are properly recorded and communicated.

Reporting to the board should be decision-useful: a dashboard covering strategy, performance, risk, compliance, people, and finance, with exceptions highlighted and clear recommendations.

Policy exceptions require documented approval at the level defined in the framework, with compensating controls and a time limit before escalation.

Documented processes support the control environment: evidence of approval, segregation of duties, and retention schedules enable audit and regulatory inspection.

Governance reporting lines up the annual report, committee reports, and regulatory filings, so that each disclosed statement is traceable to underlying board decisions and records.

Apply the comply-or-explain test: identify the code provision, state whether the entity complies, and if not, give reasons and any alternative practice adopted.

Use agency theory to predict control design: where ownership and control separate, expect monitoring, incentive alignment, and disclosure mechanisms to appear.

Distinguish rules-based from principles-based regimes: rules prescribe specific conduct and penalties, principles set outcomes and rely on judgement plus disclosure.

Trace accountability upward through the governance chain: management to board, board to shareholders, and board to regulators under statutory duties.

Check structural independence: separate chair and CEO, a majority-independent board, and independent-led audit, remuneration, and nomination committees.

Apply independence tests: employment, material contracts, family ties, advisory fees, and tenure beyond the code threshold each disqualify independence.

Allocate matters correctly: strategy, risk appetite, financial approval, and senior appointments are reserved to the board; execution is delegated to management.

Require audit committee composition of independent non-executives with at least one financial expert, plus private sessions with external and internal audit.

Use a skills matrix to compare required competencies with current directors and to direct recruitment and succession decisions.

Schedule annual board and committee evaluations, with external facilitation periodically, and record resulting actions in the board action log.

Assign each principal risk to a named executive owner and map it to at least one assurance provider across the three lines.

Rate risk as inherent (before controls) and residual (after controls); escalate where residual exposure exceeds the approved tolerance.

Test control design and operating effectiveness separately; a well-designed control that is not operating is an ineffective control.

Verify segregation of duties across authorisation, custody, recording, and reconciliation; where impractical, apply compensating monitoring controls.

Map controls to the five COSO components to identify gaps in the control environment, risk assessment, control activities, information and communication, or monitoring.

Build a regulatory obligations register: map each obligation to a policy, control owner, monitoring activity, and evidence source.

Classify incidents by regulatory notification trigger and deadline; escalate reportable breaches to the board or audit committee promptly.

Operate the conflicts register: record interests, apply disclosure and recusal, and review at least annually and on any change of circumstances.

Protect whistleblowers by offering confidential and anonymous channels, independent investigation, and a documented non-retaliation policy.

Assess ethical culture using conduct metrics, training completion, speak-up volumes, and outcomes of investigations, reported to the board.

Apply the materiality test to each disclosure: would omission or misstatement influence a stakeholder's decision?

Map stakeholders by influence and interest, then set engagement frequency, channel, and the board owner for each material group.

Verify shareholder rights are operable: notice periods, proxy voting, attendance at general meetings, and approval of major transactions.

Cross-check the governance statement against the code: each provision is either complied with or explained, with no unexplained gaps.

Route stakeholder feedback into board agendas, risk registers, and policy reviews so engagement produces documented action.

Confirm internal audit independence: functional reporting to the audit committee, unrestricted access to records, and no operational management duties.

Track audit findings by severity and due date; escalate overdue high-severity items to the audit committee with a remediation plan.

Confirm external auditor safeguards: partner rotation within the code period, non-audit service limits, and audit committee approval of fees.

Build an assurance map showing, for each principal risk, which providers give assurance and the strength of that assurance.

Set KPIs with baselines, targets, and thresholds; report exceptions with root cause and agreed corrective action.

Classify each document as board policy, management standard, procedure, or guidance, and route approval to the correct authority level.

Check every policy for owner, scope, approval date, review date, version, and linked controls before publication.

Apply the delegation of authority schedule to each decision; escalate anything above the role limit to the next level up to the board.

Verify board paper timeliness and content: issued in advance, decision-focused, with risk, financial, and legal implications stated.

Record decisions, dissent, and actions in minutes and the action log; confirm follow-up status at the next meeting.

Governance is the system of rules, practices, and processes by which an organisation is directed and controlled; it allocates rights and responsibilities among board, management, and shareholders.

Agency theory holds that separating ownership from control creates conflicts of interest; governance mechanisms (monitoring, incentives, disclosure) are designed to reduce agency costs.

Stakeholder theory broadens accountability beyond shareholders to employees, customers, creditors, regulators, and communities affected by the entity.

Stewardship theory assumes managers are trustworthy custodians; it justifies empowering management and emphasising long-term value over tight monitoring.

Principal frameworks: OECD Principles of Corporate Governance (shareholder rights, equitable treatment, disclosure, board responsibilities) and national codes issued on a comply-or-explain or rules-based basis.

Comply-or-explain requires a statement of deviation with reasons; rules-based regimes (for example statutory listing rules) mandate compliance and prescribe penalties for breach.

The governance chain runs from owners (shareholders) through the board to management and staff; each link carries delegated authority and a corresponding duty to account upward.

Separation of the roles of chair and chief executive is a structural control against concentration of power; combined roles require a designated senior independent director as counterbalance.

Governance codes typically address board composition, independence, committees, risk oversight, remuneration, audit, and shareholder engagement; deviations must be disclosed and explained.

The board's core duties are to set strategy, appoint and oversee senior management, approve risk appetite and financial plans, and account to shareholders for stewardship of assets.

Independent non-executive directors have no material business, employment, family, or advisory relationship with the company; independence tests usually include a tenure cap (commonly around nine to twelve years).

Mandatory or recommended committees: audit (financial reporting, external and internal audit, controls), remuneration (executive pay), and nomination (board composition, succession); risk committees are common in financial services.

The audit committee should comprise independent non-executives, include at least one financial expert, and meet the external auditor without management present at least annually.

Chair leads the board, sets agendas, and promotes constructive challenge; the CEO leads management and executes strategy; the company secretary supports governance and board information flows.

Board effectiveness depends on an appropriate mix of skills, experience, diversity, and independence, matched to a skills matrix reviewed during nomination and succession planning.

Board evaluation - internal self-assessment or externally facilitated review - should occur at least annually, with outcomes feeding director development and committee composition.

A quorum, conflict-of-interest recusal rules, and a schedule of reserved matters (decisions retained by the board) define the formal boundary between board and management authority.

Directors owe fiduciary duties of loyalty and care plus statutory duties: act within powers, promote company success, exercise independent judgement, avoid conflicts, and declare interests.

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of objectives; risk tolerance sets quantified limits within that appetite.

The three lines model: first line (operational management owns and manages risk), second line (risk and compliance functions set frameworks and monitor), third line (internal audit provides independent assurance).

COSO Internal Control - Integrated Framework has five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

COSO ERM aligns risk with strategy and performance across governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting.

Control types: preventive (authorisation, segregation of duties, access limits), detective (reconciliations, exception reports), and corrective (remediation, incident response); key controls are those whose failure would materially affect objectives.

Segregation of duties separates authorisation, custody of assets, recording, and reconciliation so no single person controls an entire transaction cycle.

Risk registers record each risk's description, owner, inherent and residual rating, controls, and treatment plan; heat maps plot likelihood against impact.

The board approves risk appetite and receives regular risk reporting; management operates the framework; internal audit evaluates design and operating effectiveness of controls.

Emerging and principal risks (cyber, climate, conduct, supply chain) require horizon scanning and scenario analysis, with escalation triggers defined in advance.

Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational damage from failure to comply with applicable laws, regulations, and codes of conduct.

A compliance programme typically comprises a risk assessment, policies and procedures, training, monitoring and testing, a whistleblowing channel, and remediation tracking.

The compliance function is part of the second line; it advises, monitors, and reports, but must not own operational risk decisions that belong to the business.

Tone at the top - demonstrated by board and executive behaviour - is the strongest predictor of ethical culture; codes of conduct translate values into expected behaviours.

Whistleblowing arrangements must allow confidential or anonymous reporting, protect reporters from retaliation, and provide independent investigation and escalation to the audit committee.

Conflicts of interest are managed by identifying, recording in a register, disclosing, and where necessary recusing or divesting; gifts and hospitality policies set approval thresholds.

Market abuse, insider dealing, bribery, sanctions, and data protection are common high-priority regulatory areas requiring specific controls, monitoring, and breach reporting.

Regulatory change management tracks new rules, assigns impact assessment and implementation owners, and evidences compliance through a regulatory obligations register.

Breach reporting duties often require notification to regulators within fixed timeframes (for example data protection breaches without undue delay), with root-cause analysis and remedial action.

Accountability requires that decision-makers answer for outcomes to those affected; transparency supplies the information stakeholders need to hold them to account.

Shareholder rights include voting on directors, auditors, and remuneration, receiving timely information, participating in general meetings, and approving major transactions.

The annual report is the principal accountability vehicle: strategic report, governance statement (including code compliance), directors' remuneration report, and audited financial statements.

Materiality governs disclosure: information is material if omitting or misstating it could influence stakeholder decisions; sustainability and climate disclosures increasingly fall within this test.

Engagement mechanisms include investor roadshows, proxy voting and stewardship codes, annual general meetings, employee voice arrangements, and customer and community consultation.

Stakeholder mapping assesses each group's interest, influence, and legitimate expectations to prioritise engagement and disclosure effort.

Integrated reporting connects strategy, governance, performance, and prospects, explaining how value is created or eroded over time across multiple capitals.

Transparency has limits: commercially sensitive information, personal data, and legally privileged material may be withheld, but withholding should be justified and consistently applied.

Two-way dialogue - not one-way reporting - converts stakeholder feedback into board agenda items, risk assessments, and policy revisions.

Internal audit provides independent, objective assurance on governance, risk management, and controls; it reports functionally to the audit committee and administratively to the CEO.

External audit expresses an opinion on whether financial statements are true and fair (or present fairly); it is appointed by shareholders and must be independent of management.

The audit opinion types are unmodified (clean), qualified, adverse, and disclaimer; key audit matters disclose the areas of highest assessed risk and judgement.

Auditor independence safeguards include rotation of the engagement partner (commonly five to seven years), restrictions on non-audit services, and audit committee approval of fees.

Internal audit planning is risk-based: an audit universe is assessed for risk, and the plan allocates coverage, with the plan approved by the audit committee.

Findings are rated by severity and tracked to closure; overdue high-severity actions escalate to the audit committee with agreed remediation dates and owners.

Performance monitoring uses KPIs and KRIs linked to strategic objectives, with defined thresholds, reporting cadence, and escalation routes to the board.

Assurance mapping consolidates evidence from management, compliance, internal audit, and external audit to show the coverage and reliability of assurance over each principal risk.

The audit committee reviews financial reporting judgements, the effectiveness of internal control and internal audit, and the external auditor's independence and performance.

A policy framework defines a hierarchy: board-approved policies (mandatory, enterprise-wide), management standards and procedures (how to comply), and guidance (recommended practice).

Each policy needs an owner, scope, approval authority, review cycle, version control, and effective date; annual review is a common minimum, with trigger reviews after incidents or regulatory change.

Delegation of authority schedules state monetary and decision limits for each role and committee; matters outside limits escalate to the next level up to the board.

Board and committee processes include an annual agenda cycle, papers issued in advance (commonly five to seven working days), minutes recording decisions, and an action log.

The company secretary maintains the statutory registers, manages meeting logistics, advises on governance, and ensures decisions are properly recorded and communicated.

Reporting to the board should be decision-useful: a dashboard covering strategy, performance, risk, compliance, people, and finance, with exceptions highlighted and clear recommendations.

Policy exceptions require documented approval at the level defined in the framework, with compensating controls and a time limit before escalation.

Documented processes support the control environment: evidence of approval, segregation of duties, and retention schedules enable audit and regulatory inspection.

Governance reporting lines up the annual report, committee reports, and regulatory filings, so that each disclosed statement is traceable to underlying board decisions and records.

Apply the comply-or-explain test: identify the code provision, state whether the entity complies, and if not, give reasons and any alternative practice adopted.

Use agency theory to predict control design: where ownership and control separate, expect monitoring, incentive alignment, and disclosure mechanisms to appear.

Distinguish rules-based from principles-based regimes: rules prescribe specific conduct and penalties, principles set outcomes and rely on judgement plus disclosure.

Trace accountability upward through the governance chain: management to board, board to shareholders, and board to regulators under statutory duties.

Check structural independence: separate chair and CEO, a majority-independent board, and independent-led audit, remuneration, and nomination committees.

Apply independence tests: employment, material contracts, family ties, advisory fees, and tenure beyond the code threshold each disqualify independence.

Allocate matters correctly: strategy, risk appetite, financial approval, and senior appointments are reserved to the board; execution is delegated to management.

Require audit committee composition of independent non-executives with at least one financial expert, plus private sessions with external and internal audit.

Use a skills matrix to compare required competencies with current directors and to direct recruitment and succession decisions.

Schedule annual board and committee evaluations, with external facilitation periodically, and record resulting actions in the board action log.

Assign each principal risk to a named executive owner and map it to at least one assurance provider across the three lines.

Rate risk as inherent (before controls) and residual (after controls); escalate where residual exposure exceeds the approved tolerance.

Test control design and operating effectiveness separately; a well-designed control that is not operating is an ineffective control.

Verify segregation of duties across authorisation, custody, recording, and reconciliation; where impractical, apply compensating monitoring controls.

Map controls to the five COSO components to identify gaps in the control environment, risk assessment, control activities, information and communication, or monitoring.

Build a regulatory obligations register: map each obligation to a policy, control owner, monitoring activity, and evidence source.

Classify incidents by regulatory notification trigger and deadline; escalate reportable breaches to the board or audit committee promptly.

Operate the conflicts register: record interests, apply disclosure and recusal, and review at least annually and on any change of circumstances.

Protect whistleblowers by offering confidential and anonymous channels, independent investigation, and a documented non-retaliation policy.

Assess ethical culture using conduct metrics, training completion, speak-up volumes, and outcomes of investigations, reported to the board.

Apply the materiality test to each disclosure: would omission or misstatement influence a stakeholder's decision?

Map stakeholders by influence and interest, then set engagement frequency, channel, and the board owner for each material group.

Verify shareholder rights are operable: notice periods, proxy voting, attendance at general meetings, and approval of major transactions.

Cross-check the governance statement against the code: each provision is either complied with or explained, with no unexplained gaps.

Route stakeholder feedback into board agendas, risk registers, and policy reviews so engagement produces documented action.

Confirm internal audit independence: functional reporting to the audit committee, unrestricted access to records, and no operational management duties.

Track audit findings by severity and due date; escalate overdue high-severity items to the audit committee with a remediation plan.

Confirm external auditor safeguards: partner rotation within the code period, non-audit service limits, and audit committee approval of fees.

Build an assurance map showing, for each principal risk, which providers give assurance and the strength of that assurance.

Set KPIs with baselines, targets, and thresholds; report exceptions with root cause and agreed corrective action.

Classify each document as board policy, management standard, procedure, or guidance, and route approval to the correct authority level.

Check every policy for owner, scope, approval date, review date, version, and linked controls before publication.

Apply the delegation of authority schedule to each decision; escalate anything above the role limit to the next level up to the board.

Verify board paper timeliness and content: issued in advance, decision-focused, with risk, financial, and legal implications stated.

Record decisions, dissent, and actions in minutes and the action log; confirm follow-up status at the next meeting.