GIA Cert Governance Foundations common mistakes
GIA Cert Governance Foundations · Understand the traps and how to avoid them.
Treating governance frameworks (e.g., OECD, UK Corporate Governance Code, COSO) as interchangeable checklists and citing the wrong framework for a given principle, such as using COSO ERM to answer a board-structure question.
Candidates memorise framework names and high-level principles without mapping each framework to its purpose (e.g., COSO for internal control, OECD for corporate governance principles, King IV for outcomes-based application). Under time pressure they pattern-match on keywords.
What to do instead
Build a one-page comparison table with columns: framework, primary purpose, scope, key principles, and typical exam triggers. For each practice question, first identify the domain and the governance outcome being tested, then select the framework that directly addresses it. Review 10 mixed questions and write the reason for each framework choice.
Confusing the roles of the board chair, CEO, and lead independent director, and assigning executive responsibilities to the chair or board responsibilities to the CEO.
Real-world titles vary across organisations, and candidates rely on general impressions rather than the separation-of-duties principle. Exam scenarios often describe overlapping duties to test precise role boundaries.
What to do instead
Create a three-column role map for chair, CEO, and lead independent director covering agenda setting, board evaluation, strategy, management execution, and shareholder engagement. For each practice scenario, underline the actor and the action, then check the action against the role map before answering.
Assuming that independence is automatic once a director meets a formal criterion (e.g., no material relationship) and ignoring behavioural or tenure-based independence issues.
Candidates focus on bright-line tests in codes and overlook that independence is a judgment about character and objectivity, which can be compromised by long tenure, cross-directorships, or personal ties.
What to do instead
Study the difference between formal independence criteria and substantive independence. For each practice question, list both the objective test and the subjective indicators present in the facts, and answer only after considering whether the director can exercise independent judgment.
Describing risk appetite and risk tolerance as the same concept, or stating that risk appetite is set by management rather than the board.
The terms are often used loosely in everyday business language, and candidates conflate the board's role in setting appetite with management's role in implementing tolerance limits.
What to do instead
Memorise the distinction: risk appetite is the amount and type of risk the board is willing to accept in pursuit of strategy; risk tolerance is the acceptable variation around that appetite, operationalised by management. For practice, write a one-sentence definition of each and identify who owns each in three different scenarios.
Treating internal controls as solely a finance and audit function and failing to recognise the board's overall responsibility for the control environment, including tone at the top and entity-level controls.
Candidates associate controls with accounting and audit committees, so they miss governance-level controls such as board oversight, code of conduct, and whistleblowing mechanisms.
What to do instead
Map the COSO control environment components to board actions: integrity and ethical values (code of conduct), board independence and oversight, organisational structure, commitment to competence, and accountability. Practise classifying controls as entity-level, process-level, or detective/preventive before answering.
Answering compliance questions by citing the strict legal minimum and ignoring the ethical conduct and spirit-of-the-law dimension that governance codes expect.
Candidates equate compliance with legality and overlook that governance exams often test whether behaviour aligns with ethical principles and stakeholder expectations beyond statutory requirements.
What to do instead
For every compliance scenario, ask two questions: what does the law require, and what would an ethical governance framework expect? Review the code of conduct and ethics provisions in the main governance codes, and practise writing answers that address both legal compliance and ethical conduct.
Confusing stakeholder accountability with shareholder primacy and failing to identify which stakeholders have legitimate claims or how engagement should be reported.
Candidates carry assumptions from one jurisdiction's model (e.g., shareholder-centric) and apply them universally, missing that many governance frameworks require balanced consideration of employees, customers, suppliers, and communities.
What to do instead
Study the difference between shareholder and stakeholder models and the concept of material stakeholders. For each scenario, list the affected stakeholder groups, their legitimate interests, and the appropriate engagement or disclosure mechanism before selecting an answer.
Misidentifying the purpose and reporting lines of internal audit versus external audit, such as saying internal audit reports to the CEO or that external audit provides assurance on internal controls to the board.
Both are called audit, and candidates blur their objectives, audiences, and independence requirements. Exam questions often test reporting lines and scope.
What to do instead
Build a comparison table covering objective, scope, reporting line, independence, and primary audience for internal and external audit. Emphasise that internal audit reports functionally to the audit committee and administratively to the CEO, while external audit reports to shareholders and the audit committee.
Treating board evaluation as a compliance box-ticking exercise and failing to describe the full cycle of self-assessment, independent review, and follow-up actions.
Candidates remember that evaluations happen annually but not the process, criteria, or the requirement to act on findings. They therefore choose superficial answers.
What to do instead
Learn the evaluation cycle: purpose and scope, criteria (board composition, dynamics, information quality, strategy oversight), methods (questionnaires, interviews, independent facilitation), reporting to the board, and an action plan with follow-up. Practise describing a complete cycle in 5–6 sentences for a sample company.
Writing policy and reporting answers that list required documents (e.g., code of conduct, annual report) without explaining the process controls that make them effective, such as approval, communication, monitoring, and escalation.
Candidates memorise document names from governance codes and assume the existence of a policy equals good governance, missing the implementation and assurance aspects tested in scenario questions.
What to do instead
For each policy, use a five-part template: ownership and approval, content and scope, communication and training, monitoring and breach handling, and review cycle. Apply the template to three policies (code of conduct, risk management, whistleblowing) and write a short paragraph for each.