GIA Cert Governance Practice cheat sheet

Corporate governance is the system by which companies are directed and controlled; it allocates rights and responsibilities among board, managers, shareholders, and stakeholders.

The UK Corporate Governance Code applies to premium-listed companies on a 'comply or explain' basis; the board must state how it has applied the Principles.

Board independence: at least half the board excluding the chair should be independent non-executive directors for FTSE 350 companies under the UK Code.

Separation of roles: the chair should not be the CEO; the UK Code requires a clear division of responsibilities between chair and CEO.

Board committees: audit, remuneration, and nomination committees are required for premium-listed companies; audit committee must have at least three independent NEDs (or two for smaller companies).

Directors' duties (UK Companies Act 2006 s.171-177): act within powers, promote success of the company, exercise independent judgment, exercise reasonable care/skill/diligence, avoid conflicts, not accept benefits from third parties, declare interest in proposed transactions.

Governance codes often require annual board evaluation; FTSE 350 companies should have an external evaluation at least every three years.

Shareholder rights: AGM notice, right to ask questions, proxy voting; UK requires poll votes at AGMs for premium-listed companies.

Stakeholder considerations: s.172 CA 2006 requires directors to have regard to employees, suppliers, customers, community, and environment.

Risk management process: identify, assess (likelihood and impact), treat (avoid, reduce, transfer, accept), monitor, and report.

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its objectives; risk tolerance is the acceptable variation around that appetite.

Three lines model: first line owns and manages risk; second line provides oversight, compliance, and risk functions; third line is internal audit providing independent assurance.

COSO ERM framework (2017) has five components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication, and reporting.

Risk register: a document listing identified risks, their owners, likelihood, impact, risk rating, mitigation actions, and review dates.

Inherent risk is the risk before controls; residual risk is the risk remaining after controls are applied.

Key risk indicators (KRIs) are metrics that provide early warning of increasing risk exposure; they should be measurable, relevant, and timely.

Business continuity management: ISO 22301 provides a framework for planning, establishing, implementing, operating, monitoring, reviewing, maintaining, and improving a BCMS.

Risk reporting to the board: the audit committee or board risk committee should receive regular risk reports covering top risks, changes, incidents, and control effectiveness.

Compliance function responsibilities: monitor regulatory changes, advise the business, provide training, conduct compliance risk assessments, and report to the board or audit committee.

Compliance risk assessment: evaluate likelihood and impact of regulatory breaches across business lines; prioritise monitoring and testing accordingly.

A compliance programme typically includes policies and procedures, training, monitoring and testing, issue management, and a whistleblowing mechanism.

UK Bribery Act 2010: offences include bribing, receiving a bribe, bribing a foreign public official, and failure of a commercial organisation to prevent bribery (strict liability defence: adequate procedures).

Market abuse regulation (UK MAR): prohibits insider dealing, unlawful disclosure of inside information, and market manipulation; requires disclosure of inside information as soon as possible.

Data protection: UK GDPR requires lawful basis for processing, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability; breach notification within 72 hours where required.

Anti-money laundering: risk-based approach; customer due diligence, ongoing monitoring, suspicious activity reports (SARs) to the National Crime Agency, and a nominated officer.

Compliance monitoring plan: risk-based schedule of reviews; findings should be tracked to remediation with owners and deadlines.

Whistleblowing: UK Public Interest Disclosure Act 1998 protects qualifying disclosures; organisations should have independent, confidential reporting channels.

Company secretary role: advise the board on governance, ensure compliance with statutory and regulatory requirements, manage board meetings, and maintain statutory registers.

Statutory registers (UK): register of members, register of directors, register of secretaries, register of charges, and register of people with significant control (PSC).

Board meeting administration: circulate agenda and papers in advance (typically at least 5-7 days), take minutes, record conflicts of interest, and track actions.

Quorum: the minimum number of directors required to validly transact business; specified in the articles or by board resolution.

Minutes should record: date, time, place, attendees, apologies, conflicts declared, decisions made, and actions with owners; they are prima facie evidence of proceedings.

Annual general meeting (AGM): notice period at least 21 clear days for UK public companies; private companies may hold no AGM unless required by articles.

Filing deadlines (UK): confirmation statement within 14 days of review period end; annual accounts within 9 months of accounting reference date for private companies, 6 months for public.

Directors' conflicts: authorise conflicts under s.175 CA 2006 (if articles permit); maintain a conflicts register and manage independence of decision-making.

Dividend process: board recommends final dividend (shareholder approval at AGM) or declares interim dividend; ensure distributable profits and solvency.

Shareholder communication: maintain accurate register, manage proxy voting, respond to shareholder queries, and ensure website disclosures are current.