GIA Cert Governance Practice common mistakes
GIA Cert Governance Practice · Understand the traps and how to avoid them.
Treating corporate governance as synonymous with legal compliance, so answers to scenario questions default to 'is it lawful?' rather than assessing board effectiveness, accountability, and stakeholder balance.
Candidates with a legal or audit background have been trained to test against rules, so they reach for the statute or code provision first and stop there, missing the governance-quality dimension the question is testing.
What to do instead
Before answering any governance scenario, explicitly ask three questions in order: who is accountable to whom, through what mechanism, and how would the board know it is working. Write the mechanism (reporting line, committee, disclosure, review cycle) into your reasoning before citing any rule.
Confusing the roles of the board, its committees, and management, and answering that the board 'runs' or 'approves' operational matters that belong to executive management.
The distinction between oversight and execution is stated simply in study material but is subtle in practice, and candidates under time pressure assign every decision to the board as the safest-sounding answer.
What to do instead
Build a two-column mental table: decisions reserved to the board (strategy approval, senior appointments, risk appetite, financial reporting sign-off) versus decisions delegated to management (implementation, hiring below executive level, operational controls). Test each answer option against that table.
Naming a committee or policy as the answer to a control question without specifying its mandate, composition, authority, and reporting line.
Candidates memorise committee names and assume the name alone demonstrates control, but exam scenarios typically hinge on whether the body has the authority and independence to be effective, not on whether it exists.
What to do instead
For any committee-based answer, state four attributes: who chairs it, whether members are independent, what it can decide versus recommend, and to whom and how often it reports. If an option lacks these, it is usually the weaker choice.
Applying a single risk framework's terminology as if it were universal, and mislabelling inherent, residual, target, and current risk when a scenario describes a control already in place.
Frameworks overlap in vocabulary but differ in definitions, and candidates learn one set of labels and apply them mechanically without checking whether the described control has already been applied.
What to do instead
Read the scenario for the presence of controls first. If controls are described as operating, the figure is residual; if the question asks what exposure would be without them, it is inherent. State the definition you are using in one clause before choosing.
Treating risk appetite, risk tolerance, and risk capacity as interchangeable and selecting an answer that sets limits without linking them to the entity's stated appetite or its actual capacity to absorb loss.
The three terms are defined in similar language, and exam options often use them loosely, so candidates match on the word 'limit' rather than on the concept being tested.
What to do instead
Anchor each term to a distinct question: appetite is what risk we want to take to pursue strategy, tolerance is how much deviation we will accept within that, capacity is what we could absorb before breaching obligations. Match the scenario's phrasing to that question, not to the vocabulary.
Answering risk-treatment questions by choosing 'mitigate' or 'add a control' by default, ignoring avoidance, transfer, and acceptance, and failing to note that acceptance must be authorised at the right level.
Control-adding feels like the responsible answer, and candidates conflate 'risk management' with 'risk reduction', overlooking that acceptance with proper authority is a legitimate and often correct treatment.
What to do instead
For every treatment question, run through avoid, reduce, transfer, and accept explicitly, then ask who has authority to approve the chosen treatment and whether the residual position sits within appetite. Select the treatment that matches the scenario's constraints, not the most active-sounding verb.
Reciting regulatory obligations without identifying the specific obligation, the responsible owner, the evidence produced, and the monitoring or reporting frequency.
Compliance questions reward precision, but candidates reproduce general statements such as 'the firm must comply with applicable regulation' because it is always true and feels safe.
What to do instead
Structure compliance answers as obligation, owner, evidence, frequency. If a chosen option cannot be mapped to all four elements, it is too generic. Practise rewriting vague obligations into that four-part form during revision.
Confusing the compliance function's advisory and monitoring role with the business line's ownership of compliance risk, and answering that compliance 'ensures' or 'is responsible for' the firm being compliant.
The phrase 'compliance is responsible for compliance' sounds intuitively correct, and candidates miss the two-lines model in which the first line owns and manages the risk while the second line advises and challenges.
What to do instead
When an option says a control function 'ensures' or 'owns' a business risk, treat it as a red flag. The correct answer usually places ownership with the business and assigns the second line monitoring, advice, and independent challenge. Memorise that split and apply it to every responsibility question.
Describing company secretariat duties as administrative support, and missing the secretariat's role in board induction, information flow, conflicts of interest, minutes as evidence, and advising on procedure.
The title suggests clerical work, so candidates underweight governance-facilitation duties and overlook procedural advice and record-keeping as substantive obligations.
What to do instead
Frame the secretariat as the guardian of board process: what information goes to the board and when, how conflicts are declared and recorded, how decisions and dissent are minuted, and how procedure is advised on. Check each answer option against those four process duties.
Answering conflict-of-interest and disclosure questions by relying on the individual's own judgement to recuse, rather than on a documented declaration, register, and board-authorised process.
Recusal feels like a matter of personal integrity, so candidates choose the answer that trusts the director to step aside voluntarily and overlook the system that makes recusal verifiable.
What to do instead
Always prefer the answer that combines a standing declaration, a maintained register, a defined recusal procedure, and independent authorisation of any permitted participation. Voluntary self-management without record is almost always the weaker option.