GIA Cert Governance & Risk cheat sheet

Three Lines Model: first line owns and manages risk, second line provides independent oversight and challenge, third line (internal audit) gives independent assurance to the governing body; the three lines are not a hierarchy and must remain functionally separate.

Board committees: audit, risk, and remuneration committees are composed of independent non-executive directors; the audit committee oversees external audit, internal audit, and financial reporting, and should not be chaired by the board chair.

Separation of the chair and CEO roles prevents concentration of authority; where combined, a lead independent director and disclosed rationale are expected governance mitigants.

Cadbury (1992) established that boards should include independent non-executives and that audit and remuneration committees be staffed by them; it underpins later UK Corporate Governance Code principles of comply-or-explain.

Sarbanes-Oxley (2002) Section 302 requires CEO/CFO certification of financial reports and disclosure controls; Section 404 requires management assessment and external auditor attestation of internal control over financial reporting.

Agency theory: separating ownership (principals) from control (agents) creates monitoring costs; independent directors, audit, and incentive alignment are governance mechanisms that reduce agency costs.

Stakeholder vs shareholder primacy: stakeholder theory holds the firm accountable to employees, customers, suppliers, and society; shareholder primacy prioritizes residual claimants - the choice shapes board mandates and reporting duties.

Delegated authority: boards set documented delegation limits (financial approval thresholds, risk appetite) and reserve specified matters to the board itself; breaches of limits must be escalated and logged.

Risk = probability × impact for expected loss; for a portfolio, expected loss = PD × LGD × EAD, where PD is probability of default, LGD loss given default, and EAD exposure at default.

Risk appetite is the aggregate amount and type of risk an entity is willing to accept in pursuit of objectives; risk tolerance is the acceptable variation around that appetite, and risk capacity is the maximum risk it can bear before breaching constraints.

COSO ERM (2017) organizes risk work around five components - governance and culture, strategy and objective-setting, performance, review and revision, and information, communication, and reporting - supported by twenty principles.

ISO 31000 process: establish scope and context, identify, analyze, evaluate, treat, then monitor and review, with communication and consultation throughout; risk criteria are set at the start and drive the evaluate stage.

Inherent risk is the exposure before controls; residual risk is the exposure after controls; control effectiveness is measured as the reduction from inherent to residual, and residual risk must sit within tolerance.

Risk treatment options are limited to accept, avoid, transfer (e.g., insurance, hedging, outsourcing), or reduce/mitigate via controls; any treatment decision must be documented with owner and date.

Inherent risk assessment uses likelihood and impact scales; a 5×5 heat map produces scores 1–25 with defined bands (commonly 1–4 low, 5–12 medium, 15–25 high) that trigger escalation thresholds.

Key risk indicators (KRIs) are leading metrics with defined thresholds and owners; a KRI breach escalates per the risk policy, and KRIs are distinct from key performance indicators, which measure objective achievement.

Bow-tie analysis separates causes (threats) and consequences from a central event and maps preventive controls on the left and mitigating controls on the right; it is used where a single high-impact event has multiple pathways.