GIA Cert Governance & Risk common mistakes
GIA Cert Governance & Risk · Understand the traps and how to avoid them.
Treating 'governance' and 'risk management' as interchangeable labels and answering a governance question with a risk-treatment action (or vice versa), so the chosen option is logically sound but sits in the wrong domain.
The two domains share vocabulary - oversight, appetite, controls, reporting - and candidates pattern-match on keywords instead of asking what the question is actually testing: who decides and is accountable (governance) versus how uncertainty is identified, assessed and treated (risk).
What to do instead
Before reading the options, restate the stem in one sentence beginning either 'Who is accountable for...' or 'How should the organisation identify/assess/treat...'. Only then evaluate options, discarding any that answer the other question even if factually correct. Drill with paired stems built from the same scenario.
Selecting the option that describes what a control does rather than who owns or is accountable for it, producing answers that describe activity without assigning responsibility.
Candidates study control catalogues and frameworks in detail and become fluent in mechanics; accountability language feels softer and less 'technical', so it is under-weighted under time pressure.
What to do instead
Memorise the accountability chain for each layer (board, committee, executive owner, control owner, assurance function) and practise rewriting every control description as 'owned by X, accountable to Y, assured by Z'. If an option names no owner and the stem asks about governance, eliminate it.
Confusing the three lines model: attributing independent assurance to the second line, or assigning control ownership to internal audit.
The model is taught as a diagram and candidates remember the count of lines but not the boundary between management oversight (second line) and independent assurance (third line), especially when the second line performs testing.
What to do instead
Anchor on function not activity: first line owns and operates controls, second line sets frameworks and challenges, third line gives independent assurance to the governing body. Test yourself by classifying ten real activities (policy drafting, control testing by compliance, internal audit review) and justify each placement in one sentence.
Answering board-effectiveness questions with the responsibilities of executive management, such as implementing the risk framework or operating controls.
Scenario stems often describe an operational failure, which primes candidates to pick an operational remedy; the question, however, asks what the board should do - typically challenge, set appetite, or require assurance.
What to do instead
Build a one-page board remit card (set direction and appetite, appoint and oversee, challenge and approve, receive assurance) and, for every practice question, ask 'is this a decision, an oversight act, or an execution act?'. Boards decide and oversee; they do not execute.
Treating risk appetite, risk tolerance and risk capacity as synonyms and choosing an option that uses the wrong one for the scenario.
The terms appear together in framework material and candidates memorise definitions in isolation without the relational logic: capacity is what you can bear, appetite is what you choose to pursue, tolerance is the acceptable variation around that choice.
What to do instead
Learn them as a hierarchy with a worked numeric example (capital capacity of 100, appetite to risk no more than 60, tolerance of plus or minus 10 on a specific metric). For each question, identify which of the three the stem is describing before looking at options.
Jumping to a treatment option (avoid, reduce, transfer, accept) before establishing the inherent risk and the effectiveness of existing controls, so the answer ignores residual exposure.
Stems are written to feel urgent and candidates want to 'solve' the problem; the assessment step is implicit and easy to skip, and options that sound decisive are attractive.
What to do instead
Apply a fixed sequence on every risk question: identify the risk, assess inherent exposure, evaluate current controls, determine residual exposure, then select treatment proportionate to residual. Write the five steps in the margin and reject any option that treats an unassessed risk.
Classifying a risk by its consequence or by the control that addresses it rather than by its source, leading to misclassification between strategic, operational, financial, compliance and reputational categories.
Real risks span categories (a cyber breach is operational, reputational and regulatory), and candidates look for a single 'correct' label instead of the dominant source the stem describes.
What to do instead
Classify by origin - where the uncertainty enters the organisation - and note secondary categories explicitly. Practise with ten multi-category scenarios and state the primary source plus one secondary effect, so the habit becomes source-first rather than outcome-first.
Treating risk transfer as risk elimination, for example assuming insurance or outsourcing removes the exposure and its accountability.
Transfer is intuitively satisfying and the word 'transfer' suggests the risk has left; candidates overlook retained residual risk, counterparty risk and the non-delegable accountability of the original owner.
What to do instead
For every transfer option, ask two questions: what residual remains with us, and who is still accountable? Remember that transferring financial consequence does not transfer reputational or regulatory accountability. Build a short list of transfer limits (exclusions, caps, counterparty failure, conduct risk).
Confusing inherent risk with residual risk when interpreting a scenario, or assuming controls are effective because they are documented.
Frameworks present both measures side by side and candidates conflate 'a control exists' with 'the control works'; design effectiveness and operating effectiveness are treated as one idea.
What to do instead
Force the distinction in writing: inherent = exposure before controls, residual = exposure after controls shown to operate. Treat documented-but-untested controls as unproven and therefore not reducing residual exposure. Rehearse with scenarios where a control is designed well but bypassed in practice.
Choosing the most comprehensive-sounding option - implement an enterprise risk framework, escalate to the board, commission a full review - when the stem describes a low-impact, well-understood risk needing a proportionate response.
Exam writers include plausible over-reactions, and candidates equate thoroughness with correctness; proportionality is a principle, not a keyword, so it is easily missed under time pressure.
What to do instead
Before selecting, ask what the risk's likelihood and impact justify and whether the response matches the tier of the risk. Prefer the least intrusive effective option; reserve escalation and full review for risks exceeding appetite or tolerance. Practise ranking three responses by proportionality and justifying the middle choice.