Governance: Structures, Accountability and Decision Rights
What governance actually covers
Governance is the system by which decisions are made, who is accountable for them, and how performance is reported and challenged. For a certification exam, focus on the mechanics rather than slogans: a governing body (board or committee) sets direction and risk appetite; executive management executes within delegated authority; assurance functions (internal audit, compliance, risk) provide independent evidence. Candidates must be able to distinguish accountability (single owner, cannot be delegated away) from responsibility (work performed) and consultation (input, not veto).
Know the standard artefacts: terms of reference for each committee, a delegation-of-authority matrix with monetary and risk thresholds, a schedule of matters reserved for the board, conflict-of-interest registers, and a code of conduct with escalation routes. Understand segregation of duties and the three-lines model: management owns risk, a risk/compliance function sets frameworks and challenges, and internal audit gives independent assurance to the governing body.
Traps to expect
Questions often blur approving a policy with owning the risk, or treat a committee charter as evidence that controls operate. Another common trap: assuming independence means outsourcing; independence is about freedom from operational pressure and reporting lines, not employment status. Watch for options that let the board delegate accountability, or that place internal audit reporting to the CFO.
Worked example
A firm's risk committee wants the CFO to chair it because he understands the numbers. Rule of thumb: the chair should not be the executive most exposed to the risks under review. Better answer: an independent non-executive chairs, the CFO attends as management, and the committee records challenges and escalations to the board.
Rule of thumb: if an option gives one person both the power to act and the power to assure the action, it is almost always wrong.