ICSB Foundation cheat sheet

Governance is the system of rules, practices and processes by which an organization is directed and held to account.

Separation of chair and CEO roles reduces concentration of power; a combined role requires a designated lead independent director.

Board independence test: a director is independent when free of material relationships with the organization, its management or major funders.

Quorum is the minimum number of directors required to transact valid business; decisions taken without quorum are voidable.

Conflict of interest rule: an interested director declares the interest, is excluded from voting and usually from the quorum for that item.

Board committees commonly include audit, risk, remuneration and nomination; delegation does not transfer ultimate accountability.

Duty of care requires informed, deliberative decision-making; duty of loyalty requires acting in the organization's interests, not personal ones.

The business judgment rule protects directors who act in good faith, on an informed basis, without conflict and in the organization's best interest.

Strategy hierarchy: mission and vision set direction, strategy sets choices, plans allocate resources, budgets quantify plans.

SWOT analyses internal strengths and weaknesses against external opportunities and threats; PESTLE scans political, economic, social, technological, legal and environmental factors.

SMART objectives are specific, measurable, achievable, relevant and time-bound; vague objectives cannot be monitored.

Balanced scorecard perspectives: financial, customer, internal process, and learning and growth; each carries objectives, measures, targets and initiatives.

KPI selection rule: a measure qualifies as key only if it is linked to a strategic objective, controllable and comparable over time.

Variance analysis compares actual against budget; favourable or adverse classification depends on whether the item is income or expenditure.

Scenario planning tests strategy against a small number of plausible futures rather than a single forecast.

Strategy fails at execution when accountability, resourcing, milestones and review cadence are not assigned explicitly.

Financial statements comprise the statement of financial position, statement of profit or loss and other comprehensive income, statement of changes in equity, statement of cash flows and notes.

Accounting equation: Assets = Liabilities + Equity; every transaction preserves this equality.

Accrual basis recognizes income when earned and expenses when incurred, not when cash moves; cash basis recognizes only cash movements.

Current ratio = current assets / current liabilities; quick ratio excludes inventory from current assets.

Risk management cycle: identify, assess, treat, monitor and report; risk appetite defines the amount of risk the board accepts.

Risk heat map plots likelihood against impact; inherent risk is assessed before controls, residual risk after controls.

Four risk treatment options: avoid, reduce, transfer (for example insurance) and accept.

Reserves policy states the target range of free reserves and the basis for holding them; it protects continuity of mission.

Compliance obligations arise from statute, regulation, contract, sector codes and voluntary commitments; the strictest applicable standard governs.

Three lines model: management owns risk, a risk and compliance function oversees it, internal audit provides independent assurance.

Regulatory risk is the risk of legal or administrative sanction, financial loss or reputational damage from failure to comply.

Whistleblowing arrangements must offer protected, confidential channels and be free from retaliation for good-faith reports.

A code of conduct translates values into expected behaviours; it is effective only when supported by training, enforcement and tone at the top.

Materiality threshold determines what must be disclosed or escalated; it is set by policy, not by individual judgement in each case.

Data protection principles typically require lawful and fair processing, purpose limitation, data minimization, accuracy, storage limitation, integrity and accountability.

Regulatory change is tracked through a compliance register that records obligation, owner, control and evidence of compliance.

Stakeholder mapping plots interest against influence; high interest and high influence stakeholders require active management.

Mendelow matrix quadrants: key players, keep satisfied, keep informed, and minimal effort.

Engagement spectrum runs from inform to consult, involve, collaborate and empower.

Materiality assessment identifies stakeholders and topics that significantly affect the organization or are significantly affected by it.

Stakeholder salience depends on power, legitimacy and urgency; higher combined attributes produce higher priority.

Disclosure transparency requires accurate, timely, balanced reporting of both positive and negative performance.

Annual reporting typically covers strategy, governance, performance, risk and sustainability; integrated reporting additionally explains value creation over time.

Feedback loops convert stakeholder input into measurable actions with owners and response commitments.

Internal control components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

COSO control activities include authorization, segregation of duties, reconciliation, physical safeguards and performance reviews.

Segregation of duties separates authorization, custody of assets, recording and reconciliation so no one person controls a full transaction cycle.

Preventive controls stop errors before they occur; detective controls identify errors after the fact; corrective controls remedy them.

Internal audit provides independent, objective assurance; external audit expresses an opinion on the financial statements.

Audit findings are tracked through an action plan with owner, deadline and evidence of remediation.

Three lines model: first line is operational management, second line is risk and compliance oversight, third line is internal audit.

Control testing assesses design effectiveness (is the control capable of preventing the risk) and operating effectiveness (does it work consistently).

ESG stands for environmental, social and governance factors used to assess non-financial performance and risk.

Double materiality covers financial materiality (how sustainability affects the organization) and impact materiality (how the organization affects society and environment).

Triple bottom line reports on people, planet and profit rather than profit alone.

Scope 1 emissions are direct emissions from owned sources; Scope 2 are purchased energy; Scope 3 are value-chain emissions.

Greenwashing is misleading sustainability communication; it is mitigated by verifiable data, clear baselines and independent assurance.

UN Sustainable Development Goals provide 17 global targets that organizations map their contributions against.

Sustainability reporting frameworks include GRI for impact reporting and ISSB standards for investor-focused financial materiality.

Purpose statement defines why the organization exists; it should connect to strategy, incentives and decision criteria to be meaningful.

Digital governance assigns accountability for technology decisions, data quality, cyber risk and digital investment.

Data governance defines ownership (accountable executive), stewardship (day-to-day quality) and custodianship (technical storage and security).

Data quality dimensions: accuracy, completeness, timeliness, consistency, validity and uniqueness.

Cyber risk is governed through a board-approved risk appetite, incident response plan, tested recovery and third-party assurance.

CIA triad: confidentiality, integrity and availability are the core objectives of information security.

Technology investment cases should state benefits, costs, risks, dependencies and exit or contingency arrangements.

Artificial intelligence oversight requires documented purpose, bias testing, human review and accountability for automated decisions.

Third-party technology risk is managed through due diligence, contractual security terms, exit plans and periodic review.

Budget variance = actual minus budget; percentage variance = variance / budget x 100.

Break-even point in units = fixed costs / contribution per unit; contribution per unit = selling price minus variable cost per unit.

Liquidity risk is the risk of being unable to meet obligations as they fall due; solvency risk is the risk that liabilities exceed assets.

Cash flow forecast horizons commonly cover 13 weeks for operational liquidity and 12 months for annual planning.

Fraud triangle: opportunity, pressure or incentive, and rationalization; controls target opportunity.

Reserve cover ratio = free reserves / annual operating expenditure, expressed in months or as a percentage.

Diversification of income sources reduces concentration risk; a single funder above a set threshold is reportable to the board.

Risk register fields: risk description, cause, consequence, likelihood, impact, score, owner, control, treatment and review date.

Ethical decision tests include the legality test, the public disclosure test and the reciprocity test.

Anti-bribery controls: gifts and hospitality register, due diligence on intermediaries, no facilitation payments, and confidential reporting.

Sanctions and anti-money-laundering obligations require customer due diligence, beneficial ownership identification and suspicious activity reporting.

Statutory filing deadlines and regulator notifications are tracked on a compliance calendar with named owners.

Board minutes are the primary evidence of governance decisions; they should record the decision, reasoning and declared interests.

Records retention schedules state minimum retention periods by record class and the lawful basis for disposal.

Regulatory breach escalation typically requires immediate notification to the board or audit committee, followed by root-cause analysis.

Conflicts of interest registers are reviewed at least annually and updated when circumstances change.

Communication planning answers audience, message, channel, timing, owner and feedback mechanism.

Crisis communication principles: acknowledge quickly, state known facts, avoid speculation, give a next update time and keep a single source of truth.

Investor and funder reporting should align narrative disclosures with the financial statements to avoid inconsistency.

Stakeholder consultation is meaningful only when input can demonstrably influence the decision.

Accessibility and plain-language standards widen reach and reduce misinterpretation risk.

Reputation risk is managed through consistent behaviour, transparent disclosure and prompt correction of errors.

Grievance mechanisms should be accessible, documented and report resolution times to the board.

Board diversity reporting covers skills, experience, tenure, gender and other characteristics relevant to effective challenge.

Process mapping identifies inputs, activities, outputs, controls and handoffs; bottlenecks are constraints limiting throughput.

Key risk indicators are forward-looking measures that signal rising risk exposure before losses occur.

Business continuity planning covers business impact analysis, recovery time objective and recovery point objective.

Recovery time objective is the maximum acceptable downtime; recovery point objective is the maximum acceptable data loss.

Service level agreements define measurable service standards, remedies and review points for outsourced operations.

Incident management stages: log, classify, contain, resolve, review and report lessons learned.

Quality assurance uses defined standards, sampling and documented evidence to confirm consistent delivery.

Operational resilience requires identifying important business services, setting impact tolerances and testing severe-but-plausible scenarios.

Climate risk divides into physical risk (acute and chronic hazards) and transition risk (policy, technology and market change).

Net zero commitments require a baseline year, interim targets, scope coverage and a credible decarbonization pathway.

Science-based targets align reduction trajectories with the Paris Agreement goal of limiting warming to 1.5 degrees Celsius.

Circular economy principles design out waste through reuse, repair, remanufacture and recycling.

Social factors include labour standards, health and safety, human rights, diversity and community impact.

Sustainability assurance is performed against a stated framework and standard, such as ISAE 3000, to increase report credibility.

Executive remuneration linked to ESG metrics requires measurable, auditable targets to avoid greenwashing.

Materiality thresholds for sustainability reporting should be documented and reviewed at least annually.

Data breach response phases: detect, contain, assess, notify, remediate and review.

Personal data breach notification timelines are set by law; GDPR requires notification to the supervisory authority within 72 hours where required.

Access control principle of least privilege grants the minimum access needed for a role, reviewed periodically.

Multi-factor authentication, patching, encryption and backups are baseline cyber hygiene controls.

Data lifecycle stages: creation, storage, use, sharing, retention and disposal.

Cloud and outsourcing arrangements require clarity on data location, ownership, portability and deletion on exit.

Digital transformation governance tracks benefits realization against the approved business case at defined gateways.

Algorithmic accountability requires documenting data sources, model purpose, validation results and human override arrangements.

Board effectiveness reviews may be internally facilitated or externally facilitated; external review is commonly required periodically by code.

Director tenure limits and refreshment planning support independence and skills renewal.

Board skills matrix maps required competencies against current director capabilities to identify gaps.

Succession planning for the CEO and key executives is a standing board responsibility, not an annual event.

Delegation of authority schedule states financial and decision limits for management, committees and the board.

Board papers should be issued sufficiently in advance with clear decisions requested, risks and recommendations.

Independence is eroded by long tenure, cross-directorships, significant fees or close personal ties to management.

Chair responsibilities include setting the agenda, ensuring all voices are heard and appraising director performance.

Theory of change links inputs, activities, outputs, outcomes and impact; it tests whether the logic of a strategy is sound.

OKRs set an ambitious objective with three to five measurable key results; they are reviewed on a short cycle.

Leading indicators predict future performance; lagging indicators confirm results already achieved.

Resource allocation should follow strategic priority; incremental budgeting tends to preserve historical patterns.

Portfolio review classifies activities as grow, sustain, fix or exit based on strategic fit and performance.

Strategic risk is the risk that strategy becomes invalid due to external change or flawed assumptions.

Performance reviews should compare results against targets, explain variance and record corrective action.

Annual planning cycle typically runs strategy refresh, objective setting, budgeting, approval and quarterly monitoring.

Internal controls over financial reporting address authorization, completeness, accuracy, cut-off and classification of transactions.

Three-way match compares purchase order, goods receipt and supplier invoice before payment is approved.

Bank reconciliations should be prepared by someone independent of cash handling and reviewed monthly.

Capital versus revenue classification determines whether expenditure is capitalized and depreciated or expensed immediately.

Going concern assessment considers at least twelve months of projected cash flows, covenants and available facilities.

Related party transactions must be disclosed and approved under a conflicts policy.

Internal financial control weaknesses are reported to the audit committee with a remediation plan and timeline.

Budget monitoring reports should show year-to-date actual, full-year forecast and explanation of material variances.

A compliance risk assessment ranks obligations by likelihood and impact of breach to prioritize controls.

Regulatory engagement should be documented, consistent and authorized through a single point of contact.

Codes of conduct apply to directors, employees, volunteers and contracted suppliers where specified.

Gifts and hospitality thresholds define what may be accepted, what must be recorded and what must be declined.

Competition law prohibits price fixing, market sharing and abuse of dominance; trade association contacts carry risk.

Employment obligations include fair treatment, health and safety, and protection from discrimination and retaliation.

Ethical culture is measured through speak-up rates, case resolution times and repeat-issue analysis.

Non-compliance consequences include sanctions, remediation costs, contract loss and reputational damage.

Audience segmentation groups stakeholders by interest, influence, knowledge and preferred channel.

Message discipline requires one agreed narrative supported by consistent evidence across all channels.

Two-way engagement produces measurable outcomes such as changes to design, policy or service delivery.

Stakeholder trust is built through consistency between stated commitments and observed behaviour.

Complaint handling standards specify acknowledgement time, investigation steps, response time and escalation route.

Board reporting on engagement should quantify reach, feedback themes and actions taken.

Digital channels require moderation policies, data privacy compliance and accessibility conformance.

Media and social media monitoring provides early warning of emerging reputational issues.

Assurance mapping shows which risks are covered by which assurance sources and where gaps remain.

Assurance sources include management self-assessment, second-line compliance review, internal audit and external audit.

Audit committee responsibilities include overseeing external audit, internal audit, risk management and financial reporting integrity.

Internal audit independence requires reporting lines to the audit committee and freedom from operational management duties.

Audit planning is risk-based, prioritizing areas of highest risk and weakest assurance.

Findings are rated by severity, and overdue high-severity actions are escalated to the board.

Control self-assessment engages process owners in evaluating the design and operation of their controls.

Whistleblowing reports and investigation outcomes are reported to the audit committee in summary form.

ESG ratings vary by provider because methodologies, weightings and data sources differ; divergence is expected.

Sustainability-linked finance ties pricing to achievement of predefined sustainability performance targets.

Green bonds require use-of-proceeds reporting and independent verification against published principles.

Stakeholder capitalism holds that organizations should create value for customers, employees, suppliers, communities and shareholders.

Just transition considers the social consequences of shifting to a low-carbon economy for workers and communities.

Biodiversity and nature-related risks are increasingly assessed alongside climate risk.

Supply chain due diligence identifies environmental and human rights risks in sourcing and requires remediation.

Purpose-led governance embeds mission into board recruitment, strategy review and performance metrics.

Digital strategy should align technology investment with organizational strategy and state measurable outcomes.

IT general controls cover access management, change management, IT operations and backup and recovery.

Change management controls require testing, approval and segregation between development and production environments.

Data classification schemes assign handling requirements by sensitivity level, such as public, internal, confidential and restricted.

Privacy impact assessments identify and mitigate risks before processing personal data in new ways.

Vendor concentration risk arises when critical services depend on a single provider without viable alternatives.

Cyber incident escalation requires predefined severity levels, notification routes and board reporting triggers.

Technology obsolescence risk is managed through a documented lifecycle and replacement roadmap.

Board meeting effectiveness depends on a forward agenda, timely papers, clear decision items and recorded actions.

Non-executive directors provide independent challenge and scrutiny of executive performance.

Committee terms of reference define membership, quorum, authority and reporting obligations.

Governance codes commonly follow a comply-or-explain approach rather than prescriptive rules.

Board evaluation covers composition, dynamics, information quality and decision effectiveness.

Executive performance is assessed against agreed objectives, with remuneration linked to measurable outcomes.

Induction and continuing development ensure directors understand the organization, sector and their duties.

Succession and contingency plans name an interim arrangement for chair and CEO absence.

Strategic options are evaluated against feasibility, acceptability and suitability.

Cost-benefit analysis compares total costs against total expected benefits, including non-financial factors where relevant.

Sensitivity analysis tests how outcomes change when one key assumption varies.

A logic model failure occurs when outputs are reported as if they were outcomes.

Benchmarking compares performance against peers or best practice to identify improvement opportunities.

Strategic drift occurs when incremental change leaves strategy misaligned with the external environment.

Performance dashboards should present a small set of indicators with targets, trends and exception flags.

Benefits realization reviews confirm whether planned benefits were actually delivered after implementation.

Risk appetite statement defines the types and levels of risk the organization will accept in pursuit of objectives.

Risk tolerance sets the acceptable variation around the risk appetite for a specific category.

Gross risk is assessed before controls; net or residual risk is assessed after controls.

Risk owners are accountable individuals, not committees, and are named in the risk register.

Key risk indicators have defined thresholds that trigger escalation when breached.

Concentration risk arises from dependence on a single funder, customer, supplier or system.

Stress testing models severe adverse scenarios to confirm the organization can survive them.

Insurance transfers defined risks but does not eliminate reputational or contractual exposure.

Regulatory obligations differ by jurisdiction and legal form; the applicable legal framework must be confirmed.

Delegated authority must be documented, with limits and escalation routes for exceptions.

Breach registers record the incident, root cause, remediation, owner and closure date.

Ethical frameworks commonly include consequentialist, deontological and virtue-based reasoning.

Confidentiality obligations apply to board deliberations, personal data and commercially sensitive information.

Conflicts of interest include financial interests, family relationships, external roles and competing loyalties.

Regulators increasingly expect evidence of culture, not just documented policies.

Training completion and policy attestation rates are common compliance effectiveness metrics.

Stakeholder engagement plans should state purpose, scope, methods, responsibilities and success measures.

Consultation records should document who was consulted, what they said and how input was used.

Crisis escalation protocols define spokespeople, approval routes and holding statement templates.

Transparency about failure, followed by credible remediation, generally preserves trust better than silence.

Reporting should distinguish verified data from estimates and explain the basis of any assumptions.

Accessible communication uses plain language, alternative formats and translation where needed.

Employee engagement is a leading indicator of delivery risk and should be measured regularly.

Investor relations disclosures must comply with market abuse and equal-access rules where listed.

Process owners are accountable for control design and operation within their area.

Key controls are those that address the most significant risks; they are identified and tested first.

Walkthrough testing confirms understanding of a process and identifies where controls operate.

Sample testing provides evidence of operating effectiveness but carries sampling risk.

Control deficiencies are classified as deficiency, significant deficiency or material weakness by severity.

Remediation plans require an owner, action, deadline and verification of effectiveness after implementation.

Root cause analysis distinguishes symptoms from underlying process or culture failures.

Combined assurance reduces duplication by coordinating assurance activity across the three lines.

Materiality assessment output determines report content and should be reviewed with stakeholders.

Emissions baseline recalculations are required when methodology, data or organizational boundaries change.

Carbon offsetting does not substitute for emission reduction in a credible climate strategy.

Sustainability performance targets should be specific, measurable and independently verifiable.

Human rights due diligence follows identify, assess, act, track and communicate stages.

Board oversight of sustainability should include a named committee or director responsibility.

ESG data quality risks include estimation, inconsistent boundaries and unaudited supplier data.

Stakeholder complaints about environmental or social impact should feed into risk assessment.

Board digital literacy requirements should be reflected in the skills matrix and development plan.

Data ethics principles include fairness, transparency, accountability and avoidance of harm.

Automated decision-making requires a lawful basis, explainability and a route to human review.

Cyber insurance covers defined losses but does not replace preventive controls.

Incident response exercises, including tabletop simulations, test plans before a real event.

Data retention limits reduce breach exposure and storage cost and support regulatory compliance.

Third-party contracts should include audit rights, breach notification timelines and data return obligations.

Technology risk appetite should state tolerance for downtime, data loss and security incidents.

Board composition should reflect the diversity of the communities and stakeholders served.

Meeting quorum and voting rules are set in the constitution or articles and cannot be overridden by custom.

Directors' duties typically include acting within powers, promoting success, exercising independent judgement and avoiding conflicts.

Board minutes should record attendance, apologies, declarations, decisions and any dissent.

Committee chairs report to the board, and minutes of committee meetings are circulated to all directors.

Governance documentation includes constitution, terms of reference, delegation schedule and policies.

Board information quality depends on concise papers with clear recommendations and risk disclosure.

Leadership succession should be reviewed at least annually and linked to strategy.

Objectives cascade from strategy to team and individual goals, aligning incentives with priorities.

Performance measurement should balance financial and non-financial indicators to avoid distortion.

Targets set too aggressively encourage gaming; targets set too loosely fail to stretch performance.

Forecasting is updated as assumptions change; a static annual budget alone is insufficient for control.

Rolling forecasts extend the planning horizon continuously, commonly by four to six quarters.

Driver-based models link performance to underlying operational drivers such as volume and conversion.

Post-implementation reviews compare actual outcomes with the original business case.

Strategic review cadence commonly separates monthly operational review from quarterly strategic review.