Corporate Governance and Risk Management
What the exam tests
This domain tests board and committee accountability, the UK governance code and regulatory governance rules, and how remuneration and culture are aligned with risk. Questions often ask who owns risk and which committee does what.
Core rules and concepts
- The board sets strategy, risk appetite and the control framework, and oversees management. It cannot delegate ultimate accountability.
- The UK Corporate Governance Code applies to premium-listed companies on a comply-or-explain basis. It expects a chair independent on appointment, at least half the board independent (excluding the chair), and a clear division between chair and CEO.
- PRA and FCA rules in SYSC require firms to have effective governance, fit-and-proper senior managers and appropriate systems and controls. The Senior Managers and Certification Regime (SM&CR) assigns prescribed responsibilities to senior managers; statements of responsibilities map accountability.
- Key board committees: audit (financial reporting, internal and external audit, controls), risk (risk appetite, risk framework, exposures), remuneration (pay aligned with risk), nomination (board composition). Independence and challenge are central.
- The three lines model: business owns risk; risk and compliance provide oversight; internal audit gives independent assurance. Internal audit should report to the audit committee and have access to the board.
- Remuneration should include deferral, malus and clawback so bonuses can be reduced or recovered for poor risk outcomes. Excessive short-term incentives encourage risk-taking.
- Whistleblowing channels, conflicts-of-interest management and a speak-up culture are governance controls, not just HR matters.
Worked example
A bank proposes a risk committee chaired by the CEO, with two executive directors and one non-executive director (NED). This fails governance expectations: the CEO chairs the committee that oversees the CEO's risk-taking; executives dominate; there is only one NED. A better structure is an independent NED as chair, a majority of independent NEDs, and the CEO attending by invitation. The audit committee should remain separate, with its own independent chair and direct access to internal audit. The board should approve the risk appetite and receive regular risk reports.
Traps that cost marks
- Saying NEDs run risk day to day. They challenge and oversee; executives manage.
- Merging audit and risk committees. Their remits overlap but audit focuses on assurance and reporting, risk on appetite and exposures.
- Assuming SM&CR applies only to banks. It covers banks, insurers and most FCA-regulated firms, with proportional differences.
- Treating governance as a compliance document. Regulators assess behaviour, challenge and evidence of decisions.
- Ignoring group and solo-entity governance. A dual-regulated firm may need clarity on which board owns which risk.