CPA Ethics and Governance common mistakes
CPA Ethics and Governance · Understand the traps and how to avoid them.
Answering an ethical-dilemma scenario by concluding 'the conduct is lawful, therefore it is ethical', and stopping there without an independent ethical judgement.
Candidates conflate the legal minimum with the ethical standard, and exam distractors are deliberately written in the language of legal compliance to reward that shortcut.
What to do instead
Run two separate tests on every scenario and label them: (1) is the conduct permitted by law/regulation/professional standards, and (2) does it satisfy the fundamental principles and withstand a reasonable and informed third party test. State the conclusion separately for each, and identify which stakeholder bears the cost if the behaviour falls below the ethical standard even though it is legal.
Naming the wrong APES 110 fundamental principle in a scenario - for example labelling a competent-but-biased auditor as lacking integrity, or labelling a fee-driven lenient judgement as a competence failure.
The five principles are described in similar-sounding language (objectivity, integrity, professional competence and due care, confidentiality, professional behaviour) and are often learned as a list rather than as distinct tests.
What to do instead
Attach one diagnostic trigger to each principle and reuse it: integrity = truthful and not misleading/association with misleading information; objectivity = freedom from bias, conflict of interest or undue influence; competence and due care = skill, currency of knowledge, diligence; confidentiality = non-disclosure and non-use of information; professional behaviour = compliance with law and avoiding conduct that discredits the profession. Map each scenario fact to one trigger before writing the principle name.
Treating each threat to compliance with the fundamental principles as an automatic answer - e.g. writing 'a self-interest threat exists, therefore the engagement must be declined' - without evaluating significance or considering safeguards.
The threat categories (self-interest, self-review, advocacy, familiarity, intimidation) are memorised as labels, so the conceptual framework is reduced to a matching exercise rather than applied as a three-step reasoning process.
What to do instead
Structure every answer as: identify the specific threat(s) and what they threaten; evaluate significance using both qualitative and quantitative factors (nature of the client, level of judgement, seniority of those involved, fee dependence, relationship duration); then respond by eliminating the circumstance, applying safeguards, or declining/terminating. Only state 'decline' as the conclusion when evaluation shows the threat cannot be reduced to an acceptable level.
Treating client confidentiality as absolute, or conversely disclosing too readily - failing to identify the recognised exceptions (legal requirement, regulatory or professional-body obligation, court order, or a professional duty to disclose including whistleblowing) and failing to note that confidentiality continues after the engagement or employment ends.
Candidates reduce confidentiality to 'never tell anyone' and then cannot resolve scenarios where a legal or professional duty to disclose competes with it; they also forget the non-use limb, so they disclose to a third party without breaching the letter of a disclosure prohibition.
What to do instead
State the rule (two limbs: do not disclose, do not use) then test the specific exception raised by the facts, note whether disclosure is permitted or required and to whom, and record that the confidential obligation survives termination. Where a duty to disclose exists, state that only the information necessary is disclosed and that legal advice/appropriate escalation is obtained.
Describing agency theory, stakeholder theory and stewardship theory as if they predict the same board behaviour - for example writing that agency theory implies boards should balance the interests of all stakeholders equally, or that stewardship theory implies boards must introduce incentives to align management with shareholders.
The theories are learned as a set of definitions and the causal chain (separation of ownership and control, divergent interests, monitoring mechanisms) is not rehearsed, so predictions get swapped under exam pressure.
What to do instead
For each theory memorise the assumption, the predicted problem, and the predicted governance remedy as a three-part chain: agency = self-interested managers plus information asymmetry, so monitoring and incentive alignment (independent board, audit, equity-based pay); stewardship = managers are trustworthy stewards, so empower management and separate chair/CEO for clarity rather than control; stakeholder = the firm is accountable to a broad set of claimants, so board representation and disclosure beyond shareholders. Rewrite each scenario answer by stating the assumption explicitly before drawing the implication.
Writing a governance answer entirely within one unstated theoretical lens - usually assuming shareholder primacy - when the question asks about accountability to a wider group, or alternatively asserting that 'best practice' requires directors to maximise returns for all stakeholders simultaneously.
Candidates default to the perspective in which the firm exists to maximise shareholder wealth because it feels like the safe commercial answer, and do not signal which framework they are using.
What to do instead
In the opening sentence of the answer, name the lens you are applying ('from a shareholder-primacy perspective...'; 'under a stakeholder accountability view...') and where the question invites it, contrast the two conclusions. Avoid untestable claims that all stakeholder interests can be maximised at once; instead discuss trade-offs, prioritisation and the disclosure used to make the trade-off accountable.
Confusing the roles and composition of board committees - for example assigning remuneration-setting to the audit committee, or stating the nomination committee must consist entirely of independent non-executive directors in all cases, or holding the audit committee responsible for the external audit opinion.
The committees share membership characteristics (independence, non-executive majority) and are studied as a block, so responsibility boundaries blur.
What to do instead
Build a comparison table with one row per committee and three columns: core responsibility, composition and independence expectation, and key reporting line. Anchor each committee to a single verb: audit = oversee integrity of reporting and the external auditor relationship (it does not perform the audit); risk = set and monitor the risk appetite and framework; remuneration = design and set executive pay; nomination = board composition, skills matrix and succession. Answer using the table entry rather than memory of a general 'independent committee' rule.
Presenting ASX Corporate Governance Council recommendations or other 'best practice' guidance as legally binding obligations, or conversely treating a comply-or-explain disclosure as an automatic breach when a company explains a departure.
Recommendations and statutory duties are both discussed as 'governance requirements', and the difference between a listing-rule disclosure obligation and a substantive legal duty is easily lost.
What to do instead
Distinguish three layers explicitly in every answer: statutory/legal duties (e.g. Corporations Act director duties) that are enforceable; listing-rule obligations (including comply-or-explain disclosure); and voluntary guidance. When a company departs from a recommendation, the correct analysis is whether the explanation is adequate and whether any underlying legal duty is still met - not whether a rule was broken.
Treating sustainability and integrated reporting as one interchangeable item, or asserting that Australian companies must publish a sustainability report under a specific framework, or labelling any philanthropic or community spend as evidence of sustainability performance.
The reporting landscape (GRI, integrated reporting, TCFD-style climate disclosure, modern slavery and other statutory reporting) is studied as a list of acronyms without mapping each to its status and purpose.
What to do instead
For each report type, record three facts: whether it is voluntary or mandatory (and under what instrument), who it is primarily addressed to, and what it measures. In particular distinguish a sustainability report (impacts on society and environment, GRI-style, multi-stakeholder) from an integrated report (how the organisation creates value over time across the six capitals, addressed primarily to providers of financial capital). Assess performance against disclosed metrics and assurance status, not against donations or publicity.
Answering 'who should the board prioritise' by listing stakeholders in an arbitrary order or treating all stakeholders as equally salient, and ignoring whether claims are backed by power, legitimacy and urgency.
Candidates equate stakeholder accountability with treating every claimant identically, so they cannot resolve scenarios where two stakeholder groups make competing and unequal claims.
What to do instead
Apply stakeholder salience explicitly: assess each group against power (ability to affect or be affected by the organisation), legitimacy (validity of the claim) and urgency (time sensitivity and criticality), then classify as definitive, expectant or latent and justify the priority order. Where priority is contested, state the trade-off, the mechanism for hearing the disadvantaged group (disclosure, engagement, grievance process) and how the outcome will be reported.