Strategy, Governance and Risk Management
This domain tests how organisations set direction, govern decision-making, and manage risk. Candidates must distinguish strategy from operations and governance from management. Scenarios often ask for a recommendation that balances stakeholder interests, risk appetite, and control.
Core rules
- Strategy analysis uses external and internal perspectives. Porter's five forces examines industry attractiveness; SWOT summarises strengths, weaknesses, opportunities, and threats; generic strategies include cost leadership, differentiation, and focus.
- Governance concerns direction, oversight, accountability, and stakeholder protection. The board sets strategy and risk appetite; management executes within delegated authority.
- Risk management identifies, assesses, treats, monitors, and reports risk. Inherent risk exists before controls; residual risk remains after controls.
- The three lines model separates operational management, risk and compliance functions, and internal audit. Independence of the third line is essential.
- A risk register records cause, event, impact, likelihood, owner, controls, and treatment. Risk appetite defines acceptable exposure; risk tolerance sets operational limits.
Worked example
A risk is assessed at likelihood 4 and impact 5 on a 5-point scale, giving an inherent score of 20, which is high. Controls reduce likelihood to 3 and impact to 4, giving a residual score of 12, which is medium. The owner decides to accept the residual risk with monthly monitoring, because transferring it would cost more than the expected loss and avoiding it would stop a core service. The board reviews the residual score against risk appetite. If the appetite for this risk is low, acceptance is not justified and further treatment is required. The reasoning must state both inherent and residual exposure.
Traps that cost marks
Do not confuse governance with day-to-day management. Do not treat a risk score as fixed without stating the scale and criteria. Do not ignore residual risk after controls. Do not let internal audit own operational risks. Do not recommend a strategy without linking it to capabilities and stakeholder impact.