Risk and Governance in Strategic Decision-Making
This domain tests the board's role in a strategic decision: whether the governance arrangements are adequate, whether a director has a conflict, and whether the proposed risk sits inside the board's stated appetite. Typical requirements ask you to advise non-executive directors on whether to proceed, or to identify governance failures in the case.
Governance architecture
Separation of ownership and control creates agency costs. The counterweights are independent non-executive directors, a chair distinct from the CEO, board committees (audit, risk, remuneration, nominations), transparent reporting and an independent internal audit function. In Ghana, the Companies Act 2019 (Act 992) codifies directors' duties - good faith, best interests of the company, and care, skill and diligence - and carries consequences for trading while insolvent; the SEC's Code on Best Practice in Corporate Governance operates largely on a comply-or-explain basis; GSE listing rules add disclosure obligations; and sector regulators (Bank of Ghana for banks, the NIC for insurers, the Energy Commission) layer approval requirements onto major transactions. Related-party dealings, controlling-shareholder extraction and directors' service contracts are the recurring conflict-of-interest questions.
Risk in the decision
Distinguish three things: risk appetite (how much risk the board will accept in pursuit of objectives), risk tolerance (acceptable variation around a specific objective) and risk capacity (the maximum the entity could absorb). COSO ERM (2017) provides the structure: governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting. Responses are tolerate, treat, transfer (insurance, hedging) or terminate - plus exploiting risk for upside. The three lines model allocates ownership: management owns risk, risk and compliance monitor, internal audit assures independently, with the audit committee overseeing.
Worked example
An acquisition faces a 30% chance of a six-month regulatory delay costing GHS 25m - expected cost 7.5m. Spending GHS 4m on regulatory readiness cuts the probability to 10%, giving an expected cost of 2.5m: a 5m saving for 4m of spend, so treat the risk. But if the same deal pushes gearing to 55% against a 45% covenant, it is outside tolerance whatever the expected value, and the board should restructure the funding before approving.
Traps that cost marks
- Reciting COSO without applying it to the actual decision.
- Confusing appetite, tolerance and capacity.
- "The board should monitor risk" offered as a recommendation.
- Missing a related-party conflict or a required regulatory approval.
- Assuming internal audit owns risk management.
- Ignoring that a director with a conflict must recuse themselves.