CS Professional GRMCE cheat sheet

Governance is the system by which companies are directed and controlled; it allocates rights and responsibilities among shareholders, board, and management.

Core principles: accountability, transparency, fairness, responsibility, and independence of oversight.

Agency problem: separation of ownership (shareholders) from control (managers) creates monitoring costs; governance mechanisms reduce information asymmetry.

Apply-or-explain (comply-or-explain) regimes require a statement of conformity or reasoned departure from a governance code.

Two-tier boards separate supervisory and management functions; unitary boards combine oversight and executive direction with independent non-executives.

Shareholder primacy vs stakeholder (pluralist) models determine whose interests directors must prioritise.

Governance codes are soft law; company law and listing rules are binding and prevail on conflict.

Proportionality and balance: no single person should hold unchecked power; chair and CEO roles are normally separated.

Board duties: set strategy, appoint and monitor executives, approve risk appetite, ensure financial reporting integrity, and oversee succession.

Independence test typically includes no material business relationship, no recent employment, no family ties, and no long tenure beyond a stated period.

Committees: audit, risk, remuneration, and nomination; each needs a written terms of reference and independent membership.

Chair leads the board and sets its agenda; CEO leads management; combining the roles concentrates power and requires explanation.

Quorum rules and conflict-of-interest recusal determine valid decision-making; interested directors are excluded from relevant votes.

Board evaluation (self, internal, or externally facilitated) is a periodic effectiveness review covering composition, dynamics, and information quality.

Non-executive directors provide independent challenge; executives provide operational knowledge; board balance must prevent either group dominating.

Directors owe fiduciary duties: act in good faith, in the company's best interests, with care, skill, and diligence, and avoid conflicts.

Risk = likelihood x impact; inherent risk is before controls, residual risk is after controls, and target risk is the accepted level.

COSO ERM components: governance and culture, strategy and objective-setting, performance, review and revision, and information/communication/reporting.

ISO 31000 process: scope and context, risk identification, analysis, evaluation, treatment, monitoring and review, communication and consultation.

Risk appetite is the amount and type of risk an organisation is willing to accept; risk tolerance is the acceptable variation around it.

Treatment options: avoid, reduce (mitigate), transfer (insurance, contracts), or accept, each with an owner and residual assessment.

A risk register records description, cause, consequence, owner, rating, controls, and treatment plan; it is a live document.

Three lines model: management owns risk, the risk/compliance function provides oversight, and internal audit gives independent assurance.

Key risk indicators (KRIs) are forward-looking metrics with thresholds that trigger escalation before losses materialise.

The compliance function identifies, assesses, advises on, monitors, and reports compliance risk; it must be independent of business lines.

Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational damage from failure to comply with laws and rules.

Core activities: compliance risk assessment, policy and procedure maintenance, training, monitoring, advisory, and regulatory liaison.

Compliance must have appropriate authority, resources, and access to the board or a board committee, often via the audit or risk committee.

A compliance programme typically includes a code of conduct, risk assessment, controls, training, monitoring, whistleblowing, and remediation.

Regulatory relationships require timely, complete, and accurate disclosure; misrepresentation to a regulator is itself a serious breach.

Compliance monitoring differs from internal audit: monitoring is first/second-line ongoing testing; audit is independent third-line assurance.

Breach management: identify, contain, assess, report to the regulator where required, remediate root cause, and record lessons learned.

Internal controls comprise the control environment, risk assessment, control activities, information and communication, and monitoring activities.

Preventive controls stop errors before they occur; detective controls identify them afterwards; corrective controls remedy them.

Segregation of duties separates authorisation, custody, recording, and reconciliation so no one person controls an entire transaction.

Maker-checker (four-eyes) approval requires a second authorised person to review and approve a transaction.

IT general controls cover access management, change management, backup and recovery, and physical/environmental security.

Application controls include input validation, processing checks, and output reconciliation specific to a business process.

Key control testing records the control description, owner, frequency, evidence, sample size, and test result.

Control weaknesses are rated by severity and impact; material weaknesses are reported to the audit committee and remediated with an action plan.

Ethical decision tests: legality, consistency with the code, transparency (would you disclose it publicly), and treatment of affected parties.

Conflicts of interest must be identified, disclosed, managed (recusal, information barriers), or avoided where management is impossible.

Insider information is material, non-public information; trading on it or tipping others is market abuse.

Bribery risk is highest in gifts, hospitality, facilitation payments, intermediaries, and public officials; gifts registers and thresholds are controls.

Whistleblowing channels must allow confidential or anonymous reporting, protect reporters from retaliation, and guarantee independent investigation.

Professional scepticism means questioning evidence and not accepting assertions without verification, especially in audit and compliance.

Confidentiality duties persist after employment ends; exceptions include legal compulsion, regulatory requests, and public interest.

Tone at the top sets ethical culture; incentives and performance targets must not reward misconduct.

Regulators typically hold powers to authorise, supervise, investigate, impose sanctions, and require remediation.

Anti-money laundering framework: customer due diligence, beneficial ownership identification, ongoing monitoring, suspicious activity reporting, and record retention.

Sanctions compliance requires screening against designated lists and freezing assets of listed persons; strict liability often applies.

Data protection principles include lawfulness, purpose limitation, minimisation, accuracy, storage limitation, integrity, and accountability.

Market abuse offences include insider dealing, unlawful disclosure, and market manipulation; disclosure of inside information is required promptly.

Statutory filings (annual accounts, confirmation statements, beneficial ownership registers) have fixed deadlines and late-filing penalties.

Regulatory change management tracks new rules, assesses impact, updates policies and controls, and evidences implementation.

Reporting obligations to regulators often have strict time limits; failure to report a known breach can be a separate offence.

Internal audit provides independent, objective assurance on the effectiveness of governance, risk management, and controls.

Audit independence requires organisational separation, unrestricted access, and reporting lines to the audit committee.

Risk-based audit planning prioritises audit effort by likelihood and impact of risk, not by convenience or cycle alone.

Audit process: plan and scope, understand controls, test design and operating effectiveness, evaluate findings, report, and follow up.

Assurance mapping shows where assurance comes from (management, compliance, internal audit, external audit) and identifies gaps or duplication.

External audit expresses an opinion on financial statements; internal audit focuses on processes and controls, not the audit opinion.

Audit findings are rated by risk and require management agreement on action, owner, and due date, tracked to closure.

The audit committee oversees internal and external audit, reviews findings, and challenges management on remediation.

Stakeholders include shareholders, employees, customers, suppliers, regulators, lenders, communities, and the environment.

Materiality assessment identifies which stakeholder issues are significant to business performance and to stakeholder decisions.

Engagement methods include annual general meetings, investor roadshows, surveys, consultation, grievance mechanisms, and reporting.

Shareholder rights include voting, receiving information, asking questions, and in some jurisdictions proposing resolutions.

Stakeholder salience depends on power, legitimacy, and urgency of the claim.

Grievance mechanisms must be accessible, transparent, and provide remedy without fear of retaliation.

Engagement outcomes should feed board decisions and disclosure; engagement without feedback is not effective.

Investor stewardship codes encourage institutional investors to monitor and engage with investee companies.

Transparency means timely, accurate, complete, and comparable disclosure of material information to relevant parties.

Materiality: information is material if its omission or misstatement could influence the economic decisions of users.

Periodic disclosure includes annual reports, financial statements, governance statements, and remuneration reports.

Continuous/ongoing disclosure requires prompt announcement of inside information, subject to limited permitted delays.

Related-party transactions must be disclosed and often approved by independent directors or shareholders.

Fair disclosure principles prohibit selective disclosure of material information to analysts or favoured investors.

Corporate governance statements typically disclose board composition, independence, committee membership, and code compliance.

Disclosure controls and procedures ensure information is recorded, processed, and reported accurately within required deadlines.