CS Professional GRMCE common mistakes
CS Professional GRMCE · Understand the traps and how to avoid them.
Describing governance principles (fairness, accountability, transparency, responsibility) in the abstract and then failing to apply them to the facts of the scenario, so the answer never states which principle is breached and by whom.
Candidates memorise the OECD/G20 principle list as a definition to reproduce and treat the scenario as background rather than as the subject of the question. The exam usually asks for application, and the marking rewards linking a named principle to a specific actor and decision.
What to do instead
Practise a fixed two-line template for every scenario answer: name the principle, then name the actor and the act ('transparency - the board approved the related-party contract without disclosing terms to independent directors'). Build a short revision table mapping each principle to two or three concrete behaviours that breach it, and rehearse converting each behaviour into a one-sentence diagnosis.
Treating independence as a personal quality ('he is a person of integrity') instead of assessing it against the objective criteria - tenure, material business relationships, cross-directorships, former executive office, advisory fees, family ties.
Colloquial usage of 'independent' encourages a character judgement, and candidates skip the checklist because it feels mechanical. Questions that plant a nine-year tenure or a consulting fee usually hinge precisely on that detail.
What to do instead
Memorise the disqualifying factors as a checklist and run it line by line against every named director in the stem. In each practice question, write out the factor found, the threshold it breaches, and the conclusion. Where the facts are silent on a criterion, say so rather than assuming independence.
Confusing the roles of chair and CEO, or assigning executive responsibility to the board as a whole, when answering questions on segregation of duties and board composition.
Many candidates come from organisations where the roles are combined, so the separation feels artificial and they default to the structure they know. The exam tests the governance rationale for separation, not familiarity.
What to do instead
Learn the role split as three columns - chair (board effectiveness, agenda, appraisal of CEO), CEO (execution, strategy delivery), board (oversight, appointment, remuneration, risk appetite). For each practice scenario, state explicitly who decides, who recommends, and who monitors, and check no single person occupies two of those positions.
Listing risk responses (avoid, reduce, transfer, accept) without connecting them to the organisation's stated risk appetite and tolerance levels, so the recommendation is technically correct but unanchored.
Risk response taxonomy is easy to recall and candidates stop there, assuming the examiner only wants the categories. Marks are usually awarded for justifying why a response fits the declared appetite and who owns the residual risk.
What to do instead
Answer in a fixed chain: identify the risk, state the appetite or tolerance it breaches, select the response, name the risk owner, and state the residual exposure and reporting line. Practise writing this chain in under two minutes so it becomes the default structure for every risk question.
Describing the three lines model as a simple org chart ('audit is the third line') without explaining the distinct mandate, independence and reporting relationship of each line, or where the governing body sits.
The model is often taught as a diagram, so recall is visual and shallow. Questions that probe whether internal audit can own a control, or whether compliance is first or second line, expose the gap.
What to do instead
Write a one-page summary of each line covering its objective, what it may and may not do, to whom it reports, and its independence safeguards. Then answer ten short scenarios classifying activities into lines and justifying the classification. Note explicitly that internal audit provides independent assurance and must not design or operate the controls it audits.
Treating the code of conduct as a document to be published rather than a programme to be operated, and omitting the mechanisms - training, declaration registers, whistleblowing channels, sanctions, tone from the top - when asked how to embed ethics.
Candidates answer the 'what' (we have a code) and skip the 'how' (how it changes behaviour), because the mechanisms are less memorable than the statement of values.
What to do instead
Build a standard embedding answer with five components: leadership example, clear rules and examples, training and communication, confidential reporting with non-retaliation, and consistent consequences. For each component, prepare one concrete artefact (for example, an annual interest declaration register reviewed by the board) so answers are specific rather than aspirational.
Confusing the compliance function with the legal department or with internal audit, and consequently giving compliance an executive decision-making role or an assurance-only role.
Organisational labels vary between firms, so candidates map the exam's terms onto their own employer's structure. The exam tests the standard division: compliance advises and monitors, management owns and decides, internal audit assures independently.
What to do instead
Prepare a comparison table for compliance, legal, risk and internal audit across four dimensions: primary objective, independence, reporting line, and whether the function can approve business decisions. In practice answers, state which function should act and why the others should not, naming the independence risk of each alternative.
Answering internal control questions by listing control types (preventive, detective, corrective) without identifying the specific assertion or risk the control addresses, or without stating how the control would be tested.
Control classifications are easy to reproduce, and candidates stop at labelling. Marks typically require linking the control to an objective and describing evidence of operating effectiveness.
What to do instead
For every control answer, complete three fields: the risk or assertion controlled, the control activity and frequency, and the test procedure with the evidence that would demonstrate it operated. Rehearse designing a test for a manual control (sample selection, inspection of evidence, reperformance) and for an automated one (configuration review, exception report).
Giving disclosure answers that recite the principle of transparency but cannot name what must be disclosed, to whom, and through which channel, or the consequences of failing to disclose a material matter.
Transparency is treated as a value rather than an obligation with defined content. Candidates therefore produce answers that sound right but contain no disclosable item, recipient or mechanism.
What to do instead
Maintain a disclosure matrix: item (related-party transactions, remuneration policy, material risks, going-concern statements, changes in control), recipient (regulator, market, shareholders, board), channel (annual report, continuous disclosure announcement, regulatory filing), and timing. Use it to answer every transparency question with named content rather than principle.
Naming a stakeholder group and asserting their interest without analysing their power, legitimacy or urgency, or proposing an engagement mechanism, so stakeholder answers read as a list of parties rather than an engagement strategy.
Stakeholder identification is quick to recall and candidates assume naming the group is the answer. The exam usually asks how the board should prioritise and engage, which requires analysis and a mechanism.
What to do instead
Use a three-step structure: map stakeholders on influence and interest, justify the prioritisation with evidence from the scenario, then specify a channel and frequency of engagement for each priority group (for example, quarterly investor calls, workforce council, supplier code audits). Practise applying it to a scenario with a conflicting claim between two stakeholder groups and state how the board should resolve the conflict.