I85PREP
⌘ K
CGIA study materials
CGIA study resources

CGIA: Governance, Risk Management, and Control Frameworks

CGIA · Work through your exam, one topic at a time.

All guide sections

Governance, Risk Management, and Control Frameworks

This domain tests how you frame every audit judgment: governance, risk management, and control, plus the Three Lines Model and the public-sector accountability chain.

Core rules

  • Governance is the processes by which an organization is directed, controlled, and held accountable. In government it adds legislative oversight, stewardship of public funds, transparency and central-agency rules, so "the board" may be a council, commission or legislature.
  • COSO ERM (2017) has five components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication and reporting.
  • COSO Internal Control-Integrated Framework (2013) has five components and 17 principles: control environment, risk assessment, control activities, information and communication, and monitoring activities. Control activities include authorizations, segregation of duties, reconciliations, physical controls and IT controls.
  • The Three Lines Model (IIA, 2020) allocates roles, not departments: operational management owns and manages risk; risk and compliance functions monitor, advise and challenge; internal audit gives independent assurance to the governing body.
  • Relevant Standards: 2110 governance, 2120 risk management (evaluate exposures and fraud risk), 2130 control (evaluate adequacy and efficiency).

Worked example

A waste-billing office lets one clerk both post and approve billing adjustments, and the risk register lists "revenue leakage" with no owner or control. Reasoning: segregation of duties is missing, so the control exists only on paper; no second-line review exists; monitoring is absent. Conclusion: report a design deficiency in control activities plus a monitoring gap, and recommend a second approver and monthly exception reporting to management.

Traps

Treating the three lines as job titles; saying internal audit "owns" enterprise risk; assuming a documented control is an operating control; confusing ERM strategy work with day-to-day internal control.