Governance and Management: Boards, Risk and Control
Concepts to master
Governance questions examine how organisations are directed and controlled. Know agency theory, stakeholder theory, the roles of the board and management, the separation of chair and chief executive, independent non-executive directors, board committees, particularly audit and risk committees, disclosure and transparency, and the comply-or-explain approach. Management questions cover planning, organising, directing and controlling; motivation and leadership; performance measurement; and the control environment within frameworks such as COSO.
Traps in questions
- Confusing governance, which sets direction and oversight, with management, which executes day-to-day operations.
- Assuming all non-executive directors are independent. Independence requires no material relationship with the company.
- Allowing the chief executive to chair the board, which concentrates power and weakens oversight.
- Staffing the audit committee with executives or with members lacking financial expertise.
- Treating internal control as only accounting controls. It includes the control environment, risk assessment, control activities, information and communication, and monitoring.
- Classifying a detective control, such as reconciliation, as preventive, or vice versa.
- Ignoring the agency problem: managers may pursue growth, perks or entrenchment rather than shareholder value.
Worked rule of thumb
A sound board separates the chair and chief executive, has a majority of independent non-executive directors, and operates an audit committee composed entirely of independent non-executives with at least one financial expert. The committee should meet the external auditor without management present and review the effectiveness of internal control and risk management. Departures from a governance code should be explained, not hidden.
Control logic
Preventive controls stop errors; detective controls find them; corrective controls fix them. Design controls around identified risks rather than copying a checklist.