CMA Sri Lanka SL3 Business Strategy & Risk Management Exam
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
SL3 Business Strategy and Risk Management is the strategic-level paper in CMA Sri Lanka's professional programme. It sits above the operational and management levels and assumes you can already read financial statements, cost a product and explain basic control concepts. SL3 asks you to think like a board adviser: diagnose an organisation's competitive position, choose between strategic options, plan implementation and change, and then build a risk framework that connects governance, internal control and enterprise risk management into one coherent story.
The paper suits candidates moving from technical accounting roles into business partnering, planning or risk functions, and it rewards anyone who can write a structured argument under time pressure. The syllabus is roughly one-fifth external analysis, one-fifth strategy formulation and evaluation, and around one-third risk content, with the remainder on implementation, performance measurement, governance and ethics. Expect both multiple-choice questions testing definitions and frameworks and constructed-response questions built around a scenario.
Preparation works best in two passes. First build a framework map - PESTEL, Porter's five forces, value chain, SWOT, Ansoff, BCG, risk appetite and tolerance, COSO-style ERM components - so you can name and apply each tool. Then practise applying them to written case scenarios, because marks come from analysis of the specific organisation, not from describing the model. Work through past-paper style questions, time your answers, and get feedback on structure. Confirm the current syllabus, exam format and logistics on CMA Sri Lanka's official website before you plan your study schedule.
What you'll study
About CMA Sri Lanka SL3 Business Strategy & Risk Management Exam preparation
What is the SL3 exam actually testing?
Whether you can apply strategy and risk frameworks to a specific organisation rather than recite them. Questions typically give a scenario and ask you to analyse the environment, evaluate options, recommend a course of action, or design a risk response. Marks reward justified analysis and clear recommendation, not model description.
How is the exam structured?
The published format combines multiple-choice questions with constructed-response questions. The precise number of questions and the split between sections are set by CMA Sri Lanka and can change between sittings, so check the current syllabus and examiner's instructions on the official CMA Sri Lanka website rather than relying on second-hand accounts.
How long is the exam and what is the pass mark?
Both are set by the institute and published officially. CMA Sri Lanka's website and your student handbook carry the current duration, pass mark and any sectional requirements. Do not plan your revision around figures quoted in forums, because they are often out of date or refer to older syllabuses.
How difficult is SL3 compared with earlier levels?
The technical content is not dramatically harder, but the assessment is. Earlier levels reward correct computation; SL3 rewards judgement. Candidates who lose marks usually know the frameworks but fail to apply them to the scenario, run out of time on written answers, or give recommendations with no supporting analysis.
Can I retake, and how often?
Retakes are permitted, but the rules on attempt limits, waiting periods and fees are set by CMA Sri Lanka and change from time to time. Confirm the current policy directly with the institute before you plan a resit, particularly if you are close to any attempt limit.
Which order should I study the domains in?
Start with external analysis and strategy formulation, since they supply the vocabulary used everywhere else. Then move to implementation and performance measurement, which link strategy to control. Finish with the risk domains: framework and identification first, then response, internal control and ERM. Governance and ethics are best revised last, as they draw on all the others.
How much writing practice do I need?
Substantial. Constructed-response marks come from structure: define the issue, apply the framework to the facts, weigh alternatives, recommend. Practise full answers under timed conditions and get them marked or self-mark against a model answer. Reading notes is not enough preparation for a written strategic paper.
What are the most common reasons candidates fail?
Three recur: answering the question they prepared rather than the one asked, describing a model without applying it to the scenario, and poor time allocation that leaves later questions thin. A fourth is ignoring the risk and governance domains because they feel less technical, even though they carry significant weight.
Where do I confirm exam dates, fees and entry requirements?
Only on CMA Sri Lanka's official website and communications. The institute publishes the current timetable, fees, entry requirements and any exemptions. Treat this page as study guidance, not as an official source, and verify all logistics before you register or book travel.