CMA Sri Lanka SL3 Business Strategy & Risk Management Exam cheat sheet

PESTLE covers Political, Economic, Social, Technological, Legal, Environmental factors; use it to scan macro forces before industry-level analysis.

Porter's Five Forces: rivalry intensity, threat of new entrants, threat of substitutes, supplier bargaining power, buyer bargaining power. High combined force pressure means low industry profit potential.

Industry attractiveness is judged by the strength of the five forces, not by market size; a large market with weak barriers can still earn low returns.

Strategic group mapping plots firms on two competitive dimensions; firms in the same group face similar competitive pressure and often imitate each other.

Porter's value chain separates primary activities (inbound logistics, operations, outbound logistics, marketing and sales, service) from support activities (firm infrastructure, HR, technology development, procurement).

Core competence test (Prahalad and Hamel): a competence must be valuable, rare, hard to imitate and non-substitutable to qualify as a source of sustained advantage (VRIN).

SWOT is only a summary tool; strengths and weaknesses are internal, opportunities and threats external, and pairing them yields SO, ST, WO and WT options.

Life-cycle stages (introduction, growth, maturity, decline) shift the balance of rivalry and pricing power; maturity typically intensifies price competition.

Ansoff matrix: existing products/markets (market penetration), new products/existing markets (product development), existing products/new markets (market development), new products/new markets (diversification).

Porter's generic strategies: cost leadership, differentiation and focus; being stuck in the middle means neither lowest cost nor clear differentiation, which erodes returns.

Mintzberg's 5 Ps of strategy: Plan, Ploy, Pattern, Position, Perspective.

Corporate-level strategy answers 'which businesses should we be in'; business-level strategy answers 'how do we compete in each one'.

Diversification is related when it shares value-chain activities or capabilities; unrelated diversification relies on portfolio management and financial synergies.

BCG matrix: stars (high growth, high share), cash cows (low growth, high share), question marks (high growth, low share), dogs (low growth, low share).

Parenting advantage exists only when the corporate centre adds more value to a business than an alternative owner would.

Vertical integration is justified when transaction costs, hold-up risk or quality control outweigh the loss of flexibility from market contracting.

SAFe criteria: Suitability (fits the environment and capabilities), Acceptability (meets stakeholder return, risk and ethical expectations), Feasibility (resources and competences can deliver it).

Suitability tools include SWOT pairing, TOWS, life-cycle analysis and Porter's Five Forces fit; acceptability uses return, risk and stakeholder reaction tests.

Feasibility screening checks financial capacity, people and skills, physical resources and the ability to achieve required market position.

Risk in strategy evaluation is assessed through sensitivity analysis (change one variable), scenario analysis (coherent alternative futures) and simulation.

Decision trees compare expected monetary values of options by weighting payoffs by probability; they clarify but do not eliminate uncertainty.

Real options thinking values the flexibility to defer, expand, contract or abandon; flexibility has value that static NPV ignores.

Shareholder value analysis discounts forecast free cash flows at the cost of capital; a strategy is acceptable if NPV is positive after strategic risk adjustment.

Strategy selection is political as well as analytical; coalition-building and the influence of dominant stakeholders can override rational appraisal.

Mintzberg's emergent strategy: realised strategy is the pattern that emerges from intended strategy filtered by deliberate choices and unintended drift.

Kotter's eight steps: urgency, guiding coalition, vision, communicate, empower action, short-term wins, consolidate gains, anchor in culture.

Lewin's model: unfreeze, move (change), refreeze; force-field analysis weighs driving against restraining forces.

Balanced Scorecard perspectives: financial, customer, internal process, learning and growth; each needs objectives, measures, targets and initiatives.

Kaplan and Norton strategy map logic: learning and growth drives internal process, which drives customer outcomes, which drive financial results.

Performance measures must be specific, measurable, achievable, relevant and time-bound; lagging indicators report results while leading indicators predict them.

Cultural web (Johnson and Scholes): stories, rituals and routines, symbols, organisational structures, control systems, power structures.

Change readiness depends on the perceived cost-benefit to individuals, the clarity of the vision and the credibility of the change leaders.

Agency problem: separation of ownership and control lets managers pursue self-interest; governance mechanisms include boards, audit, incentives and disclosure.

Board committees typically comprise audit, remuneration and nomination; independence of non-executive directors is central to effective monitoring.

Stakeholder salience model (Mitchell, Agle and Wood): power, legitimacy and urgency determine which stakeholders managers prioritise.

Mendelow's matrix classifies stakeholders by power and interest: high power/high interest (key players), high power/low interest (keep satisfied), low power/high interest (keep informed), low/low (minimal effort).

Ethical theories: utilitarianism judges by outcomes (greatest good), deontology by duties and rules, virtue ethics by character, justice by fairness of distribution.

A code of ethics is effective only when supported by tone at the top, training, whistleblowing channels and consistent sanctions.

Corporate social responsibility covers economic, legal, ethical and philanthropic responsibilities (Carroll's pyramid).

Related-party transactions and conflicts of interest require disclosure and, where material, independent approval to protect minority shareholders.

ISO 31000 process: establish context, identify risk, analyse risk, evaluate risk, treat risk, with communication and consultation plus monitoring and review throughout.

Risk is the effect of uncertainty on objectives; it has both downside and upside, and is expressed as likelihood combined with consequence.

Risk appetite is the amount of risk an organisation is willing to accept in pursuit of objectives; risk tolerance is the acceptable variation around that appetite.

Risk architecture defines roles, responsibilities, reporting lines and the risk committee structure; risk strategy defines the organisation's approach and appetite.

Three lines model: operational management owns risk, the risk and compliance function oversees, internal audit provides independent assurance.

A risk register records risk description, cause, consequence, owner, inherent and residual rating, controls and treatment actions.

Risk capacity is the maximum risk the organisation can bear before breaching capital or solvency constraints; it caps the appetite.

Embedding requires risk to be integrated into planning, budgeting, performance appraisal and decision-making, not treated as a compliance exercise.

Identification techniques: brainstorming, workshops, interviews, Delphi, checklist, HAZOP, FMEA, fault tree analysis, scenario analysis and incident data review.

FMEA scores severity, occurrence and detection to produce a risk priority number (RPN = S x O x D); higher RPN means higher priority.

Likelihood and impact are typically scored on a 5x5 matrix; risk score = likelihood rating x impact rating.

Inherent risk is assessed before controls; residual risk is assessed after existing controls are applied.

Bow-tie analysis separates multiple causes (threats) on one side from multiple consequences on the other, with controls on each pathway.

Qualitative assessment uses descriptive scales; quantitative assessment uses probability distributions, historical loss data and modelling.

Risk correlation matters: risks that materialise together can aggregate into a loss far greater than the sum of individual assessments.

Control risk arises when controls are poorly designed or not operating; testing design and operating effectiveness addresses it.

TARA responses: Tolerate (accept), Treat (mitigate), Transfer (insurance, contracts), Terminate (avoid the activity); some frameworks add Take/exploit for upside risk.

COSO internal control components: control environment, risk assessment, control activities, information and communication, monitoring activities.

COSO principles require segregation of duties, authorisation, reconciliation, physical controls, and IT general controls.

Preventive controls stop errors before they occur; detective controls find errors after; corrective controls restore the position.

A control should be proportionate: its cost should not exceed the expected loss reduction it delivers.

Transfer does not eliminate risk entirely; insurance leaves retention, deductibles, exclusions and counterparty risk.

Key risk indicators are metrics with thresholds that give early warning that risk exposure is rising.

Business continuity planning uses business impact analysis to set recovery time objectives and recovery point objectives for critical processes.

ERM manages risk portfolio-wide across silos, aligning risk appetite with strategy rather than treating risks independently.

COSO ERM 2017 components: governance and culture, strategy and objective-setting, performance, review and revision, information, communication and reporting.

Risk aggregation examines how individual exposures combine at enterprise level; diversification can reduce net exposure but concentration increases it.

Risk reporting should be timely, accurate, relevant and decision-useful; dashboards use heat maps and trend indicators for boards.

Stress testing and reverse stress testing identify scenarios that would breach solvency or strategic objectives.

Embedding ERM requires risk-adjusted performance measures, risk-based capital allocation and risk consideration in major investment decisions.

Maturity models typically progress from ad hoc, to repeatable, to defined, to managed, to optimised risk processes.

ERM links to internal audit through the audit plan, which should be risk-based and prioritise high residual risk areas.

Agency theory predicts managers may over-invest, consume perks or resist takeover; monitoring and incentive alignment are the remedies.

Stewardship theory assumes managers are trustworthy stewards; it favours empowered boards over heavy monitoring.

Stakeholder theory holds that firms should account for all affected parties, not only shareholders.

Legitimacy theory explains that organisations seek to operate within societal norms, and disclosure maintains their social licence.

Insider trading, bribery, facilitation payments and conflicts of interest are core integrity risks requiring policy and monitoring.

An effective whistleblowing policy guarantees confidentiality, protection from retaliation and independent investigation.

The triple bottom line reports economic, social and environmental performance (profit, people, planet).

Ethical decision tests include the public disclosure test, the golden rule and the rights test.

Risk taxonomy groups risks into strategic, operational, financial, compliance and reputational categories to ensure complete identification.

Root cause analysis asks 'why' repeatedly to distinguish underlying causes from symptoms.

Scenario analysis constructs plausible futures to test strategy against shocks that historical data may not capture.

Monte Carlo simulation runs many random draws from input distributions to produce a range of outcomes and confidence intervals.

Expected loss = probability of event x financial impact; expected loss is used for pricing and provisioning, unexpected loss for capital.

Value at Risk (VaR) states the maximum loss at a given confidence level over a defined horizon; it says nothing about losses beyond that threshold.

Risk heat maps plot likelihood against impact to prioritise risks visually for management and the board.

Data quality limits assessment: incomplete or biased loss data understates frequency and severity.

Control self-assessment lets process owners evaluate and attest to the effectiveness of their own controls.

Segregation of duties separates authorisation, custody, recording and reconciliation so no one person controls a transaction end to end.

IT general controls cover access management, change management, backup and recovery, and IT operations.

Application controls cover input validation, processing completeness and output accuracy.

A compensating control substitutes for a primary control that cannot be applied, such as independent review when segregation is impractical.

Key control testing samples transactions and evidence to confirm the control operated as designed throughout the period.

Residual risk above appetite requires escalation, additional treatment or a formal, time-bound acceptance.

Incident management captures near misses and losses to feed back into risk identification and control improvement.

Risk appetite statements should be specific and measurable, for example maximum acceptable loss per transaction or a target credit rating.

Risk culture is evidenced by how people behave when no one is watching, including escalation of bad news.

Risk committees at board and management level oversee the risk profile, appetite breaches and emerging risks.

Emerging risks such as cyber, climate and regulatory change are identified through horizon scanning before they appear in loss data.

Risk-based internal audit plans allocate audit effort according to residual risk and control weakness.

Integrated reporting connects strategy, governance, performance and prospects, including material risk disclosure.

Risk-adjusted return on capital compares return against capital consumed by risk, guiding capital allocation.

ERM failure often stems from silo thinking, weak data, unclear ownership and risk appetite disconnected from strategy.

Porter's diamond explains national competitive advantage through factor conditions, demand conditions, related and supporting industries, and firm strategy, structure and rivalry.

Industry life cycle and the experience curve both predict falling unit costs as cumulative output rises; this underpins cost leadership.

PESTLE factors should be assessed for likelihood and impact, not merely listed.

The macro environment is largely outside managerial control; the industry environment is shaped partly by firm choices.

Competitor analysis examines objectives, assumptions, current strategy and capabilities to predict rival moves.

Buyer power rises when buyers are concentrated, purchases are large relative to their costs, products are undifferentiated, or switching costs are low.

Supplier power rises when suppliers are few, their product is critical, or forward integration is credible.

Barriers to entry include economies of scale, capital requirements, brand loyalty, regulation and access to distribution.

Mission states purpose and scope; vision states the desired future; values state behavioural principles; objectives must be measurable.

Growth options: organic growth, mergers and acquisitions, joint ventures and strategic alliances; each trades control against speed and risk.

A joint venture suits high uncertainty and shared capabilities but creates governance and exit complications.

Cost leadership requires scale, standardisation and tight cost control; differentiation requires innovation, brand and customer insight.

Focus strategy serves a narrow segment with either cost focus or differentiation focus.

Core rigidity occurs when capabilities that once drove success become barriers to adaptation.

Blue ocean thinking seeks uncontested market space through value innovation rather than competing on existing dimensions.

Strategic drift arises when strategy lags environmental change through incremental adjustment and denial.

Sensitivity analysis identifies which variables most affect the outcome; it does not assign probabilities.

Scenario analysis assigns coherent sets of assumptions to alternative futures and tests strategy robustness across them.

Payback period measures time to recover investment; it ignores cash flows after payback and the time value of money.

Accounting rate of return divides average profit by average investment; it ignores timing of cash flows.

Internal rate of return is the discount rate at which NPV equals zero; accept projects whose IRR exceeds the cost of capital.

Profitability index = present value of cash inflows divided by initial investment; useful when capital is rationed.

Stakeholder acceptability tests: return, risk and ethical acceptability to each stakeholder group.

A strategy scoring matrix weights critical success factors and scores options against them to structure choice.

Structure follows strategy (Chandler): growth and diversification require the multi-divisional form.

Functional structure suits single-business firms; divisional structure suits diversified firms; matrix structure balances product and geography but creates dual reporting.

Performance measurement must avoid gaming: measures drive behaviour, so unintended consequences must be anticipated.

Benchmarking compares performance against best practice internally, competitively or functionally.

The balanced scorecard links measures through cause and effect, not as an unconnected list of KPIs.

Kotter's short-term wins build credibility and momentum but must not substitute for deeper change.

Resistance to change is reduced by participation, communication, support and negotiated agreement.

Transfer pricing and internal resource allocation determine whether divisional performance reflects genuine contribution.

Governance codes typically require a majority of independent non-executive directors and separation of chair and CEO roles.

The audit committee oversees external audit, internal audit and financial reporting, and should comprise independent directors with financial expertise.

Remuneration should be linked to long-term performance and include clawback provisions to align with shareholders.

Transparency requires timely, accurate and complete disclosure of material information to the market.

Conflict of interest requires declaration, recusal from decisions and independent oversight.

A bribery risk assessment should cover third parties, agents, gifts, hospitality and facilitation payments.

Stakeholder engagement ranges from informing to consulting to partnership, depending on power and interest.

Board diversity and skills matrices ensure the board has the mix of experience needed to challenge management.

The risk management process must be proportionate to the size, complexity and risk profile of the organisation.

Risk owners are accountable for managing specific risks; the risk function facilitates but does not own operational risks.

Risk registers should be reviewed at defined intervals and on trigger events such as major incidents or strategic change.

Risk appetite must be approved by the board and communicated down through tolerances and limits.

Risk maturity assessment identifies gaps between current and desired practice and drives improvement plans.

Insurance, hedging and contractual transfer are risk financing tools applied after risk reduction options are considered.

Business continuity and crisis management sit within the risk framework as response capabilities for severe events.

Independent assurance on the risk framework comes from internal audit and, where required, external review.

Risk descriptions should state cause, event and consequence so that controls can be targeted at causes.

Likelihood scales should be defined with explicit frequencies (for example once in 10 years) to reduce subjectivity.

Impact scales should be defined in financial and non-financial terms, including reputational and regulatory consequences.

Risk workshops should include cross-functional participants to surface risks hidden within silos.

Near-miss reporting improves frequency estimates before a major loss occurs.

External data such as industry loss databases supplement sparse internal loss experience.

Risk interdependencies should be mapped so that cascading failures are recognised.

Assessment should be repeated after controls change or after significant external events.

Avoidance removes the activity and its risk, but may forgo strategic opportunity.

Mitigation reduces likelihood or impact through controls, process redesign or diversification.

Acceptance must be documented, approved at the right authority level and reviewed periodically.

Transfer shifts financial consequences through insurance, outsourcing or contractual indemnities.

Control environment is the foundation; weak tone at the top undermines all other controls.

Monitoring activities include ongoing supervision and separate evaluations such as internal audit.

Deficiencies in internal control should be reported to management and, if significant, to the audit committee.

Documentation of controls enables testing, succession and consistency of operation.

ERM aligns risk appetite with strategy by defining appetite before strategic choices are made.

Portfolio view: aggregate risk exposure should be assessed against risk capacity and capital.

Risk reporting to the board should focus on material risks, appetite breaches, emerging risks and treatment progress.

Scenario and stress testing inform capital planning and strategic resilience.

Risk culture is assessed through surveys, incident reporting rates and escalation behaviour.

ERM should inform performance management through risk-adjusted metrics and risk-informed objectives.

Integration with strategy means risk is considered at planning, investment appraisal and performance review stages.

Continuous improvement of ERM is driven by monitoring, review and learning from incidents.

Globalisation drivers include market, cost, government and competitive factors.

Institutional voids in emerging markets raise transaction costs and require different entry strategies.

Technological disruption shortens product life cycles and can make existing capabilities obsolete.

Regulatory change can create or destroy barriers to entry and alter industry structure.

Environmental factors increasingly affect cost structures, supply chains and reputational risk.

Social trends shift demand patterns and stakeholder expectations, affecting strategy viability.

Industry convergence blurs boundaries between sectors and redefines competitor sets.

Scenario planning helps strategy remain robust across uncertain external futures.

Strategy formulation should follow analysis of external environment and internal capability, not precede it.

Objectives should cascade from mission and vision and be translated into measurable targets.

Resource-based view emphasises internal resources and capabilities as the primary source of advantage.

Dynamic capabilities describe the ability to integrate, build and reconfigure competences in changing environments.

Strategic alliances can share risk and access capabilities but require clear governance and exit terms.

Mergers and acquisitions create value only when synergies exceed the premium paid and integration risk.

Turnaround strategy involves retrenchment, cost reduction and repositioning before growth resumes.

Corporate parenting roles range from portfolio manager to synergy manager to parental developer.

NPV discounts all future cash flows at the cost of capital and is the primary investment appraisal method.

Discount rate should reflect the risk of the project, not just the firm's average cost of capital.

Capital rationing requires ranking projects by profitability index when funds are limited.

Sensitivity analysis should identify the percentage change in a variable that makes NPV zero.

Scenario analysis should include plausible worst-case and best-case futures, not only base case.

Strategic fit should be tested against capabilities, culture and stakeholder expectations.

Risk-adjusted appraisal should consider strategic risk, not only financial risk.

Evaluation should be documented to support accountability and learning.

Implementation requires alignment of structure, systems, style, staff, skills and shared values (McKinsey 7S).

Change programmes should define scope, milestones, resources and governance.

Communication should be repeated and two-way to reduce uncertainty and resistance.

Performance targets should be challenging but achievable to avoid demotivation or gaming.

Leading and lagging indicators should be used together for balanced performance management.

Benchmarking should compare like with like and lead to action, not just reporting.

Reward systems should reinforce the behaviours the strategy requires.

Lessons learned should be captured and fed into future change programmes.

Board effectiveness depends on independence, competence, diversity and constructive challenge.

The chair leads the board; the CEO leads management; combining roles weakens accountability.

Non-executive directors should meet without management present to encourage candour.

Audit committee should review internal control and risk management arrangements.

Remuneration committee should set pay that rewards sustainable performance.

Nomination committee should plan succession and board composition.

Ethical culture is reinforced by consistent consequences for misconduct.

Stakeholder engagement should be systematic and recorded to inform decisions.

Risk framework should be documented, approved by the board and reviewed periodically.

Risk roles and responsibilities should be defined in terms of accountability, not just activity.

Risk appetite should be translated into limits and tolerances at operational level.

Risk reporting should be timely and relevant, with escalation routes for breaches.

Risk training should build capability across the organisation.

Risk framework should be proportionate and integrated with existing management processes.

Assurance should be independent of the risk-taking function.

Framework review should consider changes in strategy, environment and regulation.

Identification should be systematic and repeatable, using multiple techniques.

Risk categories should reflect the organisation's activities and strategy.

Likelihood and impact scales should be calibrated and consistently applied.

Assessment should distinguish inherent and residual risk.

Risk owners should validate assessments and agree treatment.

Assessment should consider both threats and opportunities.

Data quality and assumptions should be documented.

Assessment should be refreshed after significant change.

Response selection should consider cost, benefit and residual risk.

Controls should be designed to address specific risks and tested for effectiveness.

Segregation of duties, authorisation and reconciliation are core preventive controls.

Monitoring and review should confirm controls continue to operate.

Deficiencies should be remediated within agreed timescales.

Acceptance of residual risk should be formally approved.

Control documentation should be kept current.

Control environment should be assessed as part of the overall control framework.

ERM should be embedded in strategy-setting, not applied after strategy is chosen.

Risk appetite should guide resource allocation and performance targets.

Risk aggregation should consider correlations and concentrations.

Risk reporting should support board decision-making on material risks.

Stress testing should inform capital and liquidity planning.

Risk culture should be assessed and developed.

ERM should be reviewed for effectiveness and improved over time.

ERM should link to internal audit through a risk-based plan.

Strategy formulation should balance external opportunity with internal capability.

Objectives should be specific, measurable and time-bound.

Growth strategy should consider organic, acquisition and alliance options.

Competitive strategy should be clearly positioned, not stuck in the middle.

Diversification should be justified by synergy or parenting advantage.

Strategy should be reviewed as the environment changes.

Stakeholder expectations should inform strategy choices.

Strategy should be communicated clearly to guide implementation.