CMA Sri Lanka SL3 Business Strategy & Risk Management Exam common mistakes
CMA Sri Lanka SL3 Business Strategy & Risk Management Exam · Understand the traps and how to avoid them.
Writing a full PESTLE, five forces, and SWOT analysis for every scenario question regardless of what the question actually asks, then stopping without stating a conclusion or recommendation.
Candidates memorise the analytical frameworks as a checklist and treat 'use a model' as the objective, so they dump analysis instead of answering the verb that the question uses (evaluate, recommend, assess). Under time pressure the framework dump feels productive and safe.
What to do instead
Read the command verb first and underline it. Select only the two or three framework elements that bear on that verb, apply each to facts given in the scenario, and finish with an explicit judgement sentence ('Therefore the attractiveness of the industry is limited because...'). Practise past-style questions by writing only the conclusion and the three supporting points, then checking whether the analysis you added actually changed the conclusion.
Treating SWOT as the analysis and listing strengths, weaknesses, opportunities and threats as unconnected bullet points, without matching them into SO/ST/WO/WT options or linking them to the strategic choice.
SWOT is taught early and feels elementary, so candidates list items quickly and move on, not realising that marks are awarded for the synthesis and for using the output to generate strategic options.
What to do instead
Always convert the SWOT into a TOWS matrix: pair internal factors with external factors to produce at least two strategic options, then state which option the organisation should pursue and why. In the exam, write SWOT as a four-quadrant grid and draw arrows to the option you recommend.
Evaluating strategic options by listing SAFS criteria or a balanced scorecard perspective in the abstract, without testing the specific option against suitability, acceptability, and feasibility using the numbers and constraints given.
Candidates learn the criteria as definitions and reproduce them, rather than applying them as tests. Numerical acceptability tests (payback, NPV, sensitivity) are skipped because they take time and candidates fear the arithmetic.
What to do instead
For each option, write three short tests: Suitability (does it fit the environment and capability?), Acceptability (return, risk, stakeholder reaction - use the figures given), Feasibility (funds, skills, capacity). Show at least one calculation from the scenario data even if approximate, and state a ranked recommendation. Rehearse simple payback and sensitivity calculations until they take under two minutes.
Describing the chosen strategy in detail but omitting the implementation layer - structure, culture, resourcing, and the sequence of change - so the answer ends at 'the company should diversify'.
Formulation frameworks are more familiar and more concrete than implementation, and candidates run out of time after the analysis and choice stages, treating implementation as an afterthought.
What to do instead
Reserve roughly a third of the answer for implementation. Use a structure such as McKinsey 7S or the cultural web to identify what must change, name the change approach (e.g. Kotter's steps or Lewin's unfreeze-change-refreeze) and specify resources, timelines, and who owns each action. Before the exam, build a one-page implementation checklist you can reproduce from memory.
Answering a governance question by describing what the board does in general, without distinguishing executive from non-executive directors, independence, board committees, or the separation of chair and CEO.
Candidates conflate 'governance' with 'management' and rely on generic statements about good practice. They have not internalised the specific structural safeguards that codes of corporate governance require.
What to do instead
Learn the structural checklist cold: board composition and independence, separation of chair and CEO, audit/remuneration/nomination committees with independent chairs, board evaluation, and disclosure. When answering, name which safeguard is missing in the scenario, why it matters (e.g. agency problem, dominance of a controlling shareholder), and the specific remedy.
Treating ethics as a list of moral virtues, or applying a single ethical theory to every case, instead of identifying the stakeholders, their conflicting interests, and applying a named framework consistently.
Ethics feels subjective, so candidates write vague statements about integrity. They also mix teleological and deontological reasoning mid-answer, producing an inconsistent conclusion.
What to do instead
Structure every ethics answer in three steps: identify the stakeholders and their stakes; apply one named framework (utilitarian, rights-based, or virtue ethics) explicitly; then state the decision and how it would be defended to each stakeholder group. Note where frameworks conflict and justify the choice you make.
Confusing risk identification with risk assessment, and risk response with control, so that a question asking for responses receives a list of risks, or a question on controls receives generic 'monitor it' answers.
The risk management stages are learned as a sequence but the distinctions blur under exam pressure, and verbs such as 'identify', 'assess', 'treat', and 'monitor' are not read precisely.
What to do instead
Memorise the stage-to-verb mapping: identify = name and describe the event and its cause; assess = likelihood x impact with a rating; respond = TARA (tolerate, avoid, reduce, transfer) with a named mechanism; monitor = indicators, owners, and reporting. In each answer, label the stage you are addressing so the marker can see you have stayed within it.
Listing risk responses without matching the response to the assessed level of risk or considering cost-benefit, e.g. recommending insurance for a risk that should be avoided, or accepting a high-impact risk with no justification.
Candidates treat TARA as a set of options to be enumerated rather than a decision rule. They do not link the response back to the risk rating or to the cost of the control.
What to do instead
For each material risk, state the rating first, then the response, then the rationale including cost versus benefit and residual risk after treatment. Show that low risks are tolerated, high-likelihood/high-impact risks are avoided or reduced, and transfer is used only where a willing insurer or contract counterparty exists.
Describing internal control as a list of individual controls (segregation of duties, reconciliations) without situating them in the COSO components or linking them to the entity's risk register and objectives.
Candidates recall specific controls from financial accounting and auditing studies and reproduce them, but have not learned the control environment, risk assessment, control activities, information and communication, and monitoring structure as an integrated framework.
What to do instead
Frame every internal control answer around the five COSO components, placing the specific controls you name under 'control activities' and explaining how monitoring and the control environment make them effective. Link each control to a named risk from the scenario and to the objective it protects. Use a table: risk - control - COSO component - evidence of operation.
Producing a performance measurement answer that recommends only financial KPIs, or lists a balanced scorecard's four perspectives without designing actual measures and targets for the scenario.
Financial metrics are the most familiar and easiest to recall, and the balanced scorecard is remembered as four headings rather than as a design tool. Candidates also forget to link measures to strategy.
What to do instead
Always design measures: for each perspective, give one lead and one lag indicator with a formula, a target, and a frequency, and state which strategic objective it tracks. Include non-financial measures such as customer retention, cycle time, defect rate, and employee capability, and explain how the measures would drive behaviour and avoid gaming.