CMA Sri Lanka SL3 Business Strategy & Risk Management Exam flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

PESTLE analysis

A macro-environment scanning tool covering Political, Economic, Social, Technological, Legal and Environmental factors, used to identify forces outside the organisation that may affect strategy and risk.

Porter's Five Forces

A framework assessing industry attractiveness through rivalry, new entrants, substitutes, supplier power and buyer power. Strong combined forces imply lower profitability potential and weaker strategic attractiveness.

VRIN criteria

A test for core competences: a capability must be Valuable, Rare, hard to Imitate and Non-substitutable to support sustained competitive advantage rather than temporary advantage.

Ansoff matrix

A growth options grid crossing products with markets: market penetration, product development, market development and diversification. Diversification carries the highest risk because both product and market are new.

Generic strategies

Porter's three competitive positions: cost leadership, differentiation and focus. A firm failing to achieve any clearly is 'stuck in the middle' and typically earns below-average returns.

BCG matrix

A portfolio tool plotting business units by market growth and relative market share, producing stars, cash cows, question marks and dogs, each implying different investment priorities.

SAFe criteria

Strategy evaluation tests: Suitability (fits environment and capability), Acceptability (meets stakeholder return, risk and ethical expectations) and Feasibility (resources and competences can deliver it).

Sensitivity analysis

A technique that varies one assumption at a time to identify which variables most affect an outcome. It shows which factors matter but assigns no probabilities to them.

Real options

The value of managerial flexibility to defer, expand, contract or abandon a project. Static NPV ignores this flexibility, so real options can justify projects with negative conventional NPV.

Kotter's eight steps

A change model: create urgency, form a guiding coalition, build a vision, communicate it, empower action, generate short-term wins, consolidate gains and anchor change in culture.

Balanced Scorecard

A performance framework with financial, customer, internal process, and learning and growth perspectives, each defined by objectives, measures, targets and initiatives linked by cause and effect.

Lewin's change model

A three-stage change model: unfreeze existing behaviour, move to the new state, then refreeze so the new behaviour becomes the norm. Force-field analysis supports it.

Agency problem

The conflict arising when managers (agents) pursue their own interests rather than those of shareholders (principals), addressed through board monitoring, disclosure and incentive alignment.

Stakeholder salience model

Mitchell, Agle and Wood's model ranking stakeholders by power, legitimacy and urgency. Stakeholders possessing more of these attributes receive higher managerial priority.

Mendelow's matrix

A stakeholder mapping grid using power and interest: key players, keep satisfied, keep informed and minimal effort, each implying a different engagement approach.

Utilitarianism

An ethical theory judging actions by their consequences, specifically whether they produce the greatest good for the greatest number, rather than by duties or intentions.

ISO 31000 process

A risk management process: establish context, identify, analyse, evaluate and treat risk, supported throughout by communication and consultation plus monitoring and review.

Risk appetite

The amount and type of risk an organisation is willing to accept in pursuit of its objectives, approved by the board and translated into operational limits and tolerances.

Three lines model

A governance structure where operational management owns and manages risk, a risk and compliance function provides oversight, and internal audit gives independent assurance.

Risk capacity

The maximum risk an organisation can bear before breaching capital, solvency or regulatory constraints. Capacity sets the outer boundary within which risk appetite is chosen.

FMEA

Failure mode and effects analysis scores severity, occurrence and detection for each failure mode; the product gives a risk priority number used to rank corrective actions.

Residual risk

The level of risk remaining after existing controls and treatment actions have been applied, compared against risk appetite to decide whether further action is needed.

Bow-tie analysis

A diagram mapping multiple threats and their controls on one side, a central event, and multiple consequences and their controls on the other, clarifying cause and effect pathways.

TARA responses

Four risk treatment options: Tolerate (accept), Treat (mitigate), Transfer (insurance or contract) and Terminate (avoid the activity). Selection depends on cost versus benefit.

COSO internal control

A framework of five components: control environment, risk assessment, control activities, information and communication, and monitoring activities, supported by seventeen principles.

Segregation of duties

A control separating authorisation, custody, recording and reconciliation so that no single person can initiate, process and conceal a transaction without detection.

COSO ERM 2017

An enterprise risk framework with five components: governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and reporting.

Stress testing

A technique applying severe but plausible scenarios to assess whether an organisation's capital, liquidity or strategy would survive adverse conditions, informing contingency planning.

Risk aggregation

The process of combining individual risk exposures across the enterprise, accounting for correlations and concentrations, to determine the total portfolio risk position.

Risk heat map

A visual grid plotting risks by likelihood and impact, often colour-coded, allowing management and the board to prioritise attention on the highest-exposure areas.

Business impact analysis

A continuity planning technique identifying critical processes and setting recovery time objectives and recovery point objectives, so recovery priorities and resources can be planned.

Risk-based internal audit

An audit planning approach that allocates audit effort according to residual risk and control weakness, focusing coverage on the areas of greatest exposure to the organisation.