CMA Sri Lanka SL3 Business Strategy & Risk Management Exam key terms

A structured scan of political, economic, social, technological, legal and environmental forces outside an organisation, used to judge how far those forces may help or hinder its strategy.

A model assessing industry attractiveness through rivalry among existing firms, threat of new entrants, threat of substitutes, bargaining power of buyers and bargaining power of suppliers.

A technique that plots competitors on two or more strategically important dimensions to reveal clusters of firms with similar competitive approaches and to show where competitive space remains open.

A bundle of skills and technologies that a firm performs better than rivals, is difficult to imitate, and can be leveraged across several products or markets to create customer value.

A test asking whether a resource is valuable, rare, costly to imitate and supported by the organisation; answering yes to all four points to a sustained competitive advantage.

The perspective that lasting competitive advantage comes mainly from inside the firm, from resources and capabilities that are heterogeneously distributed and hard to transfer between competitors.

Breaking the firm into primary and support activities to identify where cost is incurred and where customer value is created, so that links between activities can be managed for advantage.

A summary that matches internal strengths and weaknesses against external opportunities and threats, useful for structuring discussion but not by itself a basis for choosing strategy.

A refinement of SWOT that pairs internal factors with external ones to generate four option types: strength-opportunity, weakness-opportunity, strength-threat and weakness-threat strategies.

A two-by-two grid of products and markets producing four growth directions: market penetration, product development, market development and diversification, each carrying different risk.

Entering new products or markets that differ from current ones; related diversification shares capabilities or value-chain activities, while unrelated diversification adds no such operating links and carries higher risk.

The role a head office plays in adding value to business units, judged by whether its central functions, guidance and intervention create benefits that outweigh the cost of the centre.

A portfolio tool plotting business units by market growth and relative market share, labelling them stars, cash cows, question marks or dogs and suggesting different investment priorities for each.

One of Porter's broad routes to competitive advantage: overall cost leadership, differentiation, or focus on a narrow segment combined with either low cost or differentiation.

Tests applied to proposed strategies covering suitability (does it fit the environment and capabilities), acceptability (risk, return and stakeholder reaction) and feasibility (resources and competences available).

Testing how much a strategy's projected outcome changes when one key assumption varies, thereby showing which assumptions most affect the decision and where more information is worth gathering.

Constructing a small number of plausible, internally consistent future environments so that strategy can be tested for robustness and contingency plans prepared before uncertainty resolves.

Treating an investment as the purchase of a right, not an obligation, to expand, defer, abandon or switch, so that managerial flexibility under uncertainty carries measurable value.

A mapping of stakeholders by their ability to affect the organisation and their concern with its actions, guiding whether to manage closely, keep informed, keep satisfied or simply monitor.

The degree to which managers prioritise a stakeholder's claim, determined by the combined presence of power, legitimacy and urgency in that stakeholder's relationship with the firm.

The risk that managers acting as agents pursue their own interests rather than those of shareholders, arising from separated ownership and control and addressed by incentives and monitoring.

A set of principles and provisions on board composition, independence, committees, risk oversight and disclosure that listed companies must apply or explain their departure from.

The extent to which non-executive directors are free of relationships with the company, its management or major shareholders that could materially influence their judgement in board decisions.

A board committee, normally chaired by an independent director, that oversees financial reporting, external and internal audit, and the integrity of the control environment.

A situation in which two or more moral obligations conflict, so that any available action breaches something of value and the choice requires reasoned justification rather than rule-following alone.

Disclosing wrongdoing inside or outside an organisation by a person with inside knowledge, protected in effective governance systems by confidential reporting channels and anti-retaliation safeguards.

The amount and type of risk an organisation is willing to accept in pursuit of its objectives, expressed in statements or limits that guide decisions and constrain risk-taking.

The acceptable variation around a specific objective or limit, translating broad risk appetite into practical thresholds that operational managers can monitor and act upon.

The maximum risk an organisation could bear before its solvency, reputation or objectives are seriously impaired, independent of how much risk it actually wishes to take.

A living record of identified risks, each with owner, cause, potential consequence, assessed likelihood and impact, existing controls and agreed further action with target dates.

A visual grid plotting risks by likelihood and impact so that a portfolio of exposures can be compared at a glance and priorities for treatment agreed.

The level of exposure assessed before taking account of the controls currently in place, providing the baseline against which control effectiveness and residual exposure are judged.

The exposure that remains after existing controls have operated, which must be compared with risk appetite to decide whether further treatment is required.

Choosing and applying a response to a risk: avoid the activity, reduce likelihood or impact through controls, transfer it to another party, or accept it with awareness.

Shifting the financial consequence of a risk to another party, typically through insurance, hedging or contractual terms, without removing the underlying exposure or its reputational effects.

A forward-looking metric tracked against thresholds to give early warning that a risk is rising, chosen because it moves before the loss event rather than after it.

The policies, procedures and organisational structures designed to safeguard assets, produce reliable reporting and support compliance with laws and objectives across the entity.

A widely used model of internal control built on five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

A governance structure in which operational management owns and manages risk, a risk and compliance function provides oversight, and internal audit gives independent assurance to the board.

An integrated, portfolio-wide approach to identifying, assessing and responding to risks across all functions, linking risk to strategy and appetite rather than managing risks in isolated silos.