CMA Sri Lanka SL4 Corporate Governance & Ethics Exam cheat sheet

Agency theory: separation of ownership and control creates agency costs (monitoring, bonding, residual loss); governance mechanisms aim to align agent (manager) interests with principal (shareholder) interests.

Stewardship theory assumes managers are intrinsically motivated to act in the organisation's interest; it justifies empowering boards and reducing costly monitoring rather than tightening control.

Stakeholder theory holds that the firm is accountable to parties beyond shareholders (employees, creditors, communities); it underpins sustainability and integrated reporting.

Resource dependency theory frames the board as a provider of critical resources - capital, legitimacy, expertise and network access - so board composition is chosen for resource fit.

Transaction cost economics (Williamson) explains governance structures as responses to asset specificity, uncertainty and opportunism; hierarchy substitutes for market contracting.

Principal–principal conflict describes majority versus minority shareholder tension, the dominant governance problem in family- and controlling-shareholder firms.

Cadbury Report (1992) established the comply-or-explain principle, board independence and audit committee norms; OECD Principles are the international reference standard.

Codes are typically a 'comply or explain' regime: deviation is permitted but must be disclosed and explained; 'apply and explain' (King IV) requires an explanation of how outcomes were achieved.

Board roles: strategy, monitoring/accountability, policy approval, CEO and senior appointment, risk oversight, and stakeholder communication.

Independence criteria typically exclude former employees, close family of executives, material suppliers/customers, professional advisers and long-tenured directors (commonly beyond 9 years).

Board balance: a majority of independent non-executive directors is the benchmark in many codes; separation of chair and CEO avoids concentration of power.

Board committees are delegated; the board retains ultimate responsibility and cannot delegate its own oversight accountability.

Board effectiveness levers: skills matrix, induction, continuing professional development, annual board and director evaluation, and succession planning.

Board meeting discipline: agendas aligned to strategy and risk, papers circulated in advance, quorum rules, minutes evidencing challenge and dissent.

NED remuneration should not include performance incentives tied to short-term profit, to protect independence of judgement.

Diversity (gender, skills, tenure, background) is linked to better challenge and reduced groupthink; many codes require a diversity policy and disclosure of targets.

Audit committee core mandate: oversee financial reporting integrity, external audit relationship, internal audit function and internal control/risk framework.

Composition benchmark: at least three members, all non-executive and majority independent, with at least one member financially literate; chair independent of the board chair.

External auditor independence safeguards: partner rotation, restriction on non-audit services, audit committee pre-approval of fees, and annual assessment of auditor independence.

The audit committee recommends auditor appointment/removal and remuneration to the board/shareholders; it meets the external and internal auditors without management present.

Remuneration committee: independent, sets executive pay policy, links pay to performance, and avoids executives voting on their own remuneration.

Nomination/governance committee: leads board appointments, skills-gap analysis, independence assessment and succession planning.

Risk committee (where separate): sets risk appetite, oversees enterprise risk framework; where combined, the audit committee must still cover internal control and risk.

Committee effectiveness requires documented terms of reference, minimum meeting frequency, authority to obtain external advice and reporting back to the full board.

Fiduciary duty: act in good faith in the best interests of the company; duty of care, skill and diligence measured against a reasonably diligent person with the director's knowledge and experience.

Duty to avoid conflicts of interest: declare interests, abstain from voting on conflicted matters, and obtain board approval before taking corporate opportunities.

Duty not to misuse company property, information or position; confidentiality survives resignation for as long as the information remains confidential.

Business judgement rule: courts defer to informed, good-faith decisions taken with no personal interest, provided the director was diligent and rational.

Wrongful trading/insolvent trading: liability arises where a director continues to trade when there are reasonable grounds to believe insolvency is unavoidable.

Directors may be liable for breach of duty (damages/accounting), statutory offences (fines, disqualification) and, where permitted, indemnities/insurance cover defence costs only.

Defences: reliance on professional advice, delegation in good faith, and full disclosure to the board - but not blind reliance where red flags exist.

Shadow and de facto directors owe the same duties as formally appointed directors; resignation does not extinguish liability for past acts.

COSO ERM: risk is assessed on likelihood and impact against a defined risk appetite and tolerance set by the board; risk responses are avoid, reduce, share/transfer, accept.

Three lines model: first line owns and manages risk; second line provides risk and compliance oversight; third line (internal audit) gives independent assurance to the board.

Internal audit independence: reports functionally to the audit committee and administratively to the CEO; the audit committee approves the charter and the risk-based audit plan.

Internal audit standards (IIA): independence, objectivity, due professional care, quality assurance and improvement programme with internal and external assessments.

COSO internal control framework components: control environment, risk assessment, control activities, information and communication, monitoring activities.

Segregation of duties, authorisation limits, reconciliation and physical safeguards are preventive controls; review and variance analysis are detective controls.

Risk register records risk description, owner, inherent and residual rating, controls and treatment plan; heat maps aggregate exposure for board reporting.

Control deficiencies are graded (deficiency, significant deficiency, material weakness) and escalated; management must respond with remediation owners and dates.

Stakeholder mapping by power and interest determines engagement strategy; material stakeholders typically include shareholders, employees, lenders, regulators, customers and communities.

Continuous disclosure: price-sensitive information must be released promptly and equally to the market; selective briefing of analysts is prohibited.

Annual report disclosure benchmarks: governance statement, board and committee composition, directors' remuneration, related-party transactions, risk and going-concern statement.

Related-party transactions require disclosure of nature, amount and identity of the counterparty; material ones need independent shareholder approval.

Integrated reporting six capitals: financial, manufactured, intellectual, human, social and relationship, and natural capital.

Transparency is a means, not an end: disclosure must be accurate, timely, comparable and decision-useful; boilerplate compliance statements defeat the purpose.

Whistleblowing channels and grievance mechanisms support stakeholder accountability; the board should receive reports on stakeholder concerns.

Shareholder rights: receive notice, attend and vote, appoint proxies, and approve major transactions; one share one vote unless classes provide otherwise.

Consequentialism/utilitarianism judges an act by its outcomes (greatest good); deontology judges the act by duty and rules regardless of outcome.

Virtue ethics focuses on the character of the actor (honesty, integrity, courage); ethics of care emphasises relationships and responsibilities to affected parties.

Kohlberg's stages: pre-conventional (self-interest), conventional (social norms/law), post-conventional (universal principles).

Rest's four-component model: moral sensitivity, moral judgement, moral motivation and moral character - a failure at any component produces unethical conduct.

Rationalisation traps: 'everyone does it', 'it's not illegal', 'it's not my responsibility', 'the ends justify the means'.

Ethical decision framework: identify facts, stakeholders and duties; evaluate options against rules and consequences; test for disclosure/publicity; decide and act; monitor outcome.

Moral intensity rises with magnitude of consequences, social consensus, probability of effect, temporal immediacy, proximity and concentration of effect.

Cognitive dissonance and obedience to authority (Milgram) explain how ordinary people comply with unethical instructions; governance needs speak-up channels.

A code of ethics states principles and expected behaviours; a code of conduct is more operational, with specific rules and examples; both need board ownership and periodic review.

Tone at the top: leaders' actual behaviour, incentives and responses to bad news shape culture more than written documents.

Culture risk indicators: aggressive targets, tolerance of policy breaches, fear of retaliation, high staff turnover, and repeated audit findings.

Whistleblowing programme elements: multiple confidential channels, an independent reporting line (often to the audit committee), anti-retaliation protection, triage and investigation protocol.

Protected disclosure regimes protect the worker from dismissal or detriment where the disclosure is made in good faith to a prescribed person or regulator.

Ethics training must be risk-based and case-driven; completion tracking alone does not evidence ethical culture.

Ethical performance can be measured by ethics climate surveys, speak-up volumes, substantiation rates and remediation cycle time.

Conduct risk is the risk of improper behaviour causing loss or reputational damage; it is managed through incentives, monitoring and consequence management.

Companies Act No. 7 of 2007 governs directors' duties, related-party disclosure, financial reporting and company administration in Sri Lanka.

The Code of Best Practice on Corporate Governance issued jointly by CA Sri Lanka and the Securities and Exchange Commission applies on a comply-or-explain basis to listed companies.

Securities and Exchange Commission of Sri Lanka administers the SEC Act and listing rules; the Colombo Stock Exchange Listing Rules impose disclosure, board composition and related-party rules.

Listed companies must have an audit committee chaired by an independent non-executive director, with specified composition and reporting duties.

CA Sri Lanka adopts Sri Lanka Financial Reporting Standards (SLFRS), aligned with IFRS, and SLFRS 8 requires disclosure of related-party relationships and transactions.

Anti-money-laundering obligations flow from the Financial Transactions Reporting Act and the Financial Intelligence Unit; regulated entities must apply customer due diligence and report suspicious transactions.

Bribery and corruption are addressed by the Bribery Act and the Commission to Investigate Allegations of Bribery or Corruption; listed entities should maintain anti-bribery policies.

The Institute of Chartered Accountants of Sri Lanka issues the Code of Ethics for professional accountants, based on the IESBA five fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour.