CMA Sri Lanka SL4 Corporate Governance & Ethics Exam common mistakes
CMA Sri Lanka SL4 Corporate Governance & Ethics Exam · Understand the traps and how to avoid them.
Answering questions about the board's monitoring versus strategy role by quoting the shareholder-primacy (agency) view by default, even when the scenario describes stakeholder harms or long-term value creation.
Candidates memorise agency theory as 'the' governance theory and treat stakeholder and stewardship perspectives as optional add-ons, so they force every scenario into a principal-agent frame instead of matching the theory to the facts given.
What to do instead
Before answering, identify the tension in the scenario (monitoring vs empowerment, shareholder vs stakeholder, short-term vs long-term) and then name the theory that best explains it. Practise writing one-line distinctions: agency = control and alignment of interests; stewardship = trust and intrinsic motivation; stakeholder = accountability to affected parties; resource dependence = board as access to networks and legitimacy. State the theory explicitly in your answer rather than assuming the examiner will infer it.
Treating 'independent director' as a binary label and missing the qualifying facts (former employment, family ties, material business relationships, cross-directorships, long tenure) that the scenario plants to disqualify independence.
Candidates read the role title ('Non-Executive Director') and stop there, because independence feels like a status conferred by appointment rather than a set of relationships that must be tested against defined criteria.
What to do instead
Build a mental checklist and run it against every named director: past employment with the company or its advisers, close family relationships with executives, material commercial or professional relationships, cross-directorships, shareholding above a threshold, and length of service. Answer by citing the specific disqualifying relationship in the scenario, not by asserting a conclusion. Where the scenario gives a fact that is borderline, say what additional information you would need.
Describing what a board committee does in general terms instead of specifying its composition, quorum, authority, reporting line and the limits on delegation that distinguish it from the full board.
Committee questions look like descriptive recall, so candidates write a paragraph of purpose and skip the structural detail that the marks are actually allocated to. The audit committee in particular is examined on its relationship with external and internal audit, not just its existence.
What to do instead
For every committee answer, cover five things: membership and independence requirements, chair selection, meeting frequency and quorum, authority to obtain external advice and access to information, and what cannot be delegated. For the audit committee, add its role in appointing and overseeing the external auditor, reviewing the internal audit plan and independence, and receiving whistleblowing reports. Keep the answer anchored to the specific committee named in the question.
Mixing up duty of care and skill with fiduciary duty, or describing directors' duties as a single obligation, when the question asks about a specific breach such as conflict of interest, improper use of position, or failure to prevent insolvent trading.
The duties are learned as a list rather than as distinct legal tests with different remedies and different defences, so candidates write 'the director breached their duties' without identifying which duty and what the consequence is.
What to do instead
Learn each duty with three tags: the standard it imposes (objective or subjective test), the typical fact pattern that breaches it, and the remedy or liability that follows. Practise classifying short scenarios into the correct duty before writing anything. For conflicts of interest, always mention disclosure to the board, abstention from voting, and where relevant the approval process, because these are the standard remedy steps examiners look for.
Treating internal control as synonymous with internal audit, or describing risk management as a list of risks rather than a process with identification, assessment, treatment, monitoring and reporting stages.
These topics are studied as separate chapters, so candidates cannot connect the three lines of defence model to the board's oversight role and default to describing controls as 'checks performed by auditors'.
What to do instead
Learn the three lines of defence explicitly: management owns risk and controls, the risk and compliance functions provide independent oversight, and internal audit provides independent assurance to the board and audit committee. When answering, place the question's scenario on the correct line and describe the reporting relationship. For risk questions, structure the answer by the process stages and say who is responsible at each stage.
Writing about disclosure and transparency in vague terms ('the company should disclose material information') without naming the channel, the timing, the audience, or the difference between mandatory and voluntary disclosure.
Transparency feels like a value rather than a set of obligations, so candidates produce aspirational statements that would score nothing against a mark scheme expecting specific reporting mechanisms.
What to do instead
Anchor every transparency answer to concrete mechanisms: annual report and financial statements, related-party transaction disclosure, director remuneration disclosure, timely market announcements of price-sensitive information, and the annual general meeting as an accountability forum. State who receives the information, when, and through which document. Where the question involves a governance code, distinguish between 'comply or explain' and mandatory legal requirements.
Answering ethical dilemma questions by giving the candidate's personal moral opinion or a list of virtues, without applying a named ethical framework to the facts and reaching a reasoned conclusion.
Ethics questions feel subjective, so candidates either moralise or hedge with 'it depends', missing that the examiner wants a structured application of consequentialist, deontological and virtue-based reasoning to the specific decision.
What to do instead
Use a fixed structure: identify the stakeholders and the competing interests, apply at least two named frameworks (for example utilitarian consequences versus duty-based rules versus virtue ethics), identify the tension between them, and then recommend a course of action with the reasoning made explicit. It is acceptable to conclude that one framework dominates, provided you say why. Never end without a clear recommendation.
Confusing a code of ethics with a code of conduct, or describing a code as a compliance document only, without addressing how it is embedded (training, tone at the top, sanctions, escalation) and its limits as a control.
Candidates learn the definition and stop, so they cannot answer questions about why codes fail or how they interact with culture, incentives and leadership behaviour.
What to do instead
Distinguish the two clearly: a code of ethics sets out principles and values that guide judgement in ambiguous situations; a code of conduct specifies required and prohibited behaviours with examples. Then prepare the embedding chain: leadership modelling, communication and training, advice channels, declaration of interests, disciplinary consequences, and periodic review. Be ready to explain that a code is necessary but insufficient without a supporting culture and incentive structure.
Describing whistleblowing only as 'employees reporting wrongdoing' and omitting the design features that make a whistleblowing mechanism effective: protected channels, anonymity, anti-retaliation safeguards, independent oversight, investigation and feedback, and reporting to the audit committee.
The topic is reduced to a definition, so candidates cannot answer questions about why employees stay silent or how to design a channel that the board can rely on.
What to do instead
Prepare a design checklist: multiple reporting routes including one that bypasses line management, confidentiality and anonymity options, a written anti-retaliation policy with consequences for retaliation, independent investigation, feedback to the reporter, and periodic reporting of case volumes and outcomes to the audit committee. When a scenario describes silence or a failed escalation, diagnose which design feature was missing rather than simply saying culture was poor.
Applying generic international governance principles to Sri Lankan questions without engaging with the local regulatory and institutional framework, such as the distinction between statutory requirements and code-based 'comply or explain' provisions, and the roles of the relevant regulator, the institute and the securities market regulator.
Candidates revise from international textbooks and assume the frameworks transfer unchanged, so they cannot answer questions that turn on which body issues which rule or which obligations are legally binding.
What to do instead
Build a one-page map of the Sri Lankan landscape: which rules are statutory and enforceable, which are code provisions requiring explanation for departure, and which institution is responsible for each (company law administration, securities market regulation, the professional institute's code, and listing requirements). For each governance topic you revise, add a line noting how it is treated in the Sri Lankan context. If you are unsure of a specific institutional detail, describe the mechanism and its purpose rather than guessing a name.