Risk, Compliance and Ethical Governance
What the exam tests
Whether you can connect risk appetite, internal control, compliance and ethics into one board-level system, rather than three separate silos.
Board ownership of risk
- Set and review risk appetite - the amount and type of risk the company will accept - and translate it into tolerances and limits.
- Approve the enterprise risk management framework and review the top risk register at every meeting, including emerging risks such as cyber, climate, talent and regulatory change.
- Use the three lines model: management owns risk, risk and compliance functions monitor, internal audit provides independent assurance. The board and its audit committee sit above all three.
Compliance
Identify the applicable regime: CAMA 2020 and the constitution, SEC rules for public companies, sector regulators such as CBN, NAICOM and PenCom, plus data protection, anti-money laundering and tax. Compliance is a floor, not a ceiling.
Ethics and culture
A code of conduct is worth little without a conflict-of-interest register, a gifts and hospitality policy, a confidential whistleblowing channel escalating to the audit committee, and consistent consequences for senior people. Tone at the top is measured by what the board tolerates, not what it publishes.
Worked example
A whistleblower alleges procurement kickbacks involving a senior executive. Correct sequence: preserve confidentiality and protect the reporter; the audit committee commissions an independent investigation reporting to it; the board receives the findings and takes disciplinary and remediation action; losses and control failures are assessed; regulatory disclosure obligations are considered; the control gap is logged and tracked.
Traps
- Treating the risk register as the risk management system.
- Equating compliance with ethical governance.
- Leaving risk to internal audit alone.
- Allowing a conflicted executive to sit on the investigating body.