Domain 2.1a Notes

Domain 2.1 - Risk Management Governance:

Domain 2.1a - Evaluate the organization's governance structure and application of risk management concepts found in governance frameworks.

What is Governance?

  • Governance is the system of leading, directing, controlling, and monitoring an organization to help it achieve its objectives while meeting stakeholder expectations.

  • IPPF Definition: The processes and structures used by the board to direct, manage, and monitor organizational activities toward achieving objectives.

  • OECD Definition: The relationships among management, the board, shareholders, and other stakeholders that determine how objectives are set, achieved, and monitored.

Purpose of Governance

  • Governance aims to ensure the organization achieves its objectives in a way that is: Economical, Efficient, Effective, Ethical, Sustainable

  • Success should reflect the interests of stakeholders, not just organizational performance.

Principal-Agent Relationship

  • Governance is based on the relationship between:

  • Principal: Owners or primary stakeholders (e.g., shareholders, taxpayers, citizens, service users).

  • Agent: Individuals responsible for governing and managing on behalf of the principal (e.g., board members, elected officials, executives).

  • Because agents act on behalf of others, they owe a duty of care and are accountable for their decisions, actions, and results.

Transparency and Assurance

  • Agents often have more information than principals, creating the risk of conflicting interests.

  • To build trust and confidence:

  • Organizations need transparency.

  • Transparency relies on independent assurance, particularly from internal audit.

  • Internal audit provides the board and management with objective information about governance, risk management, and controls.

Governance, Risk Management, and Control Relationship:

  • Governance: Provides strategic direction, oversight, accountability, and stewardship.

  • Risk Management: Identifies, assesses, and responds to uncertainty that could affect objectives.

  • Controls: Specific actions or measures used to manage risk and increase the likelihood of achieving objectives.

These concepts are interconnected:

  • Risk management is an intrinsic part of governance, and controls are a key component of risk management.

Risk Management Governance:

  • The structures and processes used to oversee and implement enterprise risk management (ERM).

Risk Management Principles

  • Risk can affect objectives positively or negatively.

  • Risk management should be integrated into strategic and operational planning.

  • Organizations should continuously monitor risks and adapt to changing internal and external conditions.

  • Risk assessment is an ongoing process, not a one-time exercise.


Core Elements of Governance

  1. Accountability

Board members and executives have a duty to use resources responsibly and act in the best interests of stakeholders.

  1. Management Actions and Resource Allocation

Management implements strategy, allocates resources, and makes decisions that create and protect organizational value.

  1. Independent Assurance

Internal audit provides:

  • Transparency, confidence, objectivity, insight, and recommendations for improvement

The Three Lines Model:

Governing Body / Board

The board is accountable to stakeholders for stewardship and oversight.

Key Responsibilities:

  • Define vision, mission, strategy, and culture.

  • Establish risk appetite.

  • Oversee management performance.

  • Allocate resources.

  • Establish and oversee internal audit.

Fiduciary Duties

  • Duty of Care: Act diligently and in the organization's best interests.

  • Duty of Loyalty: Avoid conflicts of interest and prioritize organizational interests.

  • Duty of Obedience: Ensure compliance with legal, regulatory, and ethical requirements.

Boards often delegate oversight to committees (i.e., Audit Committee, Risk Committee, Governance Committee).

Senior Management:

  • Responsible for executive leadership, strategy execution, and operational allocation.

  • They establish operational risk structures (CRO/ERM Committee) and monitor risk appetite, reporting directly to the Governing body.

First Line: Operational Management

Operational and program managers:

  • Deliver products and services.

  • Own and manage risks.

  • Operate controls.

  • Work within approved risk tolerances.

Second Line: Risk and Compliance Functions

  • Provides expertise, oversight, monitoring, and challenge to the first line.

  • Examples: Enterprise Risk Management (ERM), Compliance, Legal Services

Third Line: Internal Audit

  • Internal audit provides independent and objective assurance on governance, risk management, and internal controls.

  • They must remain independent from operational and risk-management responsibilities to maintain objectivity and avoid self-review.

External Assurance and Regulators

  • External Auditors: Provide assurance on financial reporting (i.e., Supreme Audit Institutions (SAIs), Office of the Auditor General (public sector))

  • Regulators: Protect public interests and ensure compliance with applicable laws and regulations.

Applying the Three Lines Model

  • Flexibility: the model should be adapted based on: Organizational size, Complexity, Industry, Risk profile, and Regulatory environment

Major Governance Frameworks

Cadbury Report (UK, 1992):

  • Defined governance as the system by which organizations are directed and controlled.

  • Introduced the "Comply or Explain" principle → entities can depart from standard governance recommendations provided they publicly explain their rationale

  • Emphasized board independence, strong external audit oversight, and an independent Remuneration Committee to oversee executive pay

G20/OECD Corporate Governance Principles

  • Adopted globally by World Bank/FSB

  • Focuses on: Effective board oversight, specialized board committees, strategic guidance, fair treatment of stakeholders, ethics and integrity, risk oversight, and reliable reporting.

  • Board explicitly sets risk policy and risk appetite


King IV Report (South Africa, 2017):

  • Defines governance as ethical and effective leadership. 

  • Key concepts include proportionality, expanded assurance model, and annual governance and risk assessments.

  • The desired outcomes are ethical culture, good performance, effective controls, and organizational legitimacy.

  • Advocates 5 Lines of Assurance (including External Audit and Board)

  • Recommends an annual IA opinion on overall governance and risk management effectiveness 

ISO 37000:

  • Defines governance as directing, controlling, and holding organizations accountable to achieve their purpose.

  • Places Purpose at the center of the governance model

  • Core principles: Purpose, Value Generation, Strategy, and Oversight and Accountability

  • Primary Principles: Leadership, Risk Governance, Data-Driven Decisions, and Stakeholder Engagement.

  • Defined Outcomes: Effective performance, responsible stewardship, and ethical behavior.


Four Ways Internal Audit Supports Governance:

  1. Advisory Services: Provides advice and insights to improve governance practices.

  2. Audit Integration: Evaluates governance elements during operational, compliance, and performance audits.

  3. Facilitation: Supports board and committee self-assessments.

  1. Governance Audits: Conducts standalone reviews of governance structures and effectiveness.

Governance Evaluation Process:

Step 1: Establish Criteria

Compare actual governance practices (i.e., structures, processes, resources) to Expected/Desired Governance:

  • Organizational policies

  • Approved frameworks

  • Recognized standards (e.g., ISO 37000, King IV)

Step 2: Gather Evidence

Methods include Interviews, observation, document review, data analysis, and testing.

Step 3: Identify Gaps

Assess:

  • Condition: the current state or observed deficiency → What is wrong? 

  • Consequence: the potential impact or financial exposure resulting from unmonitored risk decisions → What is the impact?

  • Cause: the underlying reason why the condition exists → Why did it happen?

Recall that criteria represents the expected governance standard or benchmark against which operations are evaluated.

Step 4: Assess Key Governance Areas

  • Examples include Board composition and effectiveness, committee structures, strategic planning, ERM processes, ethics programs, IT governance, assurance coordination, and CEO oversight.

Memory Aid: EGIA ("Every Good Inspector Audits")

Governance Audit Engagement Workflow:

Benchmarking and Continuous Improvement:

  • Benchmarking involves comparing governance practices to peers, industry leaders, recognized standards, and best practices (e.g., COSO, ISO)

  • It helps to identify gaps, challenge assumptions, support continuous improvement, and establish improvement targets.

Common Pitfalls of Governance:

  • Overly complex governance structures

  • Copying frameworks without adapting them

  • Treating compliance as the end goal

  • Relying on "paper compliance" without effective implementation