CIA-1 - Governance, Risk Management, and Control - Section C.1

Describe the concept of organizational governance, including the roles of the board, senior management, the internal audit function, and other assurance providers, and recognize governance frameworks, principles, and models.

Describe organisational governance as the combination of processes and structures the board uses to inform, direct, manage, and monitor the organisation towards its objectives. Distinguish the roles of the board, senior management, the internal audit function, and other assurance providers within that structure, and recognise common governance frameworks, principles, and models that shape how accountability and oversight are exercised.

Organisational governanceBoardAssurance providersGovernance frameworks

Practice question for this objective

Free sampleGovernance, Risk Management, and Controleasy

A newly appointed board member at Halden Group asks the chief audit executive to explain, in plain terms, what organisational governance actually is. Which description best captures organisational governance?

  • AThe day-to-day activities through which managers deploy resources and supervise staff to deliver operational targets.
  • BThe independent assessment internal audit performs to give the governing body assurance over the organisation's risk management.
  • CThe combination of processes and structures put in place to inform, direct, manage, and monitor the organisation's activities towards its objectives. Correct
  • DThe set of controls that line managers operate to keep individual operational process risks within their stated tolerance.
Organisational governance is the combination of processes and structures used to inform, direct, manage, and monitor an organisation towards its objectives. Governance is defined by its purpose and mechanism: the processes and structures that inform, direct, manage, and monitor the organisation. That is distinct from management's daily execution, from internal audit's assurance, and from individual process controls, each of which is only a part of the wider governance system.

Why A is wrong: This describes the work of management rather than governance; it is tempting because managing is part of running the organisation, but governance is the wider set of processes and structures that direct and monitor that work.

Why B is wrong: This describes internal audit's assurance role, not governance itself; the two are easily confused, but internal audit evaluates governance rather than being the whole of it.

Why C is correct: This matches the recognised meaning of organisational governance, which is the processes and structures used to inform, direct, manage, and monitor the organisation so its objectives are pursued responsibly.

Why D is wrong: This describes process-level controls owned by the first line; controls sit within governance but are not its definition, so the option confuses a component with the whole.

See more CIA-1 practice questions, answers explained.

More in this domain

Back to all Governance, Risk Management, and Control objectives, or the CIA-1 cert hub.

Examworthy is not affiliated with or endorsed by The Institute of Internal Auditors. Original, blueprint-aligned practice material only.