CIA-1 - Governance, Risk Management, and Control (30% of the exam) - Section C.1
Describe the concept of organizational governance, including the roles of the board, senior management, the internal audit function, and other assurance providers, and recognize governance frameworks, principles, and models.
Describe organisational governance as the combination of processes and structures the board uses to inform, direct, manage, and monitor the organisation towards its objectives. Distinguish the roles of the board, senior management, the internal audit function, and other assurance providers within that structure, and recognise common governance frameworks, principles, and models that shape how accountability and oversight are exercised.
lock_openFree sampleGovernance, Risk Management, and Controleasy
A newly appointed board member at Halden Group asks the chief audit executive to explain, in plain terms, what organisational governance actually is. Which description best captures organisational governance?
AThe day-to-day activities through which managers deploy resources and supervise staff to deliver operational targets.
BThe independent assessment internal audit performs to give the governing body assurance over the organisation's risk management.
CThe combination of processes and structures put in place to inform, direct, manage, and monitor the organisation's activities towards its objectives.check_circle Correct
DThe set of controls that line managers operate to keep individual operational process risks within their stated tolerance.
Organisational governance is the combination of processes and structures used to inform, direct, manage, and monitor an organisation towards its objectives. Governance is defined by its purpose and mechanism: the processes and structures that inform, direct, manage, and monitor the organisation. That is distinct from management's daily execution, from internal audit's assurance, and from individual process controls, each of which is only a part of the wider governance system.
Why A is wrong: This describes the work of management rather than governance; it is tempting because managing is part of running the organisation, but governance is the wider set of processes and structures that direct and monitor that work.
Why B is wrong: This describes internal audit's assurance role, not governance itself; the two are easily confused, but internal audit evaluates governance rather than being the whole of it.
Why C is correct: This matches the recognised meaning of organisational governance, which is the processes and structures used to inform, direct, manage, and monitor the organisation so its objectives are pursued responsibly.
Why D is wrong: This describes process-level controls owned by the first line; controls sit within governance but are not its definition, so the option confuses a component with the whole.
Exam traps in Governance, Risk Management, and Control
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-1 bank for this domain.
They are the line managers who own and operate the controls over the organisation's day-to-day operational risks.
errorWhy it is wrong: Line managers own risks and controls in the first line; they are the subject of assurance rather than providers of it, so this confuses risk ownership with assurance.
Accept ownership of the framework temporarily, provided the arrangement is documented in the engagement working papers.
errorWhy it is wrong: Tempting because documentation feels like a safeguard, but taking a management role even temporarily impairs the function's ability to give independent assurance later, and a note does not cure that.
Senior management should set the risk appetite and ethical tone, and the board should receive periodic updates only after decisions are made.
errorWhy it is wrong: This is tempting because senior management does drive day-to-day operations, but it wrongly strips the board of its core governance duty to set direction and hold management accountable.