Governance Frameworks and Principles

Overview
Governance Frameworks and Principles sit inside the Fraud Prevention and Deterrence section of the ACFE Certified Fraud Examiner (CFE) exam, under the Corporate Governance topic. This guide explains why the subject matters, what the major frameworks and principles actually say, how governance operates in practice to prevent and detect fraud, and how to tackle the exam questions you are likely to see.

1. Why Governance Frameworks and Principles Matter

Corporate governance is the system by which organisations are directed and controlled. For a fraud examiner, it is the first line of defence: nearly every major corporate fraud (Enron, WorldCom, Parmalat, Satyam, Wirecard) involved a governance failure, such as a dominant executive, a weak or captured board, an ineffective audit committee, or a culture that tolerated rule-breaking.

Governance matters to the CFE for three reasons:
• Tone at the top. The Fraud Triangle (pressure, opportunity, rationalisation) is shaped by the control environment. Strong governance reduces opportunity and makes rationalisation harder because ethical expectations are explicit and enforced.
• Oversight of management. Management override of controls is the most common way material financial statement fraud occurs. Only an independent board and audit committee can realistically counter it.
• Regulatory and legal exposure. Laws such as the Sarbanes-Oxley Act (SOX), listing rules, and codes such as the UK Corporate Governance Code impose duties whose breach creates liability, so the CFE must understand what organisations are required or expected to do.

On the exam, this topic is heavily tested because the ACFE expects CFEs to be able to advise boards, evaluate anti-fraud programmes, and recognise governance red flags during investigations.

2. What Corporate Governance Is

The classic definition (from the 1992 Cadbury Report in the UK) is: the system by which companies are directed and controlled. Governance addresses the relationships among a company's management, its board, its shareholders, and other stakeholders, and provides the structure through which objectives are set, the means of attaining them are determined, and performance is monitored.

Core governance principles that appear across virtually every framework:
• Accountability – the board is accountable to shareholders; management is accountable to the board.
• Transparency – timely, accurate disclosure of material matters, including financial condition, performance, ownership and governance.
• Fairness / Equitable treatment – protection of the rights of all shareholders, including minority and foreign shareholders.
• Responsibility – recognition of the legal rights of stakeholders and encouragement of cooperation in creating wealth and sustainable enterprises.
• Independence – directors and auditors must be free of relationships that could compromise objective judgement.
• Integrity and ethical behaviour – codes of conduct, anti-fraud policies, and consequences for violations.

Rules-based vs. principles-based approaches
• Rules-based (e.g., United States under SOX): specific, mandatory legal requirements with penalties for non-compliance.
• Principles-based / comply-or-explain (e.g., UK Corporate Governance Code, King IV in South Africa): companies are expected to follow the code but may deviate if they publicly explain why. The exam frequently tests this distinction.

3. The Major Frameworks You Must Know

(a) G20/OECD Principles of Corporate Governance
First issued in 1999, revised in 2004, 2015 and 2023, the OECD Principles are the most widely referenced international benchmark and are the framework the CFE manual emphasises. The chapters are:
I. Ensuring the basis for an effective corporate governance framework – promote transparent and fair markets, efficient allocation of resources, consistent rule of law, and clear division of responsibilities among supervisory, regulatory and enforcement authorities.
II. The rights and equitable treatment of shareholders and key ownership functions – secure ownership registration, transfer of shares, access to information, voting at general meetings, election of board members, sharing in profits, and protection of minority shareholders from abuse by controlling shareholders.
III. Institutional investors, stock markets and other intermediaries – investors acting in a fiduciary capacity should disclose their governance and voting policies and manage conflicts of interest.
IV. The role of stakeholders in corporate governance – respect stakeholder rights established by law or agreement; stakeholders (including employees) should be able to communicate concerns about illegal or unethical practices to the board without fear of retaliation.
V. Disclosure and transparency – timely and accurate disclosure of financial results, objectives, major share ownership, related-party transactions, risk factors, board members and their remuneration, and governance structures. Disclosure should follow high-quality standards and be subject to an independent annual audit.
VI. The responsibilities of the board – strategic guidance, effective monitoring of management, accountability to the company and shareholders; acting on a fully informed basis, in good faith, with due diligence and care, and in the best interests of the company. Key board functions include reviewing strategy and risk policy, selecting and compensating executives, managing conflicts of interest and related-party transactions, ensuring the integrity of accounting and financial reporting systems (including independent audit and internal control), and overseeing disclosure and communications.
The 2023 revision added a chapter on sustainability and resilience, reflecting ESG disclosure and climate-related risk.

(b) Sarbanes-Oxley Act of 2002 (United States)
Enacted after Enron and WorldCom, SOX applies to companies registered with the SEC. Key sections tested on the CFE exam:
• Section 101–109: Created the Public Company Accounting Oversight Board (PCAOB) to register, inspect and discipline audit firms.
• Section 201: Prohibits auditors from providing most non-audit services (e.g., bookkeeping, internal audit outsourcing, valuation) to audit clients.
• Section 203: Lead and reviewing audit partners must rotate every five years.
• Section 301: Audit committee must be composed entirely of independent directors, be directly responsible for appointing, compensating and overseeing the external auditor, and establish procedures for receiving and handling complaints, including confidential, anonymous submissions by employees (a whistleblower hotline).
• Section 302: CEO and CFO must personally certify the accuracy of quarterly and annual reports and the effectiveness of disclosure controls.
• Section 404: Management must assess and report on internal control over financial reporting (ICFR); the external auditor attests to that assessment for larger filers.
• Section 406: Disclose whether the company has a code of ethics for senior financial officers (and if not, why not).
• Section 407: Disclose whether the audit committee has at least one financial expert.
• Section 802: Criminal penalties for altering, destroying or falsifying records.
• Section 806: Whistleblower protection for employees of public companies.
• Section 906: Criminal penalties for knowingly certifying false financial reports.

(c) COSO Internal Control – Integrated Framework (2013)
COSO (Committee of Sponsoring Organizations of the Treadway Commission) defines internal control as a process designed to provide reasonable assurance regarding the achievement of objectives in operations, reporting and compliance. It has five components and 17 principles:
1. Control Environment – commitment to integrity and ethical values; board independence and oversight; structures, authority and responsibility; commitment to competence; accountability.
2. Risk Assessment – specify objectives; identify and analyse risks; Principle 8: consider the potential for fraud; identify and assess significant change.
3. Control Activities – select and develop controls; general IT controls; policies and procedures.
4. Information and Communication – relevant quality information; internal and external communication.
5. Monitoring Activities – ongoing and separate evaluations; evaluate and communicate deficiencies.
Remember the acronym CRIME (Control environment, Risk assessment, Information and communication, Monitoring, control activitiEs) or the original CRIM-plus-Control Activities. The control environment is the foundation of all other components.

(d) COSO Enterprise Risk Management – Integrating with Strategy and Performance (2017)
Broadens internal control into enterprise-wide risk management, structured around five components: Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; and Information, Communication and Reporting. Boards are expected to set risk appetite and oversee risk culture.

(e) COSO/ACFE Fraud Risk Management Guide (2016, updated 2023)
Translates COSO Principle 8 into five fraud-specific principles:
1. Establish a fraud risk governance policy as part of organisational governance.
2. Perform a comprehensive fraud risk assessment.
3. Design and implement preventive and detective fraud control activities.
4. Establish a fraud reporting process and coordinated approach to investigation and corrective action.
5. Monitor the fraud risk management process and communicate results.

(f) The IIA Three Lines Model (2020, formerly Three Lines of Defense)
• First line: operational management – owns and manages risk and controls.
• Second line: risk management, compliance, financial control – supports and monitors the first line.
• Third line: internal audit – provides independent, objective assurance to the governing body.
The governing body (board) sits above all three lines; external audit and regulators are outside the organisation.

(g) Other national codes
• UK Corporate Governance Code – comply-or-explain; separation of chair and CEO; at least half the board independent non-executives; audit, remuneration and nomination committees.
• King IV Report (South Africa) – apply-and-explain; outcome-based; integrated reporting; stakeholder-inclusive approach.
• Cadbury Report (1992) – origin of modern codes and the comply-or-explain concept.
• Basel Committee guidance – governance principles for banks.
• ISO 37000 (2021) – international standard giving guidance on governance of organisations.

4. How Governance Works in Practice to Prevent Fraud

The Board of Directors
The board has fiduciary duties of care (act with the diligence of a reasonably prudent person) and loyalty (act in the company's interest, avoid conflicts of interest and self-dealing). The board sets strategy, approves risk appetite, appoints and evaluates the CEO, approves major transactions, and oversees the integrity of financial reporting. Best practice calls for a majority of independent directors, separation of the chair and CEO roles (or a lead independent director), regular executive sessions without management, and periodic board evaluations.

The Audit Committee
The audit committee is the governance body most directly responsible for anti-fraud oversight. It should:
• Consist entirely of independent directors, with at least one financial expert.
• Hire, compensate, evaluate and, if necessary, dismiss the external auditor; pre-approve all audit and permitted non-audit services.
• Oversee the internal audit function, including approving the chief audit executive's appointment and audit plan; internal audit should report functionally to the audit committee and administratively to management.
• Review financial statements, significant accounting judgements, and management's ICFR assessment.
• Oversee the whistleblower hotline and ensure allegations are investigated and resolved.
• Meet privately with the external auditor, internal auditor and management.
• Specifically consider the risk of management override of controls.

Management
Management is responsible for designing, implementing and maintaining internal controls, for setting the ethical tone through visible behaviour, for the fraud risk assessment, and for the accuracy of financial reporting. Governance frameworks hold management accountable through certifications (SOX 302), performance evaluations tied to ethical conduct, and clawback policies for compensation earned through misconduct.

Internal Audit
Provides independent assurance over governance, risk management and control processes. The IIA standards require internal auditors to have sufficient knowledge to evaluate fraud risk and the manner in which it is managed, though they are not expected to have the expertise of a fraud examiner.

External Audit
Provides an independent opinion on the financial statements and, where required, on ICFR. Under auditing standards (e.g., AU-C 240 / ISA 240), auditors must plan and perform the audit to obtain reasonable assurance that the statements are free of material misstatement due to fraud or error, brainstorm fraud risks, and presume revenue recognition is a fraud risk.

Shareholders and Stakeholders
Shareholders exercise governance through voting (electing directors, approving auditors, say-on-pay), engagement with the board, and litigation. Stakeholders such as employees are a key fraud detection resource: ACFE Report to the Nations data consistently shows tips are the most common detection method, and employees provide the majority of tips, which is why governance codes insist on protected reporting channels.

Mechanisms that tie it together
• Code of conduct and conflict-of-interest policies acknowledged annually.
• Fraud policy stating zero tolerance and investigation procedures.
• Whistleblower hotline with anonymity and anti-retaliation protection.
• Segregation of duties, authorisation limits and reconciliations.
• Related-party transaction approval by independent directors.
• Transparent disclosure and independent audit.
• Consistent disciplinary action regardless of seniority.

5. Common Governance Red Flags Examiners Should Recognise
• A dominant CEO who is also board chair with hand-picked directors.
• Audit committee lacking financial expertise or independence.
• Frequent changes of auditors, CFOs or general counsel.
• Internal audit reporting only to management, or under-resourced.
• Excessive related-party transactions or complex structures with no business purpose.
• Compensation heavily weighted to short-term earnings targets.
• Hotline reports that go uninvestigated or whistleblowers who are punished.
• Management reluctance to provide information to auditors or the board.

6. Exam Tips: Answering Questions on Governance Frameworks and Principles

Tip 1 – Know which framework a question is pointing at. Keywords signal the framework: shareholder rights, stakeholders, disclosure, board responsibilities point to OECD; five components, control environment, reasonable assurance point to COSO; Section 404, PCAOB, CEO certification, audit committee independence point to SOX; comply or explain points to the UK Code; three lines points to the IIA model.

Tip 2 – Match the responsibility to the right party. A favourite exam trick is to attribute a duty to the wrong body. Remember: management designs and operates internal controls and prepares financial statements; the audit committee oversees the external auditor and the hotline; the board sets strategy and risk appetite and holds management accountable; internal audit provides assurance but does not own controls; the external auditor opines on the statements but is not responsible for preventing fraud.

Tip 3 – Independence is the recurring theme. If an answer choice strengthens independence (independent directors, auditor rotation, prohibiting non-audit services, internal audit reporting to the audit committee), it is usually the correct best-practice answer. If an answer choice reduces independence (CEO selecting the auditor, internal audit reporting to the CFO only), it is usually a weakness.

Tip 4 – Distinguish mandatory from recommended. Questions may ask what a company must do versus what is best practice. SOX provisions are legally mandatory for SEC registrants; OECD Principles are non-binding guidance; comply-or-explain codes allow justified deviation. Read for words such as required by law, recommended, or best practice.

Tip 5 – Remember the sequence and foundation in COSO. The control environment is the foundation; fraud risk is explicitly addressed in Principle 8 under Risk Assessment; monitoring evaluates whether the other components are functioning. If asked which component tone at the top belongs to, the answer is the control environment.

Tip 6 – Whistleblower questions usually test SOX Section 301 and OECD Chapter IV. The audit committee must establish procedures for confidential, anonymous employee complaints about accounting or auditing matters, and employees must be protected from retaliation.

Tip 7 – Watch for absolute language. Choices containing always, never, guarantees or eliminates are usually wrong because governance and internal control provide reasonable, not absolute, assurance. Conversely, choices mentioning reasonable assurance, oversight, or independent are frequently correct.

Tip 8 – Think like an adviser in scenario questions. When a scenario describes a governance weakness and asks for the best recommendation, choose the answer that addresses the root cause through structure (e.g., create an independent audit committee, separate chair and CEO, establish a hotline) rather than a one-off action (e.g., fire one employee).

Tip 9 – Memorise a few numbers and names. Five COSO components, seventeen principles; six OECD chapters (plus sustainability in 2023); five fraud risk management principles; audit partner rotation every five years; Sections 301, 302, 404, 406, 806 of SOX; Cadbury 1992; PCAOB created by SOX 2002.

Tip 10 – Eliminate systematically. CFE questions are multiple choice or true/false. First remove any answer that assigns a duty to the wrong party or contradicts the independence principle, then remove absolutes, then choose the most complete remaining answer. Manage your time: governance questions are typically knowledge-recall, so do not over-deliberate.

7. Quick Revision Summary
• Corporate governance = system by which organisations are directed and controlled.
• Core principles: accountability, transparency, fairness, responsibility, independence.
• OECD Principles = international benchmark across framework, shareholders, intermediaries, stakeholders, disclosure, board, and sustainability.
• SOX = US legal rules: PCAOB, independent audit committee with hotline, CEO/CFO certification, ICFR reporting, whistleblower protection.
• COSO = five components, seventeen principles, reasonable assurance; Principle 8 addresses fraud risk.
• Three Lines Model = management, risk/compliance, internal audit, overseen by the governing body.
• Audit committee is the anti-fraud hub; independence and tone at the top are the exam's recurring themes.

Master these structures and the relationships among the parties, and governance questions on the CFE exam become some of the most predictable marks you can earn.