Governance Roles and Responsibilities

1. Why This Topic Matters

Corporate governance is the system of rules, practices, and processes by which an organization is directed and controlled. Within the CFE Exam (Fraud Prevention and Deterrence section), Governance Roles and Responsibilities is a high-yield topic because nearly every major fraud scandal – Enron, WorldCom, Satyam, Wirecard – traces back to a governance failure: a board that did not ask questions, an audit committee that lacked independence, management that overrode controls, or auditors who deferred to the people they were supposed to scrutinize.

For a Certified Fraud Examiner, understanding who is responsible for what is essential for three reasons:
• Prevention – you cannot design an effective anti-fraud program unless you know which body owns which control.
• Detection – weaknesses in governance structure (e.g., a CEO who also chairs the board and the audit committee) are themselves red flags.
• Accountability – when fraud occurs, investigators, regulators, and courts ask whether each party discharged its duties. Knowing the standard of care for directors, officers, and auditors lets you evaluate culpability and advise clients.

The ACFE emphasizes that management is primarily responsible for preventing and detecting fraud, while the board (through the audit committee) is responsible for oversight. The exam repeatedly tests whether you can keep these layers straight.

2. What Corporate Governance Is

The ACFE, drawing on the OECD and COSO frameworks, describes corporate governance as the framework that balances the interests of stakeholders – shareholders, management, employees, customers, suppliers, regulators, and the community. Good governance provides:
• Clear allocation of authority and accountability
• A strong ethical "tone at the top"
• Effective risk management and internal control
• Transparent and reliable financial reporting
• Independent oversight of management

The agency problem underlies the whole topic: shareholders (principals) delegate control to managers (agents) whose interests may diverge. Governance mechanisms exist to monitor the agents and reduce the opportunity for self-dealing and fraud.

3. How It Works: The Key Players and Their Responsibilities

A. Shareholders / Owners
• Elect the board of directors and approve major transactions.
• Ratify the appointment of external auditors (in many jurisdictions).
• Hold the board accountable through voting, proxy proposals, and derivative lawsuits.
• Do not manage daily operations.

B. Board of Directors
The board has ultimate responsibility for oversight of the organization. Under U.S. law, directors owe fiduciary duties:
• Duty of care – act as an ordinarily prudent person would; be informed; attend meetings; ask questions.
• Duty of loyalty – put the company's interests ahead of personal interests; avoid conflicts and self-dealing; do not usurp corporate opportunities.
• Duty of good faith / oversight (the Caremark duty) – implement and monitor a reasonable reporting and compliance system. Consciously ignoring red flags can create personal liability.
The business judgment rule protects directors from liability for honest, informed, disinterested decisions that turn out badly – but it does not protect fraud, bad faith, or gross negligence.

Specific board responsibilities include:
• Setting the organization's strategic direction and risk appetite
• Hiring, evaluating, compensating, and when necessary removing the CEO
• Establishing tone at the top and approving the code of conduct
• Overseeing the fraud risk management program (per the COSO/ACFE Fraud Risk Management Guide, the board should ensure management has a documented program and should receive regular reports)
• Approving major policies, budgets, and transactions
• Ensuring the integrity of financial reporting and the independence of auditors
Best practice calls for a majority of independent directors (no material relationship with the company) and often separation of the CEO and board chair roles or appointment of a lead independent director.

C. Audit Committee
A standing committee of the board composed entirely of independent directors. Under the Sarbanes-Oxley Act (SOX) and stock exchange listing rules:
• Directly responsible for the appointment, compensation, retention, and oversight of the external auditor (SOX Section 301); the external auditor reports directly to the audit committee, not to management.
• Must establish procedures for receiving, retaining, and treating complaints about accounting, internal control, or auditing matters, including confidential, anonymous submissions by employees (the whistleblower hotline requirement).
• Must pre-approve all audit and permitted non-audit services.
• Should include at least one "audit committee financial expert" or disclose why not (SOX Section 407).
• Oversees the internal audit function – typically approves the chief audit executive's appointment, the audit plan, and the budget, and receives internal audit's reports.
• Reviews financial statements, significant accounting judgments, and management's assessment of internal control over financial reporting.
• Has authority to engage independent counsel and advisers and must be funded to do so.
• Oversees management's fraud risk assessment and anti-fraud program; should meet privately (in executive session) with external auditors, internal auditors, and management separately.
Other common board committees: compensation committee (executive pay, which can create incentives for financial statement fraud), nominating/governance committee (director selection, board evaluation), and sometimes a dedicated risk committee.

D. Senior Management (CEO, CFO, and Executive Team)
Management has primary and direct responsibility for:
• Designing, implementing, and maintaining the system of internal control
• Preventing and detecting fraud within the organization
• Preparing fair and accurate financial statements
• Conducting the fraud risk assessment and implementing the anti-fraud program
• Setting the ethical tone and modeling the code of conduct
• Communicating policies, training employees, and enforcing discipline consistently
Under SOX Section 302, the CEO and CFO must personally certify that the financial reports are accurate and that they have evaluated internal controls; Section 906 adds criminal penalties for knowingly false certifications; Section 404 requires management to assess and report on internal control over financial reporting. Section 304 provides for clawback of executive bonuses after a restatement caused by misconduct.
Management override of controls is one of the greatest governance risks – which is precisely why independent oversight by the board and audit committee exists.

E. Internal Audit
Internal audit is an independent, objective assurance and consulting activity (IIA definition) that evaluates and improves risk management, control, and governance processes. Key points for the exam:
• Should report functionally to the audit committee and administratively to senior management (typically the CEO), preserving organizational independence.
• Evaluates the design and operating effectiveness of controls, including anti-fraud controls, and considers fraud risk in every engagement.
• Per IIA standards, internal auditors must have sufficient knowledge to evaluate the risk of fraud and how it is managed, but they are not expected to have the expertise of a person whose primary responsibility is detecting and investigating fraud.
• Internal audit does not own or operate the controls it audits; ownership stays with management.
• Frequently conducts or supports fraud investigations and reports results to the audit committee.

F. External (Independent) Auditors
• Express an opinion on whether the financial statements are fairly presented in accordance with the applicable framework.
• Provide reasonable – not absolute – assurance that the statements are free of material misstatement, whether caused by error or fraud (AU-C 240 / formerly SAS 99; ISA 240; PCAOB AS 2401).
• Must plan and perform the audit with professional skepticism, hold a brainstorming session about fraud risks, presume revenue recognition is a fraud risk, and test journal entries for management override.
• For public companies, also audit internal control over financial reporting (SOX 404(b)).
• Must be independent of management; report to and are hired by the audit committee; are prohibited from providing certain non-audit services to audit clients; lead partner rotation is required.
• Not responsible for preventing fraud and are not guarantors against all fraud, especially immaterial fraud or fraud involving collusion and forged documents.

G. Compliance, Ethics, Risk, and Legal Functions
• The chief compliance/ethics officer administers the code of conduct, training, hotline, and investigations of ethics complaints; best practice gives this officer direct access to the board or audit committee.
• Risk management coordinates enterprise risk assessment, including fraud risk.
• General counsel advises on legal exposure, privilege, and regulatory reporting, and often oversees investigations.
Together these form the "second line" in the IIA's Three Lines Model: first line = operational management that owns risks and controls; second line = risk, compliance, and control functions that monitor and support; third line = internal audit providing independent assurance. The governing body sits above all three, and external auditors and regulators sit outside the organization.

H. Employees
• Comply with policies and the code of conduct.
• Report suspected misconduct through established channels.
• Employees are the most common source of fraud detection (tips), so governance structures must protect them through anti-retaliation policies (SOX Section 806, Dodd-Frank whistleblower provisions).

I. Fraud Examiners / Investigators
• Conduct investigations when predication exists, typically under the direction of legal counsel, the audit committee, or management (depending on who is implicated).
• Must remain independent of the subjects; when senior management is suspected, the audit committee should direct the investigation.

4. Putting It Together: The Governance Chain of Accountability

Shareholders → elect → Board → oversees → Management → owns → Internal Controls and Anti-Fraud Program
Board's Audit Committee → oversees → Internal Audit (evaluates controls) and External Audit (opines on financial statements)
Employees → report concerns → Hotline → overseen by → Audit Committee

A simple way to remember the verbs:
• Board/Audit Committee – oversee, approve, monitor
• Management – design, implement, maintain, prevent, detect, certify
• Internal Audit – evaluate, assess, test, assure
• External Audit – opine, provide reasonable assurance
• Employees – comply, report

5. Common Governance Red Flags
• CEO also serves as board chair with no lead independent director
• Board dominated by insiders or friends of the CEO
• Audit committee lacks a financial expert or rarely meets
• Internal audit reports only to the CFO; audit committee never meets auditors privately
• Frequent auditor changes, especially after disagreements
• No whistleblower hotline, or hotline administered by the executives it might implicate
• Compensation heavily tied to short-term earnings targets
• Management overrides controls or pressures accounting staff

6. Exam Tips: Answering Questions on Governance Roles and Responsibilities

Tip 1 – Separate "responsible for" from "oversees." The single most tested distinction. If the question asks who is primarily responsible for internal controls, preventing fraud, or preparing financial statements, the answer is management. If it asks who provides oversight, the answer is the board or audit committee. Never pick "external auditors" or "internal auditors" as the party responsible for preventing fraud.

Tip 2 – Memorize the SOX anchors. Section 301 = audit committee independence, auditor oversight, and whistleblower complaint procedures. Section 302 = CEO/CFO certification. Section 404 = internal control assessment. Section 407 = financial expert disclosure. Section 806 = whistleblower protection. Section 906 = criminal penalties for false certification. Questions often describe a requirement without naming the section; match the description to the responsible party.

Tip 3 – Know the reporting lines. External auditors report to the audit committee, not the CFO. Internal audit reports functionally to the audit committee and administratively to management. If an answer choice has internal audit reporting solely to the CFO or the external auditor hired by management, it describes poor governance.

Tip 4 – Watch for "reasonable" versus "absolute." External auditors give reasonable assurance about material misstatement. Any option claiming auditors guarantee detection of all fraud, or detect immaterial fraud, is wrong.

Tip 5 – Internal audit's fraud role is specific. Internal auditors must have sufficient knowledge to evaluate fraud risk, but are not expected to have the expertise of a dedicated fraud examiner. Questions frequently test this exact phrasing.

Tip 6 – Apply the fiduciary duty vocabulary correctly. Self-dealing or conflicts = duty of loyalty. Failure to be informed or to attend to oversight = duty of care (or Caremark oversight duty). A good-faith, informed decision that simply turned out poorly is protected by the business judgment rule.

Tip 7 – Independence is the recurring theme. Audit committee members must be independent directors; external auditors must be independent of management; internal audit must have organizational independence. When a scenario describes someone evaluating or overseeing people they report to or have financial ties with, the correct answer identifies an independence impairment.

Tip 8 – Use the Three Lines Model to classify. Operational managers = first line; compliance, risk, and controllership functions = second line; internal audit = third line. The board sits above; external audit sits outside.

Tip 9 – In scenario questions, ask "who is implicated?" If senior management is suspected, the investigation should be directed by the audit committee (often through counsel), not by management. If a lower-level employee is suspected, management or internal audit can lead.

Tip 10 – Read for absolutes and distractors. Words like "always," "never," "all," and "guarantee" usually signal an incorrect option. Watch for answers that swap roles (e.g., "the audit committee designs internal controls" or "the external auditor establishes the whistleblower hotline") – these are deliberately wrong.

Tip 11 – For true/false items, test the subject-verb pairing. Ask: is this the right body paired with the right verb? "The board of directors implements the code of conduct" is false (management implements; the board approves and oversees). "The audit committee is responsible for the appointment and compensation of the external auditor" is true.

Tip 12 – Think like the ACFE. The exam reflects the ACFE's view that tone at the top set by the board and management is the foundation of fraud deterrence, that the audit committee is the linchpin of independent oversight, and that a strong anti-fraud program requires clearly documented roles. When in doubt, choose the answer that strengthens independent oversight and keeps accountability with management.

7. Quick Review Checklist
• Shareholders elect the board.
• Board sets tone, strategy, and risk appetite; hires/fires CEO; has ultimate oversight; owes duties of care and loyalty.
• Audit committee (independent directors, financial expert) oversees external and internal audit, financial reporting, internal control, and the whistleblower hotline.
• Management designs and maintains controls, prevents and detects fraud, prepares statements, certifies under SOX 302/906.
• Internal audit independently evaluates controls and fraud risk; reports functionally to the audit committee.
• External auditors opine on financial statements with reasonable assurance and professional skepticism; hired by and report to the audit committee.
• Compliance, risk, and legal functions form the second line and support management and the board.
• Employees comply and report; anti-retaliation protections keep the reporting channel open.

Master these pairings of who and what, and governance questions on the CFE Exam become some of the most reliable points you can earn.