Sources of Governance Guidance
5 minutes
5 Questions
In the Certified Fraud Examiner (CFE) curriculum, corporate governance refers to the system of rules, practices, and processes by which an organization is directed and controlled, balancing the interests of shareholders, management, employees, customers, regulators, and the community. Because weak governance is a primary enabler of fraud, CFEs must understand where organizations obtain authoritative guidance on governance. Sources of governance guidance generally fall into several categories. First, legislation and regulation establish mandatory requirements. In the United States, the Sarbanes-Oxley Act of 2002 (SOX) imposed duties on boards, audit committees, and executives, including CEO/CFO certification of financial statements, independence of audit committee members, and internal control reporting under Section 404. The Dodd-Frank Act added whistleblower provisions and compensation disclosure rules. Other jurisdictions have comparable laws, such as the UK Companies Act and Japan's J-SOX. Second, stock exchange listing standards (e.g., NYSE and NASDAQ) require listed companies to have majority-independent boards, independent audit, compensation, and nominating committees, codes of conduct, and executive sessions of non-management directors. Third, governance codes and principles issued by international and national bodies provide widely adopted best practices. Key examples include the OECD Principles of Corporate Governance (endorsed by the G20), the UK Corporate Governance Code (operating on a 'comply or explain' basis), the Cadbury Report, and the King Reports in South Africa. These emphasize board accountability, transparency, shareholder rights, and stakeholder engagement. Fourth, internal control and risk management frameworks, notably the COSO Internal Control–Integrated Framework and COSO Enterprise Risk Management framework, guide boards and management in designing control environments that deter fraud. Fifth, professional organizations such as the ACFE, Institute of Internal Auditors, National Association of Corporate Directors, and the Business Roundtable publish guidance, including the ACFE/IIA/AICPA 'Managing the Business Risk of Fraud.' For the CFE, these sources collectively define the standards against which an organization's anti-fraud governance, tone at the top, and oversight mechanisms are evaluated.
Sources of Governance Guidance: A Complete CFE Exam Guide (Corporate Governance)
Overview
Within the ACFE CFE exam, Sources of Governance Guidance sits inside the Fraud Prevention and Deterrence section under Corporate Governance. It covers the major frameworks, codes, laws, and principles that organizations around the world draw upon to design and evaluate how they are directed and controlled. The examiner is not testing you as a lawyer or a company secretary; the exam wants to know whether you, as a fraud examiner, can recognize the leading sources of governance guidance, identify where each one comes from, understand its key features, and explain how it supports fraud prevention and deterrence.
Why This Topic Matters
Weak corporate governance is one of the most consistent root causes of major frauds. Enron, WorldCom, Parmalat, Satyam, and Wirecard all featured dominant executives, passive boards, compromised audit functions, and poor disclosure. Governance guidance exists precisely to counter these conditions.
For a Certified Fraud Examiner, knowing the sources of governance guidance matters because:
1. Benchmarking: When you assess an organization's anti-fraud environment, you need an accepted standard against which to measure it. Frameworks such as the OECD Principles or the King Report give you that yardstick.
2. Risk assessment: Governance gaps (for example, a combined chairman/CEO with no lead independent director, or an audit committee without financial expertise) are red flags that increase fraud risk.
3. Recommendations: After an investigation, CFEs frequently recommend governance improvements. Citing recognized guidance gives those recommendations authority.
4. Global practice: CFEs work internationally. The exam deliberately includes guidance from the United States, the United Kingdom, South Africa, and intergovernmental bodies so that candidates understand governance is not a single-country concept.
5. Legal exposure: Some guidance is mandatory (statutes and listing rules). Knowing which sources are binding and which are voluntary helps a CFE understand an organization's compliance obligations.
What Is Corporate Governance?
Before studying the sources, anchor yourself in the definition. The most frequently quoted definition comes from the UK's Cadbury Report (1992): corporate governance is "the system by which companies are directed and controlled." The OECD expands this to describe governance as the set of relationships between a company's management, its board, its shareholders, and other stakeholders, providing the structure through which objectives are set and performance is monitored.
Governance guidance generally addresses: the composition and responsibilities of the board; the rights and treatment of shareholders; the role of stakeholders; disclosure and transparency; internal control and risk management; the audit function (internal and external); executive remuneration; and ethical culture.
Two Broad Approaches: Rules-Based vs. Principles-Based
A recurring exam theme is the distinction between the two philosophies of governance regulation.
Rules-based approach: Governance requirements are written into law and enforced by regulators. Non-compliance carries legal penalties. The United States, through the Sarbanes-Oxley Act and stock exchange listing standards, is the leading example.
Principles-based approach: Governance is set out in a voluntary code of best practice. Companies are expected to either follow the code or publicly explain why they have not. This is known as "comply or explain" and was pioneered by the Cadbury Report in the UK. South Africa's King IV went further with "apply and explain," requiring companies to assume application of the principles and explain how they did so.
Exam questions often test whether you can match a jurisdiction or a document to the correct approach.
The Major Sources of Governance Guidance
1. The G20/OECD Principles of Corporate Governance
Issued by the Organisation for Economic Co-operation and Development, first published in 1999, revised in 2004, endorsed by the G20 in 2015, and revised again in 2023. These are the most widely referenced international governance benchmark and are used by policy makers, regulators, and stock exchanges worldwide.
Key points to remember:
- They are non-binding recommendations intended to help governments and regulators evaluate and improve their own legal and regulatory frameworks.
- They are intentionally flexible, allowing adaptation to different legal systems and ownership structures.
- The principles are organized into chapters covering: ensuring the basis for an effective corporate governance framework; the rights and equitable treatment of shareholders and key ownership functions; institutional investors, stock markets, and other intermediaries; the role of stakeholders; disclosure and transparency; the responsibilities of the board; and, in the 2023 revision, sustainability and resilience.
- Governance should promote transparent and fair markets, efficient allocation of resources, and accountability of the board to the company and its shareholders.
From a fraud-prevention perspective, the OECD principles emphasize timely and accurate disclosure, independent oversight of management, an effective system of internal control, and protection of whistleblowers and minority shareholders.
2. The Cadbury Report and the UK Corporate Governance Code
The Committee on the Financial Aspects of Corporate Governance, chaired by Sir Adrian Cadbury, reported in 1992 following UK scandals such as Polly Peck, BCCI, and the Maxwell pension fund collapse.
Key contributions:
- The classic definition of corporate governance.
- Introduction of the comply or explain principle.
- Recommendation that the roles of chairman and chief executive be separated so that no single individual holds unfettered power.
- Boards should include a sufficient number of independent non-executive directors.
- Every listed company should have an audit committee composed of at least three non-executive directors.
- Directors should report on the effectiveness of the company's internal controls.
Subsequent UK reports (Greenbury on remuneration, Hampel, Turnbull on internal control, Higgs on non-executive directors, Smith on audit committees) were consolidated into the Combined Code, now known as the UK Corporate Governance Code, maintained by the Financial Reporting Council (FRC). Companies with a premium listing on the London Stock Exchange must state how they have applied the Code.
3. The King Reports (South Africa)
Produced by the King Committee under Judge Mervyn King, these reports are highly regarded internationally and are specifically referenced in CFE study material.
- King I (1994): First South African code; adopted an integrated approach to governance in the interests of a wide range of stakeholders.
- King II (2002): Expanded coverage of risk management, internal audit, sustainability reporting, and ethics.
- King III (2009): Introduced integrated reporting (combining financial and sustainability information), applied to all entities regardless of form or size, and adopted an apply-or-explain basis.
- King IV (2016): Reduced the framework to 17 principles with recommended practices, moved to apply and explain, emphasized outcomes (ethical culture, good performance, effective control, legitimacy), and included sector supplements for municipalities, non-profits, pension funds, and state-owned entities.
Distinctive features for the exam: the King Reports take a stakeholder-inclusive view (not purely shareholder-focused), they apply to all organizations rather than only listed companies, and they are closely associated with integrated reporting.
4. The Sarbanes-Oxley Act of 2002 (United States)
Enacted after Enron and WorldCom, SOX is the leading example of mandatory, rules-based governance regulation. It applies to companies with securities registered with the U.S. Securities and Exchange Commission (SEC), including foreign private issuers.
Governance-relevant provisions frequently tested:
- Section 301: Audit committees must consist entirely of independent directors, must be directly responsible for appointing, compensating, and overseeing the external auditor, and must establish procedures for receiving complaints and anonymous employee submissions regarding accounting and auditing matters.
- Section 302: CEO and CFO must personally certify the accuracy of periodic reports and the effectiveness of disclosure controls.
- Section 404: Management must assess and report on internal control over financial reporting; for larger filers the external auditor must attest to that assessment.
- Section 406: Disclosure of whether the company has a code of ethics for senior financial officers.
- Section 407: Disclosure of whether the audit committee includes a financial expert.
- Section 806: Whistleblower protection for employees of public companies who report fraud.
- Section 906: Criminal penalties for knowingly certifying false financial reports.
- Creation of the Public Company Accounting Oversight Board (PCAOB) to oversee auditors of public companies.
- Restrictions on auditors providing certain non-audit services and mandatory audit partner rotation.
5. Stock Exchange Listing Standards
Exchanges impose governance requirements as a condition of listing. In the United States, the NYSE and Nasdaq rules (approved by the SEC) require listed companies to have a majority of independent directors; independent audit, compensation, and nominating/corporate governance committees; regular executive sessions of non-management directors; a code of business conduct and ethics; and published corporate governance guidelines. Other exchanges worldwide (London, Johannesburg, Toronto, Hong Kong) similarly require disclosure against their national governance codes.
6. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (United States)
Passed after the 2008 financial crisis, Dodd-Frank added further governance measures: shareholder advisory votes on executive pay (say-on-pay), disclosure of the ratio of CEO pay to median employee pay, clawback of incentive compensation after a restatement, independence requirements for compensation committees, and the SEC whistleblower program offering monetary awards for original information leading to successful enforcement actions.
7. The Basel Committee on Banking Supervision
The Basel Committee issues Corporate Governance Principles for Banks (most recently 2015), which apply the general governance concepts to the banking sector. The principles stress the board's overall responsibility, board qualifications and composition, senior management accountability, a strong risk management function led by a Chief Risk Officer, independent compliance and internal audit functions, prudent compensation, and transparency. These are relevant because banks face unique fraud and systemic risks.
8. The COSO Frameworks
The Committee of Sponsoring Organizations of the Treadway Commission publishes the Internal Control - Integrated Framework (1992, updated 2013) and the Enterprise Risk Management - Integrating with Strategy and Performance framework (2017). Although COSO is primarily an internal control and risk standard rather than a governance code, it is the framework most U.S. companies use to satisfy SOX Section 404, and its control environment component directly addresses board oversight, integrity, and ethical values. COSO also issued Fraud Risk Management Guide (with the ACFE) in 2016, updated in 2023.
9. Other International Sources
- International Corporate Governance Network (ICGN): An investor-led body that publishes Global Governance Principles reflecting institutional investor expectations.
- European Union directives on shareholder rights, non-financial reporting, and audit reform.
- Business Roundtable principles in the U.S., and national codes in Germany, Japan, Australia, Singapore, India, and elsewhere, most following a comply-or-explain model.
- International Organization of Securities Commissions (IOSCO) guidance for securities regulators.
How Governance Guidance Works in Practice
Regardless of source, governance guidance operates through a common set of mechanisms:
1. Structure: Defining the board, its committees (audit, remuneration, nomination, risk), and the separation of oversight from management.
2. Independence: Ensuring enough directors are free from conflicts so they can challenge management.
3. Accountability: Requiring the board to answer to shareholders (and in stakeholder models, to employees, creditors, and communities).
4. Transparency: Mandating timely, accurate disclosure of financial results, risks, related-party transactions, and governance practices.
5. Control and assurance: Requiring systems of internal control, risk management, internal audit, and independent external audit.
6. Ethical tone: Promoting codes of conduct, whistleblower channels, and a culture of integrity set by the board and senior management.
For fraud examiners, each mechanism reduces one or more elements of the fraud triangle: independence and control limit opportunity; transparency and accountability deter rationalization; reasonable remuneration design reduces the pressure to manipulate results.
Exam Tips: Answering Questions on Sources of Governance Guidance
Tip 1 - Know the origin of each source. The single most common question type asks you to match a document to its issuing body or country. Memorize: OECD = intergovernmental, non-binding; Cadbury and the UK Corporate Governance Code = United Kingdom, FRC, comply or explain; King Reports = South Africa, apply and explain, all organizations; Sarbanes-Oxley and Dodd-Frank = United States federal law, mandatory; NYSE/Nasdaq = listing standards; Basel = banks; COSO = internal control.
Tip 2 - Distinguish binding from voluntary. If a question says a framework is "legally required" or "carries criminal penalties," think SOX or Dodd-Frank. If it says "non-binding," "best practice," or "adaptable to different legal systems," think OECD, King, or the UK Code. A true/false statement claiming the OECD Principles are enforceable law is false.
Tip 3 - Master the phrases "comply or explain" and "apply and explain." Comply or explain originated with Cadbury and defines the UK model; apply and explain is the King IV refinement. Expect questions that swap these.
Tip 4 - Remember the Cadbury definition verbatim. "The system by which companies are directed and controlled" is a classic recall item.
Tip 5 - Link SOX section numbers to their content. 301 audit committee independence and complaint procedures; 302 officer certification; 404 internal control reporting; 406 code of ethics; 407 audit committee financial expert; 806 whistleblower protection; 906 criminal penalties for false certification. Questions may describe a requirement and ask which section imposes it.
Tip 6 - Spot the stakeholder versus shareholder orientation. The King Reports are notably stakeholder-inclusive and introduced integrated reporting. Questions describing a framework that applies to non-profits and public sector bodies as well as companies are pointing to King.
Tip 7 - Watch for sector-specific clues. Any question mentioning banks, prudential supervision, or a Chief Risk Officer is signaling the Basel Committee. Any question about satisfying Section 404 or the "control environment" component is signaling COSO.
Tip 8 - Read for the fraud connection. The CFE exam often frames governance questions around fraud prevention. When asked why a governance feature matters, choose the answer that explains how it limits management override, increases independent oversight, or improves detection and reporting of wrongdoing.
Tip 9 - Eliminate absolutes carefully. Answer options stating that a code "requires all companies worldwide" or that a framework "guarantees" fraud prevention are almost always wrong. Governance guidance reduces risk; it does not eliminate it.
Tip 10 - Use the true/false format to your advantage. Many CFE questions are true/false. Test each clause of the statement separately: the body, the country, the year range, the binding status, and the specific requirement. If any one clause is wrong, the statement is false.
Quick Review Summary
- Corporate governance: the system by which companies are directed and controlled (Cadbury, 1992).
- OECD Principles: international, non-binding, flexible benchmark endorsed by the G20; cover framework, shareholder rights, intermediaries, stakeholders, disclosure, board responsibilities, and sustainability.
- Cadbury/UK Code: comply or explain; separate chairman and CEO; independent non-executives; audit committee of at least three non-executives; maintained by the FRC.
- King I-IV: South Africa; stakeholder-inclusive; integrated reporting; applies to all organizations; King IV has 17 principles and apply and explain.
- Sarbanes-Oxley: U.S. federal law; independent audit committees, officer certifications, internal control reporting, PCAOB, whistleblower protection.
- Dodd-Frank: say-on-pay, clawbacks, SEC whistleblower awards.
- Stock exchange rules: majority independent board, independent key committees, codes of conduct.
- Basel Committee: governance principles for banks emphasizing risk, compliance, and internal audit.
- COSO: internal control and ERM frameworks underpinning governance and SOX compliance.
Understanding these sources, their origins, and their binding status will allow you to answer the Sources of Governance Guidance questions on the CFE exam with confidence and to apply that knowledge in real-world fraud prevention engagements.
Within the ACFE CFE exam, Sources of Governance Guidance sits inside the Fraud Prevention and Deterrence section under Corporate Governance. It covers the major frameworks, codes, laws, and principles that organizations around the world draw upon to design and evaluate how they are directed and controlled. The examiner is not testing you as a lawyer or a company secretary; the exam wants to know whether you, as a fraud examiner, can recognize the leading sources of governance guidance, identify where each one comes from, understand its key features, and explain how it supports fraud prevention and deterrence.
Why This Topic Matters
Weak corporate governance is one of the most consistent root causes of major frauds. Enron, WorldCom, Parmalat, Satyam, and Wirecard all featured dominant executives, passive boards, compromised audit functions, and poor disclosure. Governance guidance exists precisely to counter these conditions.
For a Certified Fraud Examiner, knowing the sources of governance guidance matters because:
1. Benchmarking: When you assess an organization's anti-fraud environment, you need an accepted standard against which to measure it. Frameworks such as the OECD Principles or the King Report give you that yardstick.
2. Risk assessment: Governance gaps (for example, a combined chairman/CEO with no lead independent director, or an audit committee without financial expertise) are red flags that increase fraud risk.
3. Recommendations: After an investigation, CFEs frequently recommend governance improvements. Citing recognized guidance gives those recommendations authority.
4. Global practice: CFEs work internationally. The exam deliberately includes guidance from the United States, the United Kingdom, South Africa, and intergovernmental bodies so that candidates understand governance is not a single-country concept.
5. Legal exposure: Some guidance is mandatory (statutes and listing rules). Knowing which sources are binding and which are voluntary helps a CFE understand an organization's compliance obligations.
What Is Corporate Governance?
Before studying the sources, anchor yourself in the definition. The most frequently quoted definition comes from the UK's Cadbury Report (1992): corporate governance is "the system by which companies are directed and controlled." The OECD expands this to describe governance as the set of relationships between a company's management, its board, its shareholders, and other stakeholders, providing the structure through which objectives are set and performance is monitored.
Governance guidance generally addresses: the composition and responsibilities of the board; the rights and treatment of shareholders; the role of stakeholders; disclosure and transparency; internal control and risk management; the audit function (internal and external); executive remuneration; and ethical culture.
Two Broad Approaches: Rules-Based vs. Principles-Based
A recurring exam theme is the distinction between the two philosophies of governance regulation.
Rules-based approach: Governance requirements are written into law and enforced by regulators. Non-compliance carries legal penalties. The United States, through the Sarbanes-Oxley Act and stock exchange listing standards, is the leading example.
Principles-based approach: Governance is set out in a voluntary code of best practice. Companies are expected to either follow the code or publicly explain why they have not. This is known as "comply or explain" and was pioneered by the Cadbury Report in the UK. South Africa's King IV went further with "apply and explain," requiring companies to assume application of the principles and explain how they did so.
Exam questions often test whether you can match a jurisdiction or a document to the correct approach.
The Major Sources of Governance Guidance
1. The G20/OECD Principles of Corporate Governance
Issued by the Organisation for Economic Co-operation and Development, first published in 1999, revised in 2004, endorsed by the G20 in 2015, and revised again in 2023. These are the most widely referenced international governance benchmark and are used by policy makers, regulators, and stock exchanges worldwide.
Key points to remember:
- They are non-binding recommendations intended to help governments and regulators evaluate and improve their own legal and regulatory frameworks.
- They are intentionally flexible, allowing adaptation to different legal systems and ownership structures.
- The principles are organized into chapters covering: ensuring the basis for an effective corporate governance framework; the rights and equitable treatment of shareholders and key ownership functions; institutional investors, stock markets, and other intermediaries; the role of stakeholders; disclosure and transparency; the responsibilities of the board; and, in the 2023 revision, sustainability and resilience.
- Governance should promote transparent and fair markets, efficient allocation of resources, and accountability of the board to the company and its shareholders.
From a fraud-prevention perspective, the OECD principles emphasize timely and accurate disclosure, independent oversight of management, an effective system of internal control, and protection of whistleblowers and minority shareholders.
2. The Cadbury Report and the UK Corporate Governance Code
The Committee on the Financial Aspects of Corporate Governance, chaired by Sir Adrian Cadbury, reported in 1992 following UK scandals such as Polly Peck, BCCI, and the Maxwell pension fund collapse.
Key contributions:
- The classic definition of corporate governance.
- Introduction of the comply or explain principle.
- Recommendation that the roles of chairman and chief executive be separated so that no single individual holds unfettered power.
- Boards should include a sufficient number of independent non-executive directors.
- Every listed company should have an audit committee composed of at least three non-executive directors.
- Directors should report on the effectiveness of the company's internal controls.
Subsequent UK reports (Greenbury on remuneration, Hampel, Turnbull on internal control, Higgs on non-executive directors, Smith on audit committees) were consolidated into the Combined Code, now known as the UK Corporate Governance Code, maintained by the Financial Reporting Council (FRC). Companies with a premium listing on the London Stock Exchange must state how they have applied the Code.
3. The King Reports (South Africa)
Produced by the King Committee under Judge Mervyn King, these reports are highly regarded internationally and are specifically referenced in CFE study material.
- King I (1994): First South African code; adopted an integrated approach to governance in the interests of a wide range of stakeholders.
- King II (2002): Expanded coverage of risk management, internal audit, sustainability reporting, and ethics.
- King III (2009): Introduced integrated reporting (combining financial and sustainability information), applied to all entities regardless of form or size, and adopted an apply-or-explain basis.
- King IV (2016): Reduced the framework to 17 principles with recommended practices, moved to apply and explain, emphasized outcomes (ethical culture, good performance, effective control, legitimacy), and included sector supplements for municipalities, non-profits, pension funds, and state-owned entities.
Distinctive features for the exam: the King Reports take a stakeholder-inclusive view (not purely shareholder-focused), they apply to all organizations rather than only listed companies, and they are closely associated with integrated reporting.
4. The Sarbanes-Oxley Act of 2002 (United States)
Enacted after Enron and WorldCom, SOX is the leading example of mandatory, rules-based governance regulation. It applies to companies with securities registered with the U.S. Securities and Exchange Commission (SEC), including foreign private issuers.
Governance-relevant provisions frequently tested:
- Section 301: Audit committees must consist entirely of independent directors, must be directly responsible for appointing, compensating, and overseeing the external auditor, and must establish procedures for receiving complaints and anonymous employee submissions regarding accounting and auditing matters.
- Section 302: CEO and CFO must personally certify the accuracy of periodic reports and the effectiveness of disclosure controls.
- Section 404: Management must assess and report on internal control over financial reporting; for larger filers the external auditor must attest to that assessment.
- Section 406: Disclosure of whether the company has a code of ethics for senior financial officers.
- Section 407: Disclosure of whether the audit committee includes a financial expert.
- Section 806: Whistleblower protection for employees of public companies who report fraud.
- Section 906: Criminal penalties for knowingly certifying false financial reports.
- Creation of the Public Company Accounting Oversight Board (PCAOB) to oversee auditors of public companies.
- Restrictions on auditors providing certain non-audit services and mandatory audit partner rotation.
5. Stock Exchange Listing Standards
Exchanges impose governance requirements as a condition of listing. In the United States, the NYSE and Nasdaq rules (approved by the SEC) require listed companies to have a majority of independent directors; independent audit, compensation, and nominating/corporate governance committees; regular executive sessions of non-management directors; a code of business conduct and ethics; and published corporate governance guidelines. Other exchanges worldwide (London, Johannesburg, Toronto, Hong Kong) similarly require disclosure against their national governance codes.
6. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (United States)
Passed after the 2008 financial crisis, Dodd-Frank added further governance measures: shareholder advisory votes on executive pay (say-on-pay), disclosure of the ratio of CEO pay to median employee pay, clawback of incentive compensation after a restatement, independence requirements for compensation committees, and the SEC whistleblower program offering monetary awards for original information leading to successful enforcement actions.
7. The Basel Committee on Banking Supervision
The Basel Committee issues Corporate Governance Principles for Banks (most recently 2015), which apply the general governance concepts to the banking sector. The principles stress the board's overall responsibility, board qualifications and composition, senior management accountability, a strong risk management function led by a Chief Risk Officer, independent compliance and internal audit functions, prudent compensation, and transparency. These are relevant because banks face unique fraud and systemic risks.
8. The COSO Frameworks
The Committee of Sponsoring Organizations of the Treadway Commission publishes the Internal Control - Integrated Framework (1992, updated 2013) and the Enterprise Risk Management - Integrating with Strategy and Performance framework (2017). Although COSO is primarily an internal control and risk standard rather than a governance code, it is the framework most U.S. companies use to satisfy SOX Section 404, and its control environment component directly addresses board oversight, integrity, and ethical values. COSO also issued Fraud Risk Management Guide (with the ACFE) in 2016, updated in 2023.
9. Other International Sources
- International Corporate Governance Network (ICGN): An investor-led body that publishes Global Governance Principles reflecting institutional investor expectations.
- European Union directives on shareholder rights, non-financial reporting, and audit reform.
- Business Roundtable principles in the U.S., and national codes in Germany, Japan, Australia, Singapore, India, and elsewhere, most following a comply-or-explain model.
- International Organization of Securities Commissions (IOSCO) guidance for securities regulators.
How Governance Guidance Works in Practice
Regardless of source, governance guidance operates through a common set of mechanisms:
1. Structure: Defining the board, its committees (audit, remuneration, nomination, risk), and the separation of oversight from management.
2. Independence: Ensuring enough directors are free from conflicts so they can challenge management.
3. Accountability: Requiring the board to answer to shareholders (and in stakeholder models, to employees, creditors, and communities).
4. Transparency: Mandating timely, accurate disclosure of financial results, risks, related-party transactions, and governance practices.
5. Control and assurance: Requiring systems of internal control, risk management, internal audit, and independent external audit.
6. Ethical tone: Promoting codes of conduct, whistleblower channels, and a culture of integrity set by the board and senior management.
For fraud examiners, each mechanism reduces one or more elements of the fraud triangle: independence and control limit opportunity; transparency and accountability deter rationalization; reasonable remuneration design reduces the pressure to manipulate results.
Exam Tips: Answering Questions on Sources of Governance Guidance
Tip 1 - Know the origin of each source. The single most common question type asks you to match a document to its issuing body or country. Memorize: OECD = intergovernmental, non-binding; Cadbury and the UK Corporate Governance Code = United Kingdom, FRC, comply or explain; King Reports = South Africa, apply and explain, all organizations; Sarbanes-Oxley and Dodd-Frank = United States federal law, mandatory; NYSE/Nasdaq = listing standards; Basel = banks; COSO = internal control.
Tip 2 - Distinguish binding from voluntary. If a question says a framework is "legally required" or "carries criminal penalties," think SOX or Dodd-Frank. If it says "non-binding," "best practice," or "adaptable to different legal systems," think OECD, King, or the UK Code. A true/false statement claiming the OECD Principles are enforceable law is false.
Tip 3 - Master the phrases "comply or explain" and "apply and explain." Comply or explain originated with Cadbury and defines the UK model; apply and explain is the King IV refinement. Expect questions that swap these.
Tip 4 - Remember the Cadbury definition verbatim. "The system by which companies are directed and controlled" is a classic recall item.
Tip 5 - Link SOX section numbers to their content. 301 audit committee independence and complaint procedures; 302 officer certification; 404 internal control reporting; 406 code of ethics; 407 audit committee financial expert; 806 whistleblower protection; 906 criminal penalties for false certification. Questions may describe a requirement and ask which section imposes it.
Tip 6 - Spot the stakeholder versus shareholder orientation. The King Reports are notably stakeholder-inclusive and introduced integrated reporting. Questions describing a framework that applies to non-profits and public sector bodies as well as companies are pointing to King.
Tip 7 - Watch for sector-specific clues. Any question mentioning banks, prudential supervision, or a Chief Risk Officer is signaling the Basel Committee. Any question about satisfying Section 404 or the "control environment" component is signaling COSO.
Tip 8 - Read for the fraud connection. The CFE exam often frames governance questions around fraud prevention. When asked why a governance feature matters, choose the answer that explains how it limits management override, increases independent oversight, or improves detection and reporting of wrongdoing.
Tip 9 - Eliminate absolutes carefully. Answer options stating that a code "requires all companies worldwide" or that a framework "guarantees" fraud prevention are almost always wrong. Governance guidance reduces risk; it does not eliminate it.
Tip 10 - Use the true/false format to your advantage. Many CFE questions are true/false. Test each clause of the statement separately: the body, the country, the year range, the binding status, and the specific requirement. If any one clause is wrong, the statement is false.
Quick Review Summary
- Corporate governance: the system by which companies are directed and controlled (Cadbury, 1992).
- OECD Principles: international, non-binding, flexible benchmark endorsed by the G20; cover framework, shareholder rights, intermediaries, stakeholders, disclosure, board responsibilities, and sustainability.
- Cadbury/UK Code: comply or explain; separate chairman and CEO; independent non-executives; audit committee of at least three non-executives; maintained by the FRC.
- King I-IV: South Africa; stakeholder-inclusive; integrated reporting; applies to all organizations; King IV has 17 principles and apply and explain.
- Sarbanes-Oxley: U.S. federal law; independent audit committees, officer certifications, internal control reporting, PCAOB, whistleblower protection.
- Dodd-Frank: say-on-pay, clawbacks, SEC whistleblower awards.
- Stock exchange rules: majority independent board, independent key committees, codes of conduct.
- Basel Committee: governance principles for banks emphasizing risk, compliance, and internal audit.
- COSO: internal control and ERM frameworks underpinning governance and SOX compliance.
Understanding these sources, their origins, and their binding status will allow you to answer the Sources of Governance Guidance questions on the CFE exam with confidence and to apply that knowledge in real-world fraud prevention engagements.
Test mode:
CFE - Sources of Governance Guidance Example Questions
Test your knowledge of Sources of Governance Guidance
Question 1
The Organisation for Economic Co-operation and Development is the body that developed industry-specific standards for companies disclosing financially material sustainability information to investors.
Question 2
An audit committee in the extractive industry wants to improve the company's reporting to investors. Members want guidance that sets out, industry by industry, which environmental, social and governance topics are likely to be financially material, with metrics the company can report alongside its financial filings. A fraud examiner on the company's governance working group is asked which source of guidance best meets this need. Which source should the fraud examiner recommend?
Question 3
A director tells the audit committee of a listed company that the organization must certify to its regulator that it complies with every provision of the OECD Principles of Corporate Governance. The director also says the SASB standards impose one uniform set of disclosures on all companies. A fraud examiner advising the committee is asked to correct the record. Which statement BEST describes how these two sources apply?
Unlock Premium Access
Certified Fraud Examiner (CFE)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3404 Superior-grade Certified Fraud Examiner (CFE) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CFE: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Sources of Governance Guidance questions
17 questions (total)