Corporate Governance Structures and Roles

Introduction

Corporate governance is the foundation upon which every risk management framework is built. In the IIA Certification in Risk Management Assurance (CRMA) syllabus, the topic Corporate Governance Structures and Roles sits within the Risk Management Governance domain, and it is one of the most heavily tested areas because almost every other concept in the exam (risk appetite, the Three Lines Model, internal audit independence, ERM frameworks, assurance mapping) depends on a clear understanding of who governs, who manages, who assures, and how these parties interact. This guide explains why the topic matters, what the structures and roles are, how governance operates in practice, and how to tackle exam questions on it with confidence.

1. Why Corporate Governance Structures and Roles Matter

Governance determines how an organization is directed, controlled, and held accountable. When governance structures are weak or roles are blurred, risk management fails regardless of how sophisticated the risk models are. High profile corporate collapses such as Enron, WorldCom, Carillion, and Wirecard were ultimately governance failures: boards that did not challenge management, audit committees without financial expertise, internal audit functions that lacked independence, and management that overrode controls.

For a risk management assurance professional, understanding governance structures matters for three practical reasons:

a) Internal audit is required to assess governance. The IIA Standards (Standard 2110 in the 2017 International Standards for the Professional Practice of Internal Auditing, and the Governance, Risk Management and Control requirements carried into the 2024 Global Internal Audit Standards) require the internal audit activity to assess and make appropriate recommendations to improve the organization's governance processes. You cannot assess what you do not understand.

b) Internal audit's own independence depends on governance. The chief audit executive (CAE) must report functionally to the board (typically through the audit committee) and administratively to senior management. This reporting line is itself a governance structure, and the exam frequently tests whether a described arrangement protects or compromises independence.

c) Risk ownership flows from governance. Who sets risk appetite? Who owns risks? Who provides assurance? These are governance questions. The Three Lines Model, which is central to the CRMA, is essentially a description of governance roles in relation to risk and control.

In exam terms, governance questions test your ability to distinguish oversight from execution, and accountability from responsibility. Candidates who can quickly identify which body is responsible for which activity score highly in this domain.

2. What Is Corporate Governance?

The IIA definition. The IIA Glossary defines governance as the combination of processes and structures implemented by the board to inform, direct, manage, and monitor the activities of the organization toward the achievement of its objectives. Note the key words: processes and structures, implemented by the board, and achievement of objectives. Governance is board-driven and objective-focused.

The OECD perspective. The OECD Principles of Corporate Governance describe governance as the system by which companies are directed and controlled, involving a set of relationships between a company's management, its board, its shareholders, and other stakeholders. It provides the structure through which objectives are set and the means of attaining those objectives and monitoring performance are determined.

Core principles. Across frameworks (OECD, King IV in South Africa, the UK Corporate Governance Code, COSO), governance rests on a small set of principles that frequently appear as answer options in the exam:
- Accountability: those entrusted with authority must answer for how it is used.
- Transparency: timely, accurate disclosure of material matters.
- Fairness: equitable treatment of shareholders and stakeholders.
- Responsibility: acting ethically, lawfully, and in the long-term interest of the organization.
- Independence: objective judgment free from undue influence, especially at board level.

Shareholder versus stakeholder models. The Anglo-American model historically emphasizes shareholder primacy with a unitary (one-tier) board. Many continental European models (e.g., Germany) use a two-tier structure with a supervisory board and a separate management board, and give explicit voice to employees and other stakeholders. Modern codes such as King IV adopt an integrated stakeholder-inclusive approach. The exam generally uses the generic term board to mean the highest governing body, whatever its legal form.

3. The Key Governance Structures

Think of governance as a hierarchy of delegation and accountability. The following structures appear repeatedly in CRMA questions.

3.1 Shareholders / Owners
Shareholders (or, in the public and not-for-profit sector, the equivalent owners, members, trustees, or legislature) are the ultimate principals. They elect the board, approve major transactions, appoint external auditors (in many jurisdictions), and hold the board accountable through voting and engagement. They do not manage the organization.

3.2 The Board of Directors (Governing Body)
The board is the apex of internal governance. Its responsibilities include:
- Setting and approving strategy, mission, and values.
- Establishing the risk appetite and approving the risk management framework.
- Setting the tone at the top and overseeing the ethical culture.
- Appointing, evaluating, compensating, and if necessary removing the CEO.
- Overseeing (not performing) management's activities and performance.
- Ensuring effective internal control, risk management, and assurance arrangements.
- Ensuring integrity of financial reporting and disclosures.
- Approving the internal audit charter, the CAE appointment, and the internal audit plan and budget.

Boards comprise executive directors (who are also members of management) and non-executive directors (NEDs). Independent NEDs have no material relationship with the company beyond their directorship and are essential for objective challenge. Good practice calls for a majority of independent directors on the board and fully independent audit and remuneration committees. Separation of the roles of board chair and CEO is widely recommended to avoid concentration of power.

3.3 Board Committees
Boards delegate detailed oversight to committees, each with a charter approved by the board. The committees most relevant to the CRMA are:

- Audit Committee: oversees the integrity of financial statements, internal control over financial reporting, the external auditor (appointment, independence, fees, scope), the internal audit function (charter, CAE appointment and removal, plan, resources, results), and often compliance and whistleblowing arrangements. Members should be independent and financially literate, with at least one financial expert. The audit committee is the body to which the CAE functionally reports.
- Risk Committee: oversees the enterprise risk management framework, risk appetite and tolerance, risk culture, emerging risks, and the adequacy of risk management resources. In financial institutions a separate risk committee is often mandated; in other organizations the audit committee may combine both roles as an audit and risk committee.
- Nomination / Governance Committee: board composition, succession planning, director independence, board evaluation, and governance policies.
- Remuneration / Compensation Committee: executive pay structures, ensuring incentives align with risk appetite and long-term value rather than encouraging excessive risk-taking.
- Other committees as needed (e.g., sustainability, technology, ethics).

Committees make recommendations to the board; final accountability remains with the full board.

3.4 Senior Management
Management is responsible for executing strategy and managing risk within the appetite set by the board. Key roles include:
- Chief Executive Officer (CEO): overall responsibility for operations and performance; primary link between board and management; owns the control environment on a day-to-day basis.
- Chief Financial Officer (CFO): financial reporting, treasury, financial controls, and often the administrative reporting line for the CAE (though this is less preferred than reporting to the CEO).
- Chief Risk Officer (CRO): leads the risk management function, develops and maintains the ERM framework, facilitates risk assessment, monitors aggregate exposure against appetite, and reports to the board or risk committee. The CRO is a second line role: the CRO facilitates and challenges, but does not own business risks.
- Chief Compliance Officer, General Counsel, Chief Information Security Officer, Head of Quality, etc.: specialist second line functions providing expertise, policy, monitoring, and challenge.
- Management committees such as an executive risk committee, asset-liability committee (ALCO), disclosure committee, or IT steering committee, which operate below board level and are part of management, not of the board.

3.5 Internal Audit
Internal audit is the independent, objective assurance and consulting activity. Governance characteristics that protect its value are:
- A board-approved charter defining purpose, authority, and responsibility.
- Functional reporting to the board/audit committee (approving the charter, risk-based plan, budget, CAE appointment, remuneration and removal, and receiving results).
- Administrative reporting to a senior executive, ideally the CEO, to enable day-to-day operations.
- Unrestricted access to records, personnel, and the board.
- Freedom from operational responsibility for the activities it audits.
Internal audit evaluates governance, risk management, and control processes and provides assurance to the board on their effectiveness. In the Three Lines Model it is the third line.

3.6 External Audit, Regulators, and Other External Assurance Providers
External auditors provide an independent opinion on the financial statements to shareholders. Regulators, supervisors, rating agencies, certification bodies, and standard-setters exert external governance pressure. Under the Three Lines Model these are external assurance providers whose work the board and internal audit should coordinate with (assurance mapping) to avoid gaps and duplication.

4. Roles in the IIA Three Lines Model (2020)

The 2020 update replaced the older Three Lines of Defense with a principles-based model that is heavily tested. Its six principles emphasize governance, governing body roles, management roles, third line roles, independence, and value creation. The roles are:

- Governing body: accountable to stakeholders for organizational oversight; establishes structures and processes for governance; delegates responsibility and provides resources to management; determines organizational appetite; establishes and oversees an independent internal audit function.
- Management, first line roles: directly aligned with delivering products and services, including managing risk and applying controls in day-to-day operations.
- Management, second line roles: provide expertise, support, monitoring, and challenge on risk-related matters (risk management, compliance, quality, security). Second line roles can be combined with first line roles or be separate; they are still part of management.
- Internal audit, third line: independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management, reporting primarily to the governing body.
- External assurance providers: additional assurance to satisfy legislative, regulatory, and stakeholder expectations.

Key exam point: accountability for governance rests with the governing body; responsibility for managing risk rests with management; internal audit provides assurance and must remain independent of management responsibilities. The CRO is second line, not third line. Internal audit should not own, design, or implement risk management processes (it may facilitate and advise with safeguards, per IIA Position Paper guidance on the fan diagram of roles internal audit should and should not undertake).

5. How Governance Works in Practice: The Cycle of Direction and Accountability

Governance operates as a continuous loop:

Step 1: Owners confer authority. Shareholders elect the board and set the constitutional framework (articles, bylaws, shareholder agreements).

Step 2: The board directs. The board sets purpose, values, strategy, risk appetite, and policies, and establishes committee and reporting structures. It approves delegation of authority matrices defining what management may decide and what must come to the board.

Step 3: Management executes. Management translates strategy into objectives, plans, budgets, and operations; identifies, assesses, responds to, and monitors risks; designs and operates controls; and reports performance and risk information upward.

Step 4: Second line supports and challenges. Risk, compliance, and other functions set frameworks, aggregate risk information, monitor adherence, and escalate breaches of appetite.

Step 5: Assurance is provided. Internal audit independently tests governance, risk, and control processes and reports to the audit committee. External audit opines on financial statements. Regulators review compliance.

Step 6: The board monitors and holds to account. The board and its committees receive management reports, risk dashboards, audit results, and external findings; challenge management; evaluate CEO performance; adjust strategy and appetite; and report to shareholders and stakeholders through annual reports, governance statements, and disclosures.

The loop closes with transparency to owners, who then re-elect or replace directors. Internal audit's governance assessments under Standard 2110 focus on whether this loop is working: whether the organization is making strategic and operational decisions effectively, overseeing risk management and control, promoting appropriate ethics and values, ensuring effective performance management and accountability, communicating risk and control information to the right areas, and coordinating the activities of and communication among the board, external and internal auditors, other assurance providers, and management.

6. Common Governance Weaknesses Internal Auditors Look For

These also appear as scenario details in exam questions:
- Combined chair and CEO without a strong independent lead director.
- Audit committee lacking independence or financial expertise.
- No board-level articulation of risk appetite.
- CAE reporting only to the CFO or having operational duties (e.g., managing the risk function).
- Board involved in day-to-day decisions (micromanagement) or, conversely, rubber-stamping management proposals.
- Incentive schemes rewarding short-term results that encourage excessive risk-taking.
- Inadequate information flows: the board receives only good news or receives raw data with no analysis.
- Lack of succession planning or board evaluation.
- Related-party transactions without independent review.
- Whistleblowing channels that route to management rather than an independent body.

7. How to Answer Exam Questions on Corporate Governance Structures and Roles

CRMA questions are multiple choice and often scenario-based. Use the following method:

Step 1: Identify the governance layer being tested. Ask: Is this question about owners, the board, a board committee, management, a second line function, internal audit, or external parties? Most wrong answers assign a task to the wrong layer.

Step 2: Apply the oversight versus execution test. The board oversees, approves, sets direction, and holds accountable. Management implements, operates, owns, and manages. If an option has the board approving a hedging transaction policy, that is oversight (correct). If it has the board executing individual hedges, that is execution (incorrect).

Step 3: Apply the independence test. Any option that compromises the independence of the board, audit committee, or internal audit is almost always wrong. Watch for the CAE reporting functionally to the CFO, the CAE owning the ERM framework, executives dominating the audit committee, or internal audit designing controls it will later audit.

Step 4: Apply the Three Lines test. Classify each party as governing body, first line, second line, third line, or external. The CRO is second line; the business unit head is first line; internal audit is third line.

Step 5: Choose the best answer, not merely a true one. IIA questions often include two plausible options; select the one that most completely reflects authoritative guidance (IIA Standards, Three Lines Model, COSO) and the specific question stem (e.g., most appropriate, primary responsibility, best describes).

8. Exam Tips: Answering Questions on Corporate Governance Structures and Roles

Tip 1: Memorize the IIA definition of governance. The phrase processes and structures implemented by the board to inform, direct, manage, and monitor is a frequent correct answer. Options that attribute governance to management or to internal audit are distractors.

Tip 2: Know the audit committee's four core oversight areas. Financial reporting, internal control, internal audit, and external audit. If a question asks who approves the internal audit charter or CAE appointment, the answer is the board, usually via the audit committee, never the CEO or CFO alone.

Tip 3: Remember the dual reporting line. Functional to the board; administrative to senior management. If a scenario describes the reverse, identify it as an impairment to independence.

Tip 4: Risk appetite is set by the board. Management may propose and the CRO may draft, but approval and ownership of appetite is a board responsibility. Internal audit never sets risk appetite.

Tip 5: The CRO is not internal audit. Questions often test whether candidates conflate the second and third lines. A CRO who also heads internal audit is a classic independence failure.

Tip 6: Watch for the word primary. When asked who has primary responsibility for managing risk, the answer is management (first line), not internal audit or the board. When asked who has ultimate accountability for governance, the answer is the board.

Tip 7: Internal audit can facilitate but not own. Under the IIA position on ERM roles, internal audit may facilitate risk workshops, coach management, and consolidate risk reporting with safeguards, but must not set appetite, make risk response decisions, implement responses, or take accountability for risk management.

Tip 8: Recognize tone at the top. Questions about ethical culture, codes of conduct, and whistleblowing typically have the board and senior management setting the tone, with internal audit assessing the ethics program (Standard 2110.A1) rather than owning it.

Tip 9: Coordination of assurance is a governance matter. Assurance mapping and reliance on other assurance providers (Standard 2050) support the board's need for comprehensive, non-duplicative assurance. The CAE coordinates; the board oversees.

Tip 10: Eliminate absolutes and operational language. Options stating that the board should review all transactions, approve every policy, or supervise staff are usually wrong because they describe execution. Options using words like oversee, approve the framework, monitor, challenge, and hold accountable usually describe the board correctly.

Tip 11: Think in terms of information flows. Many scenario questions describe a breakdown in communication (e.g., the audit committee is unaware of a significant control failure). The best remedial answer typically strengthens the reporting line to the board, not merely to management.

Tip 12: Public sector and not-for-profit variants. The exam may substitute terms such as trustees, council, oversight committee, or governing board. Apply the same principles: the governing body oversees; management manages; internal audit assures.

9. Worked Examples

Example 1. Which of the following best describes the role of the board of directors in enterprise risk management?
A. Identifying and assessing operational risks in each business unit.
B. Approving the risk appetite and overseeing management's risk management processes.
C. Designing and implementing risk responses.
D. Providing independent assurance on the effectiveness of risk management.
Answer: B. A and C describe management (first and second line) activities; D describes internal audit. The board oversees and approves appetite.

Example 2. The CAE of a company reports functionally to the CFO, who also chairs the management risk committee. Which governance concern is most significant?
A. The CFO may lack financial expertise.
B. Internal audit's independence is impaired because its functional reporting line is to management rather than the board.
C. The management risk committee should be chaired by the CRO.
D. The CAE should also attend the management risk committee.
Answer: B. Functional reporting must be to the board (audit committee). The other options are either irrelevant or do not address the core impairment.

Example 3. In the IIA Three Lines Model, the compliance function that develops policies, monitors adherence, and escalates breaches is best classified as:
A. Governing body.
B. First line management role.
C. Second line management role.
D. Third line.
Answer: C. Compliance provides expertise, support, monitoring, and challenge, which are second line roles within management.

Example 4. Which committee is most appropriate to review executive incentive plans to ensure they do not encourage risk-taking beyond the organization's appetite?
A. Audit committee.
B. Remuneration committee, in consultation with the risk committee.
C. Management executive committee.
D. Internal audit.
Answer: B. Remuneration design is a board committee oversight matter, increasingly coordinated with the risk committee. Internal audit may assess the process but does not decide pay.

10. Summary

Corporate governance structures and roles define who directs, who manages, who assures, and who is accountable. For the CRMA exam, master four ideas: (1) the board governs through oversight, direction, and accountability, delegating detailed oversight to committees such as the audit and risk committees; (2) management, including the CRO and other second line functions, owns and manages risk within the appetite the board sets; (3) internal audit provides independent assurance and advice, protected by functional reporting to the board; and (4) the Three Lines Model ties these roles together with clear accountability to stakeholders. When answering questions, identify the governance layer, test for oversight versus execution, check independence, classify the line, and select the most authoritative answer. With these habits, governance questions become some of the most predictable and reliably scored items on the exam.