Governance Frameworks and Principles

1. Why Governance Frameworks and Principles Matter

Governance is the foundation on which risk management and internal control are built. If the governance structure is weak, even the most sophisticated enterprise risk management (ERM) program will fail, because nobody is clearly accountable, information does not reach decision-makers, and the organization's risk appetite is never properly set or enforced. For the CRMA candidate, this topic sits at the heart of Domain II (Risk Management Governance) and is also tested indirectly in questions about the role of internal audit in providing assurance over governance processes.

Why it is important in practice:
• Corporate collapses (Enron, WorldCom, Parmalat, Carillion, Wirecard) were fundamentally failures of governance, not failures of accounting technique.
• Regulators, stock exchanges, and investors expect boards to demonstrate oversight of strategy, risk, culture, and performance.
• The IIA's mandatory guidance requires internal audit to assess and make recommendations to improve the organization's governance processes.
• Risk management frameworks such as COSO ERM and ISO 31000 explicitly place governance (board oversight, leadership, and commitment) as the first and most influential component.

Why it is important in the exam: expect questions asking you to distinguish between the responsibilities of the board, senior management, and internal audit; to recognize the key features of major frameworks; and to identify which governance principle is being violated or upheld in a scenario.

2. What Governance Is

The IIA defines governance as the combination of processes and structures implemented by the board to inform, direct, manage, and monitor the activities of the organization toward the achievement of its objectives. Memorize the four verbs: inform, direct, manage, monitor.

Key points embedded in this definition:
• Governance is owned by the board (or its equivalent governing body), not by management and not by internal audit.
• It consists of both structures (board, committees, charters, policies, reporting lines) and processes (strategy setting, risk appetite approval, performance monitoring, succession planning, ethical oversight).
• Its purpose is achievement of objectives, which links governance directly to risk management, since risk is the effect of uncertainty on objectives.

Related definitions you should know:
• Corporate governance is the system by which companies are directed and controlled (Cadbury Report, 1992).
• Risk governance refers to the governance arrangements that specifically address how risk is identified, assessed, managed, and reported, including risk appetite, risk culture, and the roles of risk committees and the chief risk officer.
• Risk culture is the set of shared values, attitudes, and behaviors that shape how people in the organization identify, understand, discuss, and act on risk.

3. Core Governance Principles

Most frameworks worldwide converge on a similar set of principles. Learn them, and learn how to recognize each one in a scenario.

• Accountability: Those who make decisions must be answerable for them. The board is accountable to shareholders and stakeholders; management is accountable to the board. Exam clue: a scenario where nobody can be identified as responsible for a decision or risk indicates a breakdown in accountability.
• Transparency: Timely, accurate, and complete disclosure of material matters, including financial position, performance, ownership, risks, and governance arrangements. Exam clue: concealment of information from the board or investors.
• Fairness / Equitable treatment: All shareholders, including minority and foreign shareholders, and other stakeholders are treated equitably; related-party transactions are controlled.
• Responsibility: The board recognizes its obligations to stakeholders and society and ensures compliance with laws and ethical standards.
• Integrity and ethical behavior: Tone at the top; a code of conduct; mechanisms such as whistleblower hotlines.
• Independence and objectivity: Sufficient independent non-executive directors; separation of chair and CEO roles (or a strong lead independent director); independent audit committee; functionally independent internal audit.
• Stewardship: Directors act as stewards of the organization's assets and long-term value for the benefit of its owners and stakeholders.
• Effective oversight of risk: The board understands the principal risks, approves risk appetite, and monitors that management operates within it.

4. Major Governance and Risk Governance Frameworks

You do not need to memorize every clause, but you must recognize each framework, its origin, its orientation (principles-based or rules-based), and its distinctive features.

4.1 G20/OECD Principles of Corporate Governance (originally 1999, revised 2004, 2015, and 2023)
The most widely referenced international benchmark. The six chapters are: (1) Ensuring the basis for an effective corporate governance framework; (2) The rights and equitable treatment of shareholders and key ownership functions; (3) Institutional investors, stock markets, and other intermediaries; (4) Disclosure and transparency; (5) The responsibilities of the board; and (6, added in 2023) Sustainability and resilience. Principles-based and intended for use by policymakers worldwide.

4.2 Cadbury Report (UK, 1992) and the UK Corporate Governance Code
Cadbury introduced the comply or explain approach: listed companies either comply with the code provisions or explain why they do not. The current UK Code is organized around board leadership and company purpose; division of responsibilities; composition, succession, and evaluation; audit, risk, and internal control; and remuneration. Exam clue: the phrase 'comply or explain' always points to the UK approach and principles-based regulation.

4.3 Sarbanes-Oxley Act (US, 2002)
A rules-based, legislated response to Enron and WorldCom. Key provisions: Section 302 (CEO/CFO certification of financial reports), Section 404 (management assessment of internal control over financial reporting and auditor attestation), Section 301 (independent audit committee with responsibility for the external auditor and whistleblower procedures), and restrictions on non-audit services. Exam clue: mandatory legal requirements with penalties indicate a rules-based regime.

4.4 King Reports (South Africa; King IV, 2016)
King IV uses an apply and explain approach, is outcomes-based, and strongly emphasizes integrated thinking, integrated reporting, stakeholder inclusivity, and ethical and effective leadership. King is notable for applying to all organizations, not only listed companies.

4.5 COSO Internal Control – Integrated Framework (2013)
Five components (control environment, risk assessment, control activities, information and communication, monitoring activities) and 17 principles. The control environment is the governance component: it includes board independence and oversight, commitment to integrity and ethical values, organizational structure and authority, competence, and accountability.

4.6 COSO Enterprise Risk Management – Integrating with Strategy and Performance (2017)
Five components and 20 principles. The first component, Governance and Culture, contains five principles: exercises board risk oversight; establishes operating structures; defines desired culture; demonstrates commitment to core values; attracts, develops, and retains capable individuals. The other components are Strategy and Objective-Setting; Performance; Review and Revision; and Information, Communication, and Reporting. The 2017 framework replaces the 2004 cube with a 'helix' that threads risk through strategy and performance.

4.7 ISO 31000:2018 Risk Management – Guidelines
Structured as principles (eight: integrated, structured and comprehensive, customized, inclusive, dynamic, best available information, human and cultural factors, continual improvement, all surrounding the central purpose of value creation and protection), a framework (leadership and commitment at the center, surrounded by integration, design, implementation, evaluation, and improvement), and a process (communication and consultation; scope, context, criteria; risk assessment comprising identification, analysis, and evaluation; risk treatment; monitoring and review; recording and reporting). Governance appears in the framework element as leadership and commitment from top management and oversight bodies. ISO 31000 is guidance only and is not certifiable.

4.8 The IIA's Three Lines Model (2020)
Replaced the Three Lines of Defense. Six principles: (1) governance; (2) governing body roles; (3) management and first- and second-line roles; (4) third-line roles; (5) third-line independence; (6) creating and protecting value. The governing body is accountable to stakeholders, sets direction, delegates to management, and receives assurance. First-line roles deliver products and manage risk; second-line roles provide expertise, support, monitoring, and challenge on risk; the third line (internal audit) provides independent and objective assurance and advice. External assurance providers sit outside the organization. Exam clue: the model stresses that lines are roles, not rigid organizational structures, and emphasizes alignment and collaboration rather than defense.

4.9 Basel Committee and sector-specific codes
Financial services organizations also follow Basel Committee guidance on corporate governance for banks, which highlights the board's risk oversight role, the independence and stature of the chief risk officer, and a strong risk culture. You are unlikely to be tested on detail, but recognize that regulated industries layer additional governance expectations on top of general codes.

5. Principles-Based vs Rules-Based Approaches

This distinction is a favorite exam theme.
• Principles-based (UK Code, OECD, King, ISO 31000): flexible, scalable, applied through judgment, uses comply-or-explain or apply-and-explain, encourages substance over form, but may result in inconsistent application and boilerplate explanations.
• Rules-based (SOX): prescriptive, enforceable, consistent, clear minimum standards, but costly, may encourage box-ticking and a compliance mindset, and can be circumvented by meeting the letter but not the spirit of the rule.
Most jurisdictions blend the two: laws establish minimum rules while listing codes add principles.

6. How Governance Works: Structures and Roles

The board of directors / governing body
• Approves strategy, purpose, and values; sets the tone at the top.
• Approves risk appetite and tolerance and monitors the risk profile against them.
• Appoints, evaluates, compensates, and if necessary replaces the CEO; plans succession.
• Ensures integrity of financial and non-financial reporting and of the systems of risk management and internal control.
• Oversees compliance, ethics, and stakeholder relations.
• Conducts periodic self-evaluation of its own effectiveness.
• Composition matters: a balance of executive and independent non-executive directors, diversity of skills and perspectives, and either separation of chair and CEO or a lead independent director.

Board committees
• Audit committee: oversees financial reporting, internal control, internal audit, and the external auditor; approves the internal audit charter and plan; receives reports from the chief audit executive (CAE); is the CAE's functional reporting line. Members should be independent and financially literate, with at least one financial expert.
• Risk committee: oversees the risk management framework, risk appetite, and emerging risks; common in financial institutions, where it is often mandatory. Where no separate risk committee exists, the audit committee usually assumes this role.
• Nomination (and governance) committee: board composition, director appointments, succession, board evaluation.
• Remuneration / compensation committee: executive pay aligned to long-term performance and risk, including clawback and malus provisions.

Senior management
• Owns and implements risk management and internal control on a day-to-day basis.
• Establishes the ERM framework, risk policies, and reporting.
• The chief risk officer (CRO) leads the second-line risk function, facilitates the risk process, challenges the first line, and reports to the board or risk committee; the CRO should have sufficient independence from revenue-generating activities.
• Management committees (executive risk committee, asset-liability committee, disclosure committee) operationalize governance below board level.

Internal audit
• The third line: provides independent, objective assurance and advice on the adequacy and effectiveness of governance, risk management, and control.
• Must assess and make appropriate recommendations to improve the organization's governance processes, including strategic and operational decision-making, oversight of risk and control, promoting ethics and values, ensuring effective performance management and accountability, communicating risk and control information, and coordinating activities among the board, external and internal auditors, assurance providers, and management.
• Under the Global Internal Audit Standards (effective 2025), the CAE must develop an understanding of governance, risk management, and control processes and consider them in risk-based planning; the board's role in supporting internal audit is set out in Domain III (Governing the Internal Audit Function), including approving the mandate, charter, plan, budget, and CAE appointment.
• Internal audit may facilitate risk management activities but must not own risks, set risk appetite, make risk management decisions, or provide assurance over its own work.

External assurance providers
• External auditors, regulators, and other independent reviewers give additional assurance to the governing body and stakeholders.

How the pieces fit together (the governance cycle)
1. The board sets purpose, strategy, values, and risk appetite.
2. Management designs structures, policies, and the risk management framework to deliver strategy within appetite.
3. First- and second-line roles identify, assess, treat, and monitor risks and report upward.
4. Internal audit independently evaluates whether governance, risk management, and control are effective and reports to the board/audit committee.
5. The board monitors performance and risk information, challenges management, and adjusts strategy or appetite.
6. The organization reports transparently to stakeholders, and the board evaluates its own effectiveness, closing the loop.

7. Assessing Governance: What Internal Audit Looks For

When providing assurance over governance (and when answering scenario questions), consider these indicators of effective governance:
• A clear, documented, and communicated strategy and set of values.
• A board with appropriate independence, skills, time commitment, and information.
• Approved risk appetite statements that are cascaded into limits and key risk indicators.
• Defined roles and responsibilities with no significant gaps or overlaps (a RACI or similar).
• Timely, relevant, reliable reporting to the board, including bad news.
• Functioning committees with charters and documented minutes.
• A code of conduct, training, and an independent whistleblowing mechanism with board-level reporting.
• Internal audit with an approved charter, unrestricted access, functional reporting to the board, and administrative reporting to a senior executive.
• Periodic board and committee self-assessments and external evaluations.
• Alignment of compensation with risk and long-term performance.

Red flags that signal governance weakness: a dominant CEO who also chairs the board; an audit committee that meets rarely or lacks financial expertise; the CAE reporting functionally to the CFO; risk appetite that exists only on paper; management filtering information before it reaches the board; frequent restatements; a culture of fear that discourages escalation; significant related-party transactions without independent review.

8. How to Answer Exam Questions on Governance Frameworks and Principles

CRMA questions are typically scenario-based multiple choice. Use a disciplined approach:

Step 1 – Identify what is really being asked. Is the question about who is responsible (board, management, internal audit, external audit), which framework applies, which principle is at stake, or what action is most appropriate?

Step 2 – Apply the responsibility hierarchy.
• Oversight, direction, approval of appetite, accountability to stakeholders = board.
• Design, implementation, day-to-day operation of risk management and controls = management.
• Independent assurance and recommendations, facilitation without ownership = internal audit.
• If an answer has internal audit setting risk appetite, owning a risk register, or making management decisions, it is wrong.
• If an answer has the board performing operational tasks, it is usually wrong; the board oversees, it does not execute.

Step 3 – Match framework keywords.
• 'Comply or explain' = UK Code / Cadbury.
• 'Apply and explain', 'integrated reporting', 'outcomes-based' = King IV.
• 'Section 404', 'certification by CEO and CFO', 'rules-based' = Sarbanes-Oxley.
• 'Governance and Culture component', 'helix', 'strategy and performance', '20 principles' = COSO ERM 2017.
• 'Control environment', '17 principles', 'five components' = COSO Internal Control 2013.
• 'Principles, framework, process', 'leadership and commitment', 'value creation and protection', 'not certifiable' = ISO 31000:2018.
• 'Six principles', 'governing body, management, internal audit', 'roles not structures' = Three Lines Model 2020.
• 'Rights of shareholders', 'disclosure and transparency', 'responsibilities of the board', 'sustainability and resilience' = G20/OECD Principles.

Step 4 – Identify the principle in the scenario. Ask: is information being hidden (transparency)? Is nobody answerable (accountability)? Are minority shareholders disadvantaged (fairness)? Is the chair also the CEO with no counterbalance (independence)? Are laws or ethics being ignored (responsibility, integrity)?

Step 5 – Choose the 'best' answer, not merely a correct one. The IIA favors answers that are independent, objective, board-focused, principles-driven, and that address root causes. Eliminate answers that are overly narrow, operational, or that compromise internal audit independence.

Step 6 – Watch for absolutes and extremes. Options containing 'always', 'never', 'all', or 'only' are frequently distractors, because governance is principles-based and context-dependent.

9. Exam Tips: Answering Questions on Governance Frameworks and Principles

• Memorize the IIA definition of governance and its four verbs (inform, direct, manage, monitor). Questions often test whether you know governance is implemented by the board.
• Know the first component of each major framework: control environment (COSO IC), Governance and Culture (COSO ERM 2017), leadership and commitment (ISO 31000 framework). Exams love to ask which component addresses board oversight and tone at the top.
• Distinguish Three Lines Model from Three Lines of Defense. The 2020 model dropped the word 'defense', emphasized roles over structures, added six principles, and framed internal audit's value as both assurance and advice. A question describing rigid, siloed lines reflects the old thinking.
• Know the CAE reporting relationship. Functional reporting to the board/audit committee and administrative reporting to senior management. Any option that makes the CFO the CAE's functional reporting line signals impaired independence.
• Remember what internal audit must not do in risk governance: set risk appetite, own risk responses, make decisions on risk treatment, or provide assurance on activities it managed within the past year.
• Risk appetite is approved by the board; management proposes and operates within it. If a question asks who approves the risk appetite statement, the answer is the board, not the CRO or CAE.
• Separate principles-based from rules-based and know the advantages and disadvantages of each. If asked for a drawback of rules-based regimes, think 'box-ticking' and 'letter rather than spirit'; for principles-based, think 'inconsistent application' and 'boilerplate explanations'.
• When a scenario asks for the greatest governance weakness, look for issues at the top of the organization (board independence, dominance of one individual, lack of oversight) rather than lower-level control deficiencies.
• Understand that governance evaluation is itself a required audit activity. The CAE should include governance processes in the risk-based audit plan and may assess governance as a whole or through individual engagements that touch governance elements.
• Expect culture questions. Ethics, tone at the top, and risk culture are governance topics. Internal audit assesses the design, implementation, and effectiveness of ethics-related objectives, programs, and activities, including whistleblower channels.
• Read the final sentence of the question stem first. Governance scenarios can be long; knowing whether you are looking for 'most appropriate', 'least appropriate', 'primary responsibility', or 'best indicator' focuses your reading.
• Think like the IIA, not like your employer. Real-world practices vary, but exam answers reflect IIA guidance and widely accepted frameworks.
• Do not over-invest in jurisdiction-specific legal detail. The exam is global; it tests recognition of SOX, UK Code, King, and OECD at a conceptual level rather than clause-by-clause.

10. Worked Examples

Example 1. The board of a listed company has delegated approval of the enterprise risk appetite statement to the chief risk officer, who also chairs the executive risk committee. Which governance principle is most directly compromised?
Reasoning: Approval of risk appetite is a board oversight responsibility. Delegating it to management removes the board's direction and accountability for risk-taking. Best answer: board accountability and oversight of risk (not transparency, not fairness). Internal audit should recommend the board retain approval and that the CRO proposes rather than approves.

Example 2. Which framework is structured around principles, a framework, and a process, and places leadership and commitment at the center of the framework?
Reasoning: This is the signature structure of ISO 31000:2018. COSO ERM uses components and principles; the Three Lines Model uses six principles and roles. Answer: ISO 31000.

Example 3. The CAE has been asked by the CEO to design and operate the company's new risk register and to approve the risk treatment plans proposed by business units. What is the most appropriate response?
Reasoning: Designing and operating the register could be acceptable only as a facilitation role with safeguards, but approving risk treatments is a management decision that would impair internal audit's independence. Best answer: the CAE should decline the decision-making role, may facilitate on a temporary basis with board approval and documented safeguards, and should ensure management owns the register and the decisions.

Example 4. A regulator introduces a corporate governance code under which listed companies must either follow each provision or disclose the reasons for departure. This approach is best described as:
Reasoning: Comply or explain; principles-based. Answer: a principles-based, comply-or-explain regime (as opposed to a rules-based, mandatory statute such as SOX).

Example 5. Which of the following would an internal auditor consider the strongest indicator of an effective governance process?
Options typically include: detailed procedures manuals; a large compliance department; an independent board that receives timely risk information and challenges management; a low number of audit findings. Reasoning: Governance effectiveness is about board independence, information, and challenge. A low number of findings or a big compliance team is not evidence of governance quality. Answer: the independent, informed, challenging board.

11. Quick Reference Summary

• Governance = processes and structures implemented by the board to inform, direct, manage, and monitor toward objectives.
• Principles: accountability, transparency, fairness, responsibility, integrity, independence, stewardship, risk oversight.
• Frameworks: OECD (international benchmark), Cadbury/UK Code (comply or explain), SOX (rules-based law), King IV (apply and explain, integrated), COSO IC 2013 (control environment), COSO ERM 2017 (Governance and Culture), ISO 31000:2018 (principles, framework, process), Three Lines Model 2020 (roles and six principles).
• Board oversees and approves; management owns and operates; internal audit assures and advises; external providers add independent assurance.
• Internal audit must assess governance processes and recommend improvements while preserving independence: facilitate, do not decide.
• In the exam, identify the actor, the framework keyword, and the principle at stake; choose the board-centered, independence-preserving, principles-based answer; avoid absolutes.

Master these points and you will be able to handle the full range of governance questions in the CRMA exam, from simple definitional recall to complex scenarios that test your judgment about roles, independence, and the application of frameworks to real organizational situations.