IFA Corporate Governance & Risk Management Flashcards

What does the Sarbanes-Oxley Act (SOX) primarily require of US public companies?

Answer: Enhanced financial disclosure requirements and CEO/CFO personal certification of financial statements

SOX requires US public companies to strengthen internal controls, certify the accuracy of financial statements, and establish audit committees, with severe penalties for non-compliance.

What is a whistleblower policy in a governance context?

Answer: A formal mechanism allowing employees to report suspected wrongdoing without fear of retaliation

A whistleblower policy provides protected channels for employees to report unethical, illegal, or fraudulent activities without facing retaliation, supporting governance integrity.

What is a 'conflict of interest' in corporate governance?

Answer: A situation where a director's personal interests may compromise their duty to act in the company's best interests

A conflict of interest arises when a director or officer has personal financial or other interests that could improperly influence their decisions made on behalf of the company.

What is 'tone at the top' in corporate governance?

Answer: The ethical culture, values, and behaviors modeled and communicated by senior leadership

'Tone at the top' refers to the ethical climate established by senior leadership, whose behavior and communication set the standard for integrity and compliance throughout the organization.

What purpose does an internal audit function serve in risk management?

Answer: It provides independent assurance that risks are being managed and internal controls are effective

Internal audit provides independent, objective assurance and consulting to management and the board that risk management, control, and governance processes are operating effectively.

What is a 'risk register' used for in organizational risk management?

Answer: A centralized document recording identified risks, their assessment, ownership, and mitigation actions

A risk register is a living document that captures all identified risks, their likelihood, impact, risk owners, current controls, and planned mitigation actions in one place.