Corporate Governance: ACCA AA Chapter 3

My handwritten notes for AA chapter 3 looked like a ransom note written during a fire drill. “CG Deficiencess”. “Excutive resp for corp opertions”. Half abbreviations, half typos, and a week later I couldn’t decode my own shorthand.

So this post is the clean version I wanted to exist. Same syllabus coverage: what corporate governance is, the OECD principles, the UK Corporate Governance Code, the audit committee, and internal control with risk management. Spelling fixed, gaps filled, and the few places where my notes were plain wrong corrected against the source material.

What corporate governance means

Corporate governance is the system by which companies are directed and controlled. The Cadbury Report gave us that phrasing in 1992 and it stuck because it splits cleanly in two. Direction is about where the company goes. Control is about whether anyone verifies that it got there properly.

Why does the machinery exist at all? Because the people who own companies stopped being the people who run them. Shareholders buy shares, directors run the business, and that split creates the agency problem: the agents (directors) know more than the principals (shareholders) and answer to different incentives. Left unchecked, some pay themselves handsomely and hide the damage. Enron hid losses in special purpose entities. Wirecard reported €1.9 billion of cash that never existed.

Governance exists so shareholders can hold directors accountable without running the company themselves.

TCWG vs management

The AA examiner loves this distinction, and ISA 260 builds on it, so learn it cold.

	TCWG	Management
Who	Board of directors and board committees	Executives and staff below the board
Job	Strategic direction and oversight	Conduct of the organisation’s operations
Reporting role	Monitor the financial reporting process	Prepare the financial statements
External auditor	Communicates formally with them (ISA 260)	Works with them operationally

TCWG stands for those charged with governance. They steer. Management rows. When the external auditor needs to discuss fraud risk or disagreement over an accounting treatment, they escalate to the TCWG, because that’s the level with authority over management.

The OECD principles

Spelling fix first: OECD is the Organisation for Economic Co-operation and Development. My notes had “Eco Co-operation & Devlopement”, which reads badly in front of an examiner.

Two things to remember about the body itself:

• It designs policies to improve economic and social well-being for people around the world. People, primarily. Companies come second.
• It issues principles and recommendations. Governments and regulators choose how to adopt them. The OECD sets no binding standards or rules of its own, and its corporate governance principles focus mainly on publicly traded (listed) companies.

The G20/OECD principles cover six areas:

1. An effective corporate governance framework. Laws, regulations and listing rules should fit together so governance actually works in practice.
2. Shareholder rights and equitable treatment. Protect voting rights, let shareholders obtain relevant information, and stop majority shareholders grinding down minorities.
3. Well-functioning stock markets. Institutional investors, intermediaries and exchanges should support good governance, since lazy capital markets let weak boards survive.
4. Disclosure and transparency. Timely, accurate disclosure of everything material: financial results, ownership structures, related party transactions.
5. Responsibilities of the board. The board acts honestly, monitors management, and stays accountable to the company and its shareholders.
6. Sustainability and resilience. Added in the 2023 revision. Boards should address sustainability matters and build capacity to absorb shocks.

Provisions that matter to auditors

Three OECD provisions show up in the AA exam again and again:

1. Shareholders have the right to obtain relevant information and to elect, appoint or approve the external auditor. The auditor works for shareholders. Keep repeating that.
2. The annual external audit should be carried out by an independent, qualified auditor working to International Standards on Auditing (ISAs).
3. External auditors should exercise due professional care throughout the audit.

Most of your AA syllabus hangs off those three lines: independence, the ISAs, professional scepticism. They all start here.

The UK Corporate Governance Code

The Financial Reporting Council (FRC) publishes the UK Code. It applies to companies listed on the London Stock Exchange and runs on “comply or explain”: follow the provisions, or publish a clear explanation of any departure in the annual report. Investors then judge those explanations, which is a softer mechanism than law but sharper than nothing.

The Code organises into five sections.

1. Board leadership and company purpose

The board sets clear goals, objectives and values, then behaves consistently with them. Workforce policies and stakeholder dealings should square with the stated values. Boards engage with shareholders and take workforce views seriously. The Code keeps pushing long-term success over short-term optics, and examiners push the same way.

2. Division of responsibilities

The chair leads the board. The chief executive runs the company. The Code demands a visible split between the two roles so no single person dominates decision-making.

The chair’s job includes promoting openness, shaping culture at board level, and making sure the non-executive directors (NEDs) are effective rather than decorative.

There’s an independence test for the chair on appointment. A candidate fails it if they:

• were an employee of the company at any time in the last 5 years,
• had a material business relationship with the company in the last 5 years,
• hold a significant shareholding in the company (small amounts are tolerated).

My notes compressed all this into “chair should independent on appoint”. Now you have the actual tests.

3. Composition, succession and evaluation

• The nomination committee has a majority of independent NEDs (the chair may sit on it if they were independent on appointment).
• All directors stand for re-election every year.
• Chairs are expected to step down after nine years on the board. My notes said “chair person should change after every 9 yrs”, which works as a memory hook but muddles the detail: the clock runs on total board tenure, and it’s an expectation, not a stopwatch.
• Appointments should promote diversity and equal opportunity.
• The board evaluates its own performance annually, with an externally facilitated review at least every 3 years.

4. Audit, risk and internal control

Two ideas carry this section. The board establishes formal policies to secure independent, effective internal and external audit. And the board decides how much risk the company can take to achieve its goals, then reports a fair, balanced assessment of the internal control system each year.

Everything below about audit committees flows from this section.

5. Remuneration

Remuneration policy should promote the long-term success of the company. And the line my notes got exactly right: no director should be involved in deciding their own remuneration outcome.

Where do CG deficiencies fit?

My notes listed a sixth item titled “CG deficiencies”. It belongs to the reporting side of comply-or-explain. Responsibility for good corporate governance rests with the board (within the wider TCWG), and when a company departs from the Code or falls short somewhere, the annual report has to disclose it and explain why. Silent gaps count against the company.

The audit committee

Mandatory for listed companies. Unlisted organisations adopt them voluntarily because the benefits survive the absence of a listing rule.

The logic fits in one line: the external auditor reports to shareholders, and the committee is independent, so committee oversight strengthens auditor independence. If management hired, paid and reviewed the auditor, the auditor would drift toward management’s comfort. The committee cuts that cord.

Composition

Requirement	Detail
Size	At least 3 independent NEDs for FTSE 350 companies; at least 2 for other listed companies
Financial expertise	At least 1 member with recent and relevant financial experience
Collective competence	As a group, the committee should understand the sector the company operates in

My notes read “atleast 2 independent NEDs (for small org 2)”, which tangled the thresholds. The table above is the version worth memorising.

Roles and responsibilities

• Monitor the integrity of the financial statements, including formal announcements relating to the company’s performance.
• Advise on reporting quality: whether the annual report and accounts, taken as a whole, is fair, balanced and understandable, with all required disclosures present.
• Review the risk management and internal control framework, unless a separate risk committee already does that.
• Monitor and review the effectiveness of the internal audit function.
• Recommend the external auditor’s appointment, reappointment or removal to the board. The board then presents the resolution to shareholders, and shareholders appoint. The chain runs: committee recommends, board proposes, shareholders decide.
• Approve the external auditor’s terms of engagement and remuneration.
• Assess the external auditor’s independence and objectivity, and confirm adequate audit plans are in place.
• Oversee the wider relationship: manage purchases of non-audit services from the audit firm (watch fee proportions), run the tender process and recommend the result to the board, and review the contents of the external auditor’s management letter.

And internal auditors? The committee approves the internal audit plan and its resourcing, and reviews its findings. Internal audit remains a function of the company: it reports functionally to the committee and administratively to management. The committee oversees and approves. It doesn’t run the department. That nuance is what my note “only approve not, decide” was fumbling toward.

FRC guidance on running the committee well

The FRC’s guidance adds operating discipline:

• Provide a proper induction for new audit committee members.
• Meet the internal and external auditors at least annually without management present, covering scope, independence and duties.
• Own the organisation’s relationship with the external auditor end to end.

Benefits and limitations

Benefits:

• Independent, informed scrutiny of financial reporting lifts shareholder confidence in the reported numbers.
• Audit matters receive detailed attention that a full board agenda never provides.
• Judgements come free of operational bias, since most members are independent NEDs.
• Relations between the company and its auditors improve, and auditor independence gains structural backing.

Limitations:

• The committee consumes NED time, and people with genuine expertise are scarce and expensive. The cost-benefit balance has to stack up.
• Authority depends on power dynamics. A committee dominated by a strong chair or CEO becomes decoration.
• Tick-box risk: satisfying the letter of the Code while missing its point.

Internal control and risk management

The board carries this responsibility in three parts. It sets the risk appetite: how much risk the company accepts while chasing its objectives. It sets an appropriate culture, tone from the top included. And it decides how principal risks should be managed and mitigated, driving potential impact down to the lowest practical level.

The RMIC system

Four components. Learn each with a concrete example so you can spot them in scenario questions.

1. Risk assessment. Identify risks, estimate likelihood and impact, rank them. Example: scoring currency exposure on import contracts before any hedging decision.
2. Information and communication systems. The right data reaches the right people in time to act: budgets, variance reports, whistleblowing channels.
3. Management and mitigation through control processes. Segregation of duties, authorisation limits, reconciliations, physical safeguards.
4. Monitoring and reviewing continuing effectiveness. Controls decay. Internal audit testing, exception reporting and periodic reviews catch the decay before it becomes a scandal.

One honest limitation worth a mark in the exam: internal controls provide reasonable assurance. Human error, collusion and management override break otherwise sound systems, and every control costs money, so some residual risk always stays accepted.

How this shows up in the exam

Section A tests recall: committee composition numbers, the chair independence windows (both 5 years), the nine year expectation for chairs, and who appoints the external auditor (shareholders, on the board’s proposal, following the committee’s recommendation).

Section B hands you scenarios: identify which Code principle a situation breaches, or which audit committee duty got skipped. Practise by tagging every fact in a scenario to one of the lists above.

Memory hooks I use:

• 2/3/1: two independent NEDs minimum (non-FTSE 350), three for FTSE 350, one with recent and relevant financial experience.
• 5/5/9: five year employee window, five year business relationship window, nine years maximum chair tenure.
• Committee advises, board proposes, shareholders dispose: the external auditor appointment chain.

Key takeaways

• Corporate governance is the system by which companies are directed and controlled, built to solve the agency problem between shareholders and directors.
• TCWG steer strategically and monitor financial reporting; management prepares the statements and runs daily operations.
• The OECD issues principles (recommendations, never binding rules) aimed at listed companies, and three provisions matter directly to auditors: shareholder-approved audits, independence under ISAs, and due professional care.
• The UK Corporate Governance Code operates on comply-or-explain across five sections, from board purpose through remuneration.
• Audit committees consist of independent NEDs (2 or 3 depending on index, 1 with recent financial experience), recommend the external auditor upward to shareholders, and approve fees, terms and non-audit services.
• Internal control follows the RMIC cycle: assess, communicate, mitigate, monitor, delivering reasonable assurance only.

For a real-world example of what happens when governance fails, see the Leopold Aschenbrenner vs Citadel case — a fund that grew to $45B without adequate independent oversight, then lost 67% of its public book in weeks.

Related questions

What is corporate governance in simple terms?

The system by which companies are directed and controlled: who makes decisions, who checks them, and how shareholders hold directors accountable between annual general meetings.

Who appoints the external auditor?

The shareholders. The audit committee recommends, the board proposes the resolution, and shareholders vote at the general meeting. The committee also approves the auditor’s terms of engagement and remuneration.

What are the main principles of the UK Corporate Governance Code?

Five sections: board leadership and company purpose, division of responsibilities, composition, succession and evaluation, audit, risk and internal control, and remuneration, applied on a comply-or-explain basis.

Is an audit committee mandatory?

For UK listed companies, yes. Unlisted organisations frequently adopt one voluntarily for the same benefits: independent oversight of reporting, auditors and internal control.

What are the components of a risk management and internal control system?

Risk assessment, information and communication systems, control processes that manage and mitigate risk, and ongoing monitoring of continuing effectiveness.

Why do auditors care about corporate governance?

Because governance defines who the auditor answers to (shareholders), protects auditor independence through the audit committee, and sets the expectations of independence, ISAs and due professional care that shape the entire audit.

In closing

Chapter 3, turned into something readable. If you’re sitting AA this session, drill the committee scenarios hardest: they reward knowing these lists cold, and the distractors in Section A come straight from the numbers (3 versus 2 NEDs, 5 versus 9 years).

For the full picture on how the audit, nomination and remuneration committees work in practice, the regulation behind them, and the Enron to London Whale cases, my board committees guide is the deep dive companion to this chapter.

More chapter cleanups are coming as I work through the paper. If you want to see how I apply finance tooling alongside study, my ACCA FM analysis hub collects that work in one place. And if you are evaluating debt or capital structure decisions for a company you work with, When Borrowing Is Good covers the framework for deciding when borrowing builds wealth.