Chapter 5 · Governance, Risk Management and Compliance

Corporate governance = the SYSTEM by which companies are DIRECTED and CONTROLLED. Includes relationships between management, board, shareholders, and stakeholders, and structures through which company objectives are set and performance monitored.

Widely-cited standard (OECD, 1999, revised 2004, 2015, 2023).

Applies to premium-listed companies on a "COMPLY OR EXPLAIN" basis — either adhere to each provision, or explain deviation in the annual report.

Principles-based (unlike US SOX rules-based). Deviation isn't automatically wrong — but requires meaningful explanation shareholders can assess.

• Sets STRATEGY and risk appetite
• APPOINTS and oversees senior management
• Ensures EFFECTIVE risk management and internal control
• Approves CULTURE and values
• Oversees FINANCIAL reporting, audit, disclosure
• Accountable to shareholders (and where relevant, other stakeholders)

Does NOT manage day-to-day. That's the exec team.

• MIX of executive + non-executive directors
• MAJORITY (or significant minority) INDEPENDENT non-execs
• Distinct CHAIR (independent, separate from CEO in most jurisdictions)
• SENIOR INDEPENDENT DIRECTOR (SID) for shareholder engagement

Independence definitions typically exclude: employed within 5 years, material business relationships, cross-directorships, tenure >9 years.

Each with NED / independent-director majority and clear terms of reference.

Risk = EFFECT of UNCERTAINTY on OBJECTIVES — includes UPSIDE and DOWNSIDE. (ISO 31000.)

Financial services tends to focus on downside — but the broader definition matters for strategic risk-taking (which is how firms make money).

Risk Appetite Statement (RAS) translates board-level appetite into measurable metrics (capital ratios, exposure limits, VaR, breach counts).

• Credit (default risk)
• Market (interest rate, FX, equity, commodity price moves)
• Liquidity (funding + market liquidity)
• Operational (processes, people, systems, external events)
• Compliance / conduct (regulatory, mis-selling)
• Reputational
• Strategic
• Model risk
• Cyber risk
• Climate / environmental (rising rapidly post-2019)

Basel definition: risk of loss from inadequate/failed internal processes, people, systems, or external events. Seven categories:

1. Internal fraud
2. External fraud
3. Employment practices
4. Clients, products & business practices
5. Damage to physical assets
6. Business disruption & system failures
7. Execution, delivery & process management

Basel EXCLUDES strategic and reputational risk from op risk (they matter separately).

PHYSICAL risks — acute events (floods, storms), chronic changes (sea-level, temperature).

TRANSITION risks — policy, technology, market shifts driven by decarbonisation (stranded assets, business-model obsolescence).

Frameworks: TCFD (voluntary → mandatory), ISSB IFRS S1/S2 (2023), PRA SS3/19 → SS1/23.

Regulatory framework introduced by UK FCA/PRA (in force 31 March 2022). Requires firms to:

1. Identify IMPORTANT BUSINESS SERVICES delivered to clients
2. Set IMPACT TOLERANCES — max tolerable disruption
3. MAP the people, processes, technology, facilities, third parties supporting each
4. TEST via severe-but-plausible scenarios
5. Take remedial action to remain within impact tolerances by 31 March 2025

Shifts focus from "avoid disruption" (impossible) to "remain within tolerance during disruption".

Impact tolerance = maximum tolerable LEVEL of disruption to an important business service. Expressed as TIME (e.g. "no more than 4 hours unavailability") plus other metrics (data loss, transaction count, error rate).

BOARDS SET impact tolerances. Based on CLIENT / MARKET impact, not internal preference.

• Risk-based DUE DILIGENCE pre-engagement
• Contractual PROTECTIONS (SLAs, audit rights, data access, exit rights)
• ONGOING monitoring
• INCIDENT reporting
• EXIT strategy planning
• CONCENTRATION risk oversight (over-reliance on single provider)
• Regulator NOTIFICATION for material outsourcing

UK PRA SS2/21, FCA SYSC outsourcing chapters. EU DORA expanded third-party ICT rules.

Combination of individual + corporate VALUES, ATTITUDES, COMPETENCIES, and BEHAVIOURS that determine a firm's commitment to and style of risk management. Reflects how risk is ACTUALLY treated day-to-day — not just as stated in policies.

FSB has consistently identified weak risk culture as root cause of major failures.

Effective board MI balances:

• HISTORIC data (losses, breaches, near-misses) + LEADING indicators (culture surveys, control-test outcomes, staff concerns)
• QUANTITATIVE metrics + QUALITATIVE narrative
• AGGREGATE (RAS metrics, capital) + SPECIFIC deep-dives

Provides ACTIONABLE info, not just status descriptions.

Compliance = 2nd line, oversight of REGULATORY compliance risk specifically. Alongside risk management (other risk types). Coordinated with — not merged into — risk management.

Structural variants:

• CCO reports directly to board / CEO (independence)
• CCO under CRO (coordination)
• Split compliance (each BU has embedded compliance overseen by group)

Structured overview of sources of assurance the board / audit committee receives on key risks and controls. Spans:

• MANAGEMENT (1st line self-attestation)
• OVERSIGHT (2nd line compliance / risk monitoring)
• INDEPENDENT ASSURANCE (internal audit + external audit + regulator / skilled-person reviews)

Identifies gaps + duplications. Prevents multiple sources testing the same thing (waste) or nothing testing a critical thing (gap).

Independent + objective assurance activity assessing effectiveness of RISK MANAGEMENT, CONTROL, and GOVERNANCE processes (including the compliance function itself).

Reports independently to the AUDIT COMMITTEE (not CEO). Standards: IIA IPPF, CIIA Financial Services Code.

• SUPERVISORY meetings with board, chair, independent directors
• ASSESSMENT of board minutes, committee papers
• INDIVIDUAL fit-and-proper assessments of Senior Managers
• PERIODIC governance reviews / thematic work
• Skilled-person reviews (UK s.166) where concerns identified

Much more intensive than pre-2008 model. FCA culture reviews (Barclays 2016+) shifted lens to culture explicitly.

Alternative: single regulator (Singapore MAS, Ireland CBI). Federal fragmented (US: OCC + Fed + SEC + CFTC + FINRA + state).