ACCA Pakistan Strategic Business Leader (SBL) Syllabus

What are the components of Porter's generic competitive strategies?

Cost leadership, Differentiation, and Focus (cost focus or differentiation focus on a narrow segment). Trying to be 'stuck in the middle' is the danger.

What are the four growth directions in Ansoff's matrix?

Market penetration (existing product/existing market), Product development (new product/existing market), Market development (existing product/new market), Diversification (new product/new market).

What are the three success criteria (SAF/SFA) for evaluating strategic choices?

Suitability (does it fit the strategic position?), Acceptability (return, risk, stakeholder reactions?), and Feasibility (can it be done with available resources?).

What are the methods of pursuing strategy in Johnson, Scholes & Whittington?

Methods of development: organic (internal) development, mergers & acquisitions, and strategic alliances/joint ventures.

What does the BCG matrix classify and on what axes?

It classifies products/SBUs by relative market share (horizontal) and market growth (vertical) into Stars, Cash Cows, Question Marks (problem children), and Dogs.

What does each BCG category imply for strategy and cash?

Stars (invest, high growth/share); Cash Cows (harvest, fund others); Question Marks (build or divest, high growth/low share); Dogs (divest/hold, low growth/low share).

What are the elements of strategy implementation that managers must align?

Structure, resources (people, finance, IT), processes/systems, and culture must be configured to deliver the chosen strategy; change must be managed effectively.

What does the McKinsey 7S model list?

Strategy, Structure, Systems (hard elements) and Shared values, Skills, Style, Staff (soft elements). All must be aligned for effective implementation.

What are Lewin's three stages of change management?

Unfreeze (create the need for change), Change/Move (implement the change), and Refreeze (embed and stabilise the new behaviours).

Define risk and distinguish it from uncertainty.

Risk is a measurable chance of an outcome differing from expectation, where probabilities can be estimated. Uncertainty is where outcomes and probabilities cannot be reliably quantified.

Distinguish gross (inherent) risk from net (residual) risk.

Gross/inherent risk is the level of risk before controls are applied. Net/residual risk is the remaining risk after controls and mitigation. Risk appetite is the residual risk the organisation accepts.

What two dimensions are used to assess and map risks?

Likelihood (probability of occurrence) and impact (severity/consequence). They are plotted on a risk map/heat map to prioritise responses.

What are the four TARA risk responses?

Transfer (e.g. insurance/hedging), Avoid (stop the activity), Reduce (controls to lower likelihood/impact), Accept (retain low-level risk). Mapped to the likelihood/impact grid.

What is the difference between business risk and financial risk?

Business risk arises from the nature of operations (strategic, operational, compliance, reputational). Financial risk arises from financing and markets (credit, liquidity, interest rate, currency/gearing).

Define a risk register and its typical contents.

A document recording identified risks with details such as description, owner, likelihood, impact, current controls, residual risk rating, and planned mitigating actions.

What is the COSO definition of internal control and its five components?

A process to provide reasonable assurance over operations, reporting and compliance. Components: Control environment, Risk assessment, Control activities, Information & communication, and Monitoring activities.

What is the difference between embedded and standalone risk management?

Embedded (enterprise risk management) integrates risk management into everyday processes and culture across the whole organisation. Standalone treats risk as a separate, periodic exercise, which is less effective.

What is the three lines model (formerly three lines of defence)?

First line: operational management owning and managing risk/controls. Second line: risk and compliance functions overseeing. Third line: internal audit providing independent assurance to the board.

What is the difference between a fundamental ethical principle approach and a rules approach (IFAC/ACCA Code)?

ACCA's Code is principles-based, requiring judgement against five fundamental principles, supported by a conceptual framework to identify, evaluate and address threats, rather than prescriptive rules.

List the five fundamental principles of the ACCA Code of Ethics.

Integrity, Objectivity, Professional competence and due care, Confidentiality, and Professional behaviour.

Name the five categories of threats to ethical compliance in the ACCA conceptual framework.

Self-interest, Self-review, Advocacy, Familiarity, and Intimidation threats. Safeguards are applied to reduce them to an acceptable level.

What is Kohlberg's classification of moral development?

Three levels: Pre-conventional (self-interest, reward/punishment), Conventional (conformity to norms/law), and Post-conventional (universal ethical principles).

What is the CIA triad in information/cyber security?

Confidentiality (data accessed only by authorised parties), Integrity (data is accurate and unaltered), and Availability (data/systems accessible when needed).

Name common cybersecurity threats an organisation must manage.

Phishing/social engineering, malware and ransomware, denial-of-service (DoS/DDoS) attacks, hacking/unauthorised access, insider threats, and data breaches.

What are typical controls to mitigate cyber/information risk?

Firewalls, encryption, access controls and authentication (e.g. MFA), staff training, patch management, intrusion detection, back-ups, and incident response/business continuity plans.

What are the four Vs commonly used to characterise Big Data?

Volume (scale), Velocity (speed of generation), Variety (different types/sources), and Veracity (trustworthiness/quality). Some add Value as a fifth V.

Distinguish descriptive, diagnostic, predictive and prescriptive analytics.

Descriptive (what happened), Diagnostic (why it happened), Predictive (what is likely to happen), and Prescriptive (what action should be taken). They increase in value and complexity.

What are key examples of disruptive technologies affecting business strategy?

Artificial intelligence/machine learning, cloud computing, the Internet of Things (IoT), blockchain/distributed ledgers, robotic process automation (RPA), and 3D printing.

What is the difference between automation (RPA) and artificial intelligence?

RPA automates repetitive, rule-based tasks following defined logic. AI can learn from data, recognise patterns and make decisions/predictions, handling unstructured problems beyond fixed rules.

What is the purpose and independence requirement of internal audit?

Internal audit provides independent, objective assurance and consulting on risk, control and governance. It should report functionally to the audit committee to safeguard its independence.

What are the four perspectives of the Balanced Scorecard?

Financial, Customer, Internal business process, and Learning & growth (innovation). It links performance measures to strategy beyond purely financial metrics.

What does ROCE measure and how is it calculated?

Return on Capital Employed measures operating efficiency/profitability of capital. ROCE = Operating profit (PBIT) / Capital employed, where capital employed = total assets less current liabilities (or equity + debt).

What is Economic Value Added (EVA) and its basic formula?

EVA measures value created above the cost of capital. EVA = Net Operating Profit After Tax (NOPAT) - (WACC x Capital employed). Positive EVA means value is being created for shareholders.