Association of Chartered Certified Accountants (ACCA) Strategic Business Leader (SBL) Syllabus

What are the three methods of pursuing strategy in the corporate strategy 'directions and methods' framework?

Organic (internal) development; mergers and acquisitions (M&A); and strategic alliances/joint ventures. Each differs in speed, cost, control and risk of achieving the chosen strategic direction.

What is the BCG growth-share matrix and its four quadrants?

A portfolio tool plotting relative market share against market growth: Stars (high share, high growth), Cash cows (high share, low growth), Question marks/problem children (low share, high growth), and Dogs (low share, low growth). It guides resource allocation across the portfolio.

What is a business model, and what does the Business Model Canvas describe?

A business model describes how an organisation creates, delivers and captures value. The Business Model Canvas has nine blocks: customer segments, value propositions, channels, customer relationships, revenue streams, key resources, key activities, key partnerships and cost structure.

What is the difference between a risk and an uncertainty?

Risk is a situation where outcomes are unknown but their probabilities can be estimated (quantifiable). Uncertainty is where outcomes and probabilities cannot be reliably estimated. Risk can be measured and managed; pure uncertainty is harder to assess.

Distinguish gross (inherent) risk from net (residual) risk.

Gross/inherent risk is the level of risk before any controls or mitigation. Net/residual risk is the risk remaining after controls and risk responses have been applied. The difference reflects the effectiveness of risk management.

How is the expected severity of a risk assessed in a risk map/heat map?

By plotting impact (consequence/severity) against likelihood (probability) of occurrence. Conceptually, risk exposure $= \text{Probability} \times \text{Impact}$. High-impact, high-likelihood risks demand priority attention; low/low risks can be accepted.

What are the four generic risk responses in the TARA framework?

Transfer (e.g. insurance, hedging, outsourcing), Avoid (cease the activity), Reduce/mitigate (controls to lower likelihood or impact), and Accept/retain (tolerate within appetite). Choice depends on the risk's likelihood and impact.

Define risk appetite and risk capacity.

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its objectives. Risk capacity is the maximum amount of risk it can actually bear given its resources. Appetite should sit within capacity.

What is the purpose of a risk register and its typical contents?

A risk register documents and tracks identified risks. It typically records the risk description, owner, likelihood, impact, gross and net risk ratings, controls in place, planned responses, and review dates. It supports monitoring and accountability.

What is Enterprise Risk Management (ERM) and how does it differ from traditional risk management?

ERM (e.g. COSO ERM framework) is an integrated, organisation-wide, portfolio approach to managing all risks in alignment with strategy and objectives, embedded in culture. Traditional risk management tends to be siloed, focusing on individual or insurable risks separately.

What is dynamic (or hierarchical) risk, and why must risk management be ongoing?

Risks change continually as the internal and external environment evolves (dynamic risk), so risk management is a continuous cycle of identifying, assessing, responding and monitoring rather than a one-off exercise. Embedded, regularly reviewed processes keep responses current.

Define internal audit and state its core purpose.

Internal audit is an independent, objective assurance and consulting activity designed to add value and improve an organisation's operations. It evaluates and improves the effectiveness of risk management, control and governance processes, reporting to the audit committee.

What are the 'three lines of defence' model for risk and control?

First line: operational management who own and manage risk. Second line: risk management and compliance functions that oversee and monitor. Third line: internal audit providing independent assurance to the board/audit committee on the effectiveness of the first two lines.

Distinguish internal audit from external audit.

External audit gives an independent opinion to shareholders on whether financial statements are true and fair; it is statutory and reports externally. Internal audit serves management/the audit committee, covering risk, controls and governance across operations; its scope is set internally and it is not statutory.

What conditions are needed for internal audit independence and effectiveness?

Reporting line to the audit committee (not finance/executives), unrestricted scope and access to records and people, appointment/removal controlled by the audit committee, no operational responsibilities that it later audits, and appropriately qualified, objective staff.

What is assurance, and what are the levels of assurance an engagement can provide?

Assurance is a professional's conclusion enhancing the confidence of intended users about a subject matter. Reasonable assurance gives a high (but not absolute) level of confidence with a positive opinion; limited assurance gives a lower level with a negative ('nothing came to our attention') conclusion.

What is digital disruption and how should organisations respond strategically?

Digital disruption is when new digital technologies/business models displace established products, services or value chains (e.g. streaming displacing physical media). Responses include adopting new technology, redesigning business models, building digital capabilities, and embedding agility and innovation.

How does technology create competitive advantage along Porter's value chain?

Technology can lower costs (automation, integrated systems) supporting cost leadership, and add value/differentiation (customisation, analytics, e-commerce) in both primary activities (operations, marketing, service) and support activities (procurement, technology development, infrastructure, HR).

What is e-business / e-commerce, and what models does it include?

E-business is conducting business processes using internet/digital technologies; e-commerce is buying/selling online. Models include B2B (business to business), B2C (business to consumer), C2C (consumer to consumer) and C2B, plus platforms, marketplaces and disintermediation of the value chain.

What are the defining characteristics (the Vs) of big data?

Volume (huge amounts of data), Velocity (speed of generation/processing), Variety (diverse structured and unstructured forms), Veracity (data reliability/quality) and Value (insight that can be derived). These distinguish big data from conventional datasets.

Distinguish the four types of data analytics by the question each answers.

Descriptive: what happened? Diagnostic: why did it happen? Predictive: what is likely to happen? Prescriptive: what should we do about it / what is the best action? Sophistication and value increase from descriptive to prescriptive.

What benefits and risks does big data analytics bring to decision making?

Benefits: better-informed decisions, customer insight, efficiency, identifying trends and risks, competitive advantage. Risks: data quality/veracity, privacy and data-protection compliance (e.g. GDPR), cost and skills, security breaches, and over-reliance/misinterpretation of correlations as causation.

In information security, what does the CIA triad stand for?

Confidentiality (data accessible only to authorised users), Integrity (data is accurate and not improperly altered), and Availability (information and systems are accessible when needed). These are the three core objectives of cyber/information security.

Identify common types of cyber security threats organisations face.

Malware (viruses, ransomware, spyware), phishing/social engineering, denial-of-service (DoS/DDoS) attacks, hacking/unauthorised access, insider threats, and data theft. Threats may be deliberate (criminal/competitor) or accidental (human error).

What controls help mitigate cyber and IT risk?

Technical controls (firewalls, encryption, antivirus, access controls, multi-factor authentication, patching, backups), organisational controls (policies, segregation of duties, incident response plans), and people controls (training, awareness). A defence-in-depth, layered approach is recommended.

What is Total Quality Management (TQM) and its underlying principles?

TQM is a continuous, organisation-wide approach to embedding quality in every process and aiming for zero defects. Principles include customer focus, continuous improvement (kaizen), getting it right first time, employee involvement, and that prevention costs less than failure (cost of quality).

What are the four categories in the cost of quality?

Prevention costs (avoiding defects, e.g. training, design), appraisal costs (inspection/testing), internal failure costs (defects found before delivery, e.g. scrap, rework), and external failure costs (defects found by customers, e.g. warranty, lost goodwill).

What is Business Process Re-engineering (BPR)?

BPR, associated with Hammer and Champy, is the fundamental rethinking and radical redesign of business processes to achieve dramatic improvements in critical measures such as cost, quality, service and speed. It rejects incremental change in favour of starting from a clean sheet.

Define Six Sigma and the DMAIC improvement cycle.

Six Sigma is a data-driven methodology to reduce defects and variation, targeting near-perfection (about 3.4 defects per million opportunities). DMAIC is its core cycle: Define, Measure, Analyse, Improve, Control. It complements continuous improvement with statistical rigour.

What is benchmarking and what are its main types?

Benchmarking is comparing processes/performance against a reference point to identify improvement. Types: internal (between units), competitive (against direct rivals), functional/process (against best-in-class for a function in any industry), and strategic benchmarking.

How is Return on Capital Employed (ROCE) calculated and what does it measure?

$$\text{ROCE} = \frac{\text{Operating profit (PBIT)}}{\text{Capital employed}} \times 100\%$$ where capital employed = total assets − current liabilities (or equity + non-current liabilities). It measures how efficiently capital generates operating profit.

Define the current ratio and the quick (acid-test) ratio.

$$\text{Current ratio} = \frac{\text{Current assets}}{\text{Current liabilities}}$$ $$\text{Quick ratio} = \frac{\text{Current assets} - \text{Inventory}}{\text{Current liabilities}}$$ Both assess short-term liquidity; the quick ratio excludes less-liquid inventory.

What is gearing (leverage) and how is it commonly measured?

Gearing measures the proportion of debt financing relative to equity, indicating financial risk. A common measure is $$\text{Gearing} = \frac{\text{Debt}}{\text{Equity}} \times 100\% \quad \text{or} \quad \frac{\text{Debt}}{\text{Debt} + \text{Equity}}.$$ Higher gearing means greater financial risk and interest obligations.

What is Net Present Value (NPV) and the decision rule for investment appraisal?

NPV discounts future cash flows to present value: $$\text{NPV} = \sum_{t=0}^{n} \frac{C_t}{(1+r)^{t}}$$ where $C_t$ is the net cash flow in period $t$ and $r$ the discount rate. Decision rule: accept projects with a positive NPV; choose the highest NPV among mutually exclusive options.

What is the Internal Rate of Return (IRR)?

The IRR is the discount rate $r$ at which a project's NPV equals zero, i.e. $$\sum_{t=0}^{n} \frac{C_t}{(1+r)^{t}} = 0.$$ A project is acceptable if its IRR exceeds the required rate of return (cost of capital).

What is a key limitation of payback period as a financial decision tool?

Payback measures how long it takes to recover the initial investment but ignores the time value of money (unless discounted), ignores cash flows after the payback point, and does not measure overall profitability. It is best used as a simple risk/liquidity screen alongside NPV.

What are the typical stages of the project life cycle?

Initiation (define the project, business case), planning (scope, schedule, budget, resources, risk), execution (delivering the work), monitoring and controlling (tracking progress against plan), and closure (handover, review, lessons learned).

What is the project management 'iron triangle' (triple constraint)?

Time, cost and quality (scope), with scope often at the centre. The constraints are interdependent: changing one affects the others. The project manager must balance these to deliver the required output within agreed parameters.

What is a business case in project management and why is it important?

A business case justifies undertaking a project by setting out the rationale, expected costs, benefits, risks and options. It supports the go/no-go decision and is revisited at gateways to confirm the project remains viable and worthwhile.

What is a Post-Completion (Post-Implementation) Review of a project?

A review carried out after a project is finished to assess whether objectives, benefits, time and cost targets were met, and to capture lessons learned for future projects. It supports accountability and organisational learning, distinct from in-project monitoring.

What are the five fundamental principles of the ACCA/IESBA Code of Ethics?

Integrity, Objectivity, Professional competence and due care, Confidentiality, and Professional behaviour. These principles govern the conduct of professional accountants and underpin public trust.

What categories of threats to the fundamental ethical principles does the IESBA Code identify?

Self-interest, self-review, advocacy, familiarity and intimidation threats. Where threats are not at an acceptable level, safeguards must be applied to eliminate or reduce them; if they cannot, the engagement/relationship should be declined or ended.

Distinguish between an ethical absolutist (deontological) and an ethical relativist (consequentialist/teleological) stance.

Absolutism/deontology holds that some actions are inherently right or wrong regardless of consequences (rules and duties matter). Relativism/consequentialism (e.g. utilitarianism) judges actions by their outcomes, so what is right depends on context and results.

What are Kohlberg's three levels of moral development?

Pre-conventional (morality based on self-interest, reward and punishment), conventional (morality based on social approval and law/order), and post-conventional (morality based on universal ethical principles and self-chosen values). It explains how ethical reasoning matures.

What does Carroll's Corporate Social Responsibility (CSR) pyramid comprise?

Four layers of responsibility, from the base upward: economic (be profitable), legal (obey the law), ethical (do what is right and fair) and philanthropic (be a good corporate citizen). Together they describe the full scope of an organisation's social responsibilities.

What are the ACCA professional skills assessed in the SBL exam?

Communication, Commercial acumen, Analysis, Scepticism, and Evaluation. Marks are awarded for demonstrating these skills in applying technical knowledge to the scenario, not just for the technical content itself.

What does the professional skill of 'scepticism' require a candidate to demonstrate?

Probing, questioning and challenging information, assumptions and the views/motives of others; not accepting evidence at face value; identifying inconsistencies, bias or missing information; and recognising the implications of unethical or questionable behaviour.

What does 'commercial acumen' mean as a professional skill?

Demonstrating awareness of the wider business and organisational context, using judgement that recognises the practical and commercial realities of the scenario, identifying opportunities and risks, and making recommendations that are realistic and value-adding for the organisation.

What is the difference between data, information and knowledge in a business communication context?

Data are raw, unprocessed facts and figures. Information is data processed and given context so it has meaning for a purpose. Knowledge is information combined with experience, judgement and understanding that enables effective action and decision making.

What qualities make management information effective (the ACCURATE attributes)?

Accurate, Complete, Cost-effective, Understandable, Relevant, Adaptable/Accessible, Timely and Easy to use. Good information must be reliable and fit for the decision it supports, with benefits exceeding the cost of providing it.

What should be considered when choosing an appropriate medium and tone for a business communication?

The audience and their needs/knowledge, the purpose (inform, persuade, instruct), the formality and confidentiality required, the complexity and urgency of the message, and the need for a record or feedback. The chosen format (report, email, presentation, briefing) and tone should match these.

What are the key elements of persuasion in French and Raven's bases of power?

Legitimate (positional authority), reward, coercive, expert (knowledge/skill), and referent (personal charisma/respect) power. Influence and persuasion draw especially on expert and referent power, which tend to gain genuine commitment rather than mere compliance.

What is the difference between influencing through compliance and through commitment?

Compliance is when people do what is asked because they must (driven by position, reward or coercive power), often yielding minimal effort. Commitment is when people genuinely agree and are motivated (driven by expert, referent power and persuasion), producing sustained, willing engagement and better outcomes.