CS (Company Secretary) Governance, Risk Management, Compliance and Ethics Syllabus

Name the components of the COSO Enterprise Risk Management (ERM) 2017 framework.

Five components: Governance & Culture; Strategy & Objective-Setting; Performance; Review & Revision; and Information, Communication & Reporting.

What is 'risk appetite'?

The amount and type of risk an organisation is willing to accept in pursuit of its strategic objectives.

What is the difference between risk appetite and risk tolerance?

Risk appetite is the broad level of risk an organisation is willing to take to meet objectives; risk tolerance is the acceptable variation/deviation around specific objectives or limits.

What are the main categories of business risk?

Strategic, Operational, Financial, Compliance/Regulatory, and Reputational risks (sometimes including hazard and technological risks).

What is the 'Three Lines Model' (formerly Three Lines of Defence)?

1st line = operational management owning/managing risk; 2nd line = risk and compliance functions overseeing risk; 3rd line = internal audit providing independent assurance to the governing body.

What are the four main steps in the risk management process?

Risk identification, risk assessment/analysis (likelihood x impact), risk evaluation/response, and risk monitoring & review.

What is a risk heat map (risk matrix)?

A visual grid plotting risks by likelihood (probability) against impact (severity), using colour coding to prioritise which risks need attention.

Name the four main risk response strategies (the 4 Ts).

Treat (reduce/control), Tolerate (accept), Transfer (insure/outsource), and Terminate (avoid/eliminate the activity).

How is the expected value of a risk commonly calculated?

Risk Exposure (Expected Loss) = Probability of occurrence x Impact (monetary value of loss).

What is a Key Risk Indicator (KRI)?

A metric used to provide an early warning signal of increasing risk exposure in various areas of an organisation.

What is a risk register?

A document that records identified risks, their assessment (likelihood/impact), owners, mitigation/control measures and current status.

What is the definition of internal control?

A process effected by an entity's board, management and personnel, designed to provide reasonable assurance regarding achievement of objectives in operations, reporting and compliance.

Name the five components of the COSO Internal Control - Integrated Framework.

Control Environment, Risk Assessment, Control Activities, Information & Communication, and Monitoring Activities.

What is the difference between preventive, detective and corrective controls?

Preventive controls stop errors/fraud before they occur (e.g., authorisation); detective controls identify problems after occurrence (e.g., reconciliations); corrective controls fix/remedy identified issues (e.g., backups, disciplinary action).

What is segregation of duties (SoD)?

An internal control dividing responsibilities for authorisation, custody, recording and reconciliation among different people to reduce the risk of error and fraud.

Under the Companies Act 2013, what is the requirement for Internal Financial Controls (IFC)?

The board's report of every company must state that directors have laid down internal financial controls and that such controls are adequate and operating effectively (Section 134); auditors must report on IFC over financial reporting for applicable companies.

What is the difference between a compliance framework and a governance framework?

A governance framework defines how an organisation is directed and controlled (decision rights, accountability); a compliance framework is the structure for ensuring adherence to laws, regulations, standards and internal policies.

What is a Compliance Management System (CMS)?

A structured set of policies, procedures, controls, training, monitoring and reporting mechanisms an organisation uses to identify and meet its legal and regulatory obligations.

In India, what is the role of the Secretarial Audit under Section 204 of the Companies Act 2013?

A mandatory audit by a Practising Company Secretary (for prescribed companies) in Form MR-3 checking compliance with applicable laws and regulations, ensuring legal and procedural compliance.

What is the difference between a regulation, a standard and a policy?

A regulation is a legally enforceable government rule; a standard is an agreed benchmark/specification (often voluntary, e.g., ISO); a policy is an internal organisational directive guiding behaviour and decisions.

What is RegTech?

Regulatory Technology - the use of technology (AI, automation, analytics) to help organisations comply with regulations efficiently and at lower cost, e.g., automated compliance monitoring and reporting.

What is GRC software used for?

To integrate Governance, Risk and Compliance activities on a single platform - centralising policy management, risk registers, control testing, audit, and regulatory reporting.

How can technologies like AI and blockchain enhance compliance?

AI enables real-time transaction monitoring, anomaly/fraud detection and automated KYC/AML; blockchain provides immutable, transparent audit trails and tamper-proof records.

What governance disclosures must a listed company's annual report contain in India?

A Corporate Governance Report (under SEBI LODR Schedule V), Management Discussion & Analysis, Board's Report, and for top companies the BRSR - covering board composition, committees, remuneration, and compliance.

What is integrated reporting <IR>?

A reporting framework (by the IIRC/IFRS Foundation) that combines financial and non-financial (ESG) information to show how an organisation creates value over time across six capitals.

What is business ethics?

The application of moral principles and standards to business behaviour - the study of what is right and wrong conduct in a commercial context.

Distinguish between deontological and teleological (consequentialist) ethics.

Deontological ethics judges actions by adherence to rules/duties regardless of outcome; teleological/consequentialist ethics judges actions by their consequences/outcomes (e.g., utilitarianism - the greatest good for the greatest number).

What is a code of ethics/conduct, and who must it cover under SEBI LODR?

A formal statement of an organisation's values and standards of behaviour; under SEBI LODR, listed companies must adopt a code of conduct for all board members and senior management, with annual affirmation of compliance.

What is a whistleblower / vigil mechanism, and is it mandatory in India?

A mechanism enabling employees/directors to report unethical behaviour, fraud or violations confidentially; under Section 177 of the Companies Act 2013 and SEBI LODR, listed and certain companies must establish a vigil mechanism with safeguards against victimisation.

What does the ICSI Code of Conduct require of a Company Secretary regarding professional standards?

Adherence to integrity, objectivity, professional competence, confidentiality, due care and professional behaviour - violations constitute professional/other misconduct under the Company Secretaries Act, 1980.

What is the difference between bribery and a facilitation payment?

Bribery is offering/giving/receiving something of value to improperly influence a decision; a facilitation payment is a small payment to speed up a routine government action - both are generally prohibited under strict anti-corruption laws like the UK Bribery Act and India's Prevention of Corruption Act.

Which Indian law is the principal anti-corruption statute, and what does it cover?

The Prevention of Corruption Act, 1988 (amended 2018) - it criminalises bribery of public servants, covers both bribe-givers and bribe-takers, and includes corporate liability for failure to prevent bribery.