Corporate Governance and Accountability

Introduction and Context

Corporate governance is the system through which companies are directed, controlled and held accountable. It encompasses the relationships among shareholders, the board of directors, executives, employees, creditors, regulators, customers, suppliers and other stakeholders. Governance determines who has authority, how decisions are made, how performance is monitored and how the organization responds when interests conflict.

The subject is strategically important because governance affects access to capital, organizational reputation, risk appetite, innovation, resilience and long-term value creation. A company may possess an attractive product and strong financial resources yet fail because its board does not challenge management, its controls are ineffective, or its incentives encourage misconduct. Governance is therefore not merely a compliance function. It is an institutional capability that shapes strategic quality and organizational legitimacy.

Modern governance debates have been influenced by the OECD Principles of Corporate Governance, national company law, stock-exchange listing rules, securities regulation, accounting standards and professional codes. Although legal rules differ across jurisdictions, sound governance generally requires accountable leadership, competent oversight, reliable information, ethical conduct, protection of rights and responsible management of risk.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain agency, stewardship and stakeholder theories of governance.
2. Evaluate the role, composition and effectiveness of boards.
3. Analyse ownership structures, executive compensation and fiduciary duties.
4. Explain the purpose of audit, internal control and risk-management systems.
5. Assess transparency, disclosure and accountability mechanisms.
6. Diagnose governance failures and recommend corrective action.
7. Evaluate contemporary challenges involving technology, sustainability and artificial intelligence.

1. The Governance Problem

A corporation is a legal person whose ownership and management are usually separated. Shareholders provide capital and elect directors, while executives manage operations. This separation creates specialization but also creates the possibility that managers will pursue private benefits rather than the interests of the organization and its owners.

Governance problems arise from several conditions:

• Information asymmetry: managers normally know more about operations than investors and directors.
• Divergent objectives: executives may value status, job security, personal compensation or empire-building, while investors may prioritize risk-adjusted returns.
• Collective-action problems: dispersed shareholders may lack the incentive or information to monitor management individually.
• Complexity: multinational operations, intangible assets and financial instruments make performance difficult to evaluate.
• Externalities: decisions may impose costs on workers, communities, consumers or the environment that are not reflected in short-term financial results.
• Uncertainty: directors must make decisions without knowing future outcomes, complicating the distinction between poor judgment and misconduct.

Governance is the institutional response to these problems. It uses authority structures, incentives, monitoring, disclosure, legal duties and organizational culture to align conduct with legitimate objectives.

2. Major Theories of Corporate Governance

2.1 Agency Theory

Agency theory treats the firm as a set of contracts between principals and agents. In the classic corporate setting, shareholders are principals and managers are agents. Because managers control resources and possess superior information, they may take actions that benefit themselves at the expense of shareholders.

Agency costs are commonly understood as the sum of:

1. Monitoring expenditures incurred by principals;
2. Bonding expenditures incurred by agents to demonstrate reliable conduct; and
3. Residual losses resulting from imperfect alignment even after monitoring and bonding.

Agency theory supports independent directors, performance-linked compensation, shareholder voting, external audits, takeover markets and disclosure requirements. It is especially useful where ownership is dispersed and managerial opportunism is a significant risk.

However, agency theory has limitations. Excessive monitoring can generate bureaucracy and defensive decision-making. Short-term performance incentives may encourage earnings manipulation or underinvestment in research, employee development and sustainability. The theory may also understate the importance of trust, professional identity and intrinsic motivation.

2.2 Stewardship Theory

Stewardship theory assumes that managers can act as responsible stewards whose objectives are aligned with the long-term success of the organization. Managers may derive satisfaction from achievement, reputation, professional standards and organizational purpose rather than from personal wealth alone.

This perspective supports empowerment, long-term relationships, managerial discretion and boards that provide advice as well as oversight. It is particularly relevant in founder-led firms, mission-driven organizations and companies with strong professional cultures.

Stewardship theory should not be interpreted as a reason to eliminate controls. Trust without verification is vulnerable to abuse, especially when a powerful executive dominates the board. The practical implication is balanced governance: provide capable managers with authority while maintaining independent challenge, transparent information and safeguards against abuse.

2.3 Stakeholder Theory

Stakeholder theory argues that corporations affect and depend upon multiple groups, including employees, customers, suppliers, creditors, communities, governments and the natural environment. Corporate purpose therefore cannot be reduced entirely to short-term shareholder wealth.

Stakeholder governance asks whether decisions create sustainable value and distribute risks and benefits fairly. It is supported by developments in environmental, social and governance reporting, responsible investment, human-rights due diligence and corporate purpose statements.

A difficulty is that stakeholder interests may conflict. A decision to close an inefficient plant may benefit shareholders and consumers through lower costs but harm employees and a local community. Directors must therefore establish decision criteria, consider material impacts, document reasoning and communicate honestly. Stakeholder theory does not mean that every interest receives equal weight in every decision; it requires that relevant interests are identified and responsibly considered.

2.4 Resource-Dependence and Institutional Perspectives

Resource-dependence theory views the board as a source of knowledge, legitimacy, relationships and access to external resources. Directors may provide expertise in regulation, technology, finance or international markets. Institutional theory emphasizes that organizations adopt governance practices partly to gain legitimacy and conform to expectations, even when formal structures do not always change actual behaviour.

These perspectives explain why board composition, network connections, reputation and symbolic compliance matter. They also warn that a company may create committees and policies ceremonially while preserving concentrated power and weak challenge in practice.

Comparative View

Effective governance is generally pluralistic. Agency controls may be necessary, stewardship may improve commitment, and stakeholder analysis may protect long-term legitimacy.

3. The Board of Directors

The board is the central internal governance institution. Its responsibilities normally include appointing and supervising senior executives, approving strategy, overseeing risk, reviewing financial reporting, ensuring legal and ethical compliance, approving major transactions and protecting the long-term interests of the company.

3.1 Board Composition

Board effectiveness depends on more than the number of independent directors. Relevant dimensions include:

• Independence: freedom from relationships that could impair objective judgment;
• Competence: financial, legal, industry, technological, international and sustainability expertise;
• Diversity: variation in gender, age, background, experience and cognitive perspective;
• Commitment: adequate time and preparation;
• Constructive challenge: willingness to question senior executives;
• Collective capability: coverage of the knowledge required by the company’s strategy and risks.

Independence is substantive, not merely formal. A director may satisfy a listing definition while remaining psychologically or economically dependent on a dominant founder. Boards should periodically assess both individual contribution and collective effectiveness.

3.2 Board Leadership and Committees

Separating the chair and chief executive roles can strengthen oversight by preventing excessive concentration of authority. Some companies combine the roles, but this requires strong independent directors, a lead independent director and clear counterbalances.

Common committees include:

• Audit committee: financial reporting, external and internal audit, internal controls and whistleblowing arrangements;
• Nomination or governance committee: board succession, composition, evaluation and governance policies;
• Remuneration committee: executive pay, performance measures and incentives;
• Risk or sustainability committee: enterprise risk, climate exposure, cyber risk and material social impacts.

Committees support detailed work but do not remove responsibility from the full board. Delegation is not abdication.

3.3 Board Processes

A high-quality board process includes a timely agenda, concise and reliable papers, access to independent advice, executive sessions without management, recorded dissent, conflict-of-interest procedures and follow-up of agreed actions. Board evaluation should examine whether directors receive bad news promptly, whether challenge changes decisions and whether the board understands critical operational risks.

A board that receives extensive information may still be poorly informed. Information quality depends on relevance, independence, comparability, timeliness and the willingness of management to disclose uncertainty. Directors should ask not only “What is the forecast?” but also “What assumptions support it, what could invalidate it and who has challenged it?”

4. Ownership, Control and Accountability

Ownership structures shape governance risks. In widely held companies, the principal problem is often manager–shareholder conflict. In family-controlled, state-owned or founder-controlled companies, the central issue may be conflict between controlling and minority shareholders.

A controlling shareholder can provide monitoring, patient capital and strategic continuity. Conversely, control can facilitate related-party transactions, preferential treatment, tunnelling of assets or appointment of unqualified insiders. Minority shareholders require voting rights, equitable treatment, access to information and remedies for oppression or unfair prejudice.

Institutional investors can improve oversight through engagement, voting and dialogue. Passive investment strategies, however, may weaken monitoring unless investors use stewardship policies and collaborate responsibly. Dual-class shares may protect founders’ long-term vision but can also create unequal voting power and weaken accountability.

Accountability operates vertically and horizontally. Shareholders hold directors accountable through elections and resolutions; directors hold executives accountable through appointment, evaluation and dismissal; regulators enforce legal standards; auditors provide assurance; employees and other stakeholders may use reporting channels, collective action and public scrutiny.

5. Fiduciary Duties and Ethical Judgment

Fiduciary duties arise when directors and officers are entrusted with power over another entity’s interests. Their precise legal content varies by jurisdiction, but commonly includes duties of care, loyalty, good faith, proper purpose and confidentiality.

The duty of care requires directors to act with the diligence, skill and attention reasonably expected in the circumstances. It does not require perfect decisions or protection from commercial failure. Courts often distinguish a reasonable, informed decision that produced a bad result from a decision made without adequate information.

The duty of loyalty requires directors to put the company’s interests ahead of personal interests in matters covered by the fiduciary relationship. Conflicts must be disclosed and managed. A director should not exploit a corporate opportunity, misuse confidential information or accept an improper benefit.

The business judgment rule, where recognized, gives directors protection from judicial second-guessing when they act in good faith, without disabling conflicts, on an informed basis and for a proper purpose. It is not a defence for fraud, bad faith, gross negligence or undisclosed self-dealing.

Ethical governance goes beyond legal minimums. A transaction may be technically lawful yet ethically unacceptable if it exploits information asymmetry, harms vulnerable parties or undermines trust. Boards should use ethical questions alongside legal analysis:

1. Who benefits and who bears the risk?
2. Would the decision withstand transparent public explanation?
3. Is the conduct consistent with the organization’s stated values?
4. Are affected stakeholders able to give meaningful consent or obtain remedy?
5. Does the decision protect long-term legitimacy?

6. Executive Compensation and Incentive Design

Executive compensation should attract capable leaders, reward sustainable performance and discourage manipulation. Typical components include salary, annual bonuses, long-term equity, benefits and severance arrangements.

A sound compensation system aligns rewards with measures that executives can influence and that reflect durable value. Metrics may include risk-adjusted financial performance, cash generation, customer retention, safety, compliance and strategic milestones. Measures should be balanced because any single metric can be gamed.

Important design principles include:

• Avoiding rewards for revenue growth that destroys margins or creates excessive risk;
• Using multi-year performance periods where outcomes take time to emerge;
• Including malus provisions that reduce unpaid awards when performance deteriorates;
• Including clawback provisions where awards were based on materially misstated results or serious misconduct;
• Linking remuneration to risk, culture and compliance rather than only share price;
• Disclosing pay philosophy and performance criteria clearly.

Relative total shareholder return can be useful for comparison, but share price is affected by market conditions beyond managerial control. Conversely, accounting measures may be influenced by classification choices and timing. Compensation committees should therefore use multiple measures and exercise documented judgment.

7. Audit, Internal Control and Risk Management

7.1 External and Internal Audit

External auditors provide independent assurance on whether financial statements are prepared, in all material respects, in accordance with the applicable reporting framework. An audit provides reasonable assurance, not absolute assurance. Auditors use risk assessment, sampling, analytical procedures, tests of controls and substantive procedures; they do not examine every transaction.

Internal audit is an independent assurance and advisory function that evaluates governance, risk management and controls. It should have sufficient authority, access to the audit committee and freedom from operational conflicts.

Auditor independence may be threatened by financial dependence, long tenure, personal relationships, advocacy services or excessive non-audit fees. Audit committees should oversee appointment, scope, rotation requirements where applicable, independence and communication of significant judgments.

7.2 Internal Control

Internal control is a process designed to provide reasonable assurance regarding effective operations, reliable reporting and compliance with laws and policies. Widely used control frameworks organize controls around the control environment, risk assessment, control activities, information and communication, and monitoring.

Examples include segregation of duties, authorization limits, reconciliations, access controls, physical safeguards, exception reporting, mandatory leave, independent review and documented policies. Controls must be proportionate to risk. A small organization cannot reproduce the control architecture of a multinational bank, but it still needs compensating controls when duties cannot be separated.

Internal control has inherent limitations. Human error, collusion, management override, cost constraints and rapidly changing conditions may defeat a well-designed system. A signed policy is not evidence that a control operates effectively.

7.3 Risk Governance

The board should approve risk appetite, identify principal risks, monitor risk capacity and ensure that management responds appropriately. Risk appetite describes the amount and type of risk the organization is willing to accept in pursuit of objectives. It should be translated into limits, indicators and escalation thresholds.

A useful governance distinction is:

• Inherent risk: exposure before controls;
• Residual risk: exposure remaining after controls;
• Risk capacity: maximum risk the organization can absorb without threatening viability;
• Risk appetite: level of risk the organization chooses to accept.

Risk registers are useful but insufficient. Boards should also examine scenarios, stress tests, near misses, emerging risks and dependencies such as critical suppliers, cloud providers and key personnel.

8. Transparency, Disclosure and Whistleblowing

Transparency enables investors and stakeholders to evaluate performance, risk and conduct. High-quality disclosure is accurate, complete, timely, understandable and decision-useful. It should distinguish facts from estimates and disclose material assumptions, uncertainty, related-party transactions, remuneration, control weaknesses and significant changes in risk.

Selective disclosure, misleading sustainability claims and overly optimistic forecasts damage market integrity. The growing use of non-financial metrics creates additional challenges because definitions may differ across organizations. Companies should establish data ownership, controls, methodological explanations and assurance processes for material environmental and social information.

Whistleblowing systems are an essential accountability mechanism. An effective system offers confidential or anonymous reporting where legally permitted, protection against retaliation, independent investigation, escalation of serious allegations and feedback to the reporter. It should not be treated as a substitute for an ethical culture. Employees must believe that raising concerns will produce fair action rather than career damage.

9. Governance Failure: An Illustrative Case

Background

The following is a fictional illustrative case. Meridian Components, a rapidly growing industrial manufacturer, was controlled by its founder, who served as executive chair. The board included several long-serving personal associates. Revenue increased substantially over four years, and executives received large bonuses based primarily on sales growth and reported earnings.

Problem

An internal audit manager discovered that distributors were receiving generous return rights and channel financing. Products had been shipped before customers were ready to accept them, while returns and credit losses were recorded later. The manager reported the issue to the chief financial officer, who dismissed it as a timing matter. The audit committee received summary reports but not the underlying analysis.

At the same time, the company entered into a property transaction with an entity partly owned by the founder’s family. The transaction was approved without a documented independent valuation. The board did not disclose the relationship clearly in its annual report.

Analysis

The case illustrates several interacting failures:

1. Agency and control failure: executive incentives rewarded volume and short-term earnings rather than sustainable cash generation.
2. Board independence failure: personal relationships reduced effective challenge.
3. Audit failure: the audit committee did not obtain direct access to internal audit evidence or investigate unusual sales practices.
4. Conflict-of-interest failure: a related-party transaction was not subjected to independent review.
5. Culture failure: the internal auditor perceived that escalation would harm his career.
6. Disclosure failure: investors were not given a clear account of revenue-recognition risks and the family transaction.

The problem was not simply an individual’s misconduct. It was a system in which incentives, information flows, board composition and culture reinforced one another.

Approach and Solution

The company should first preserve records, investigate independently and protect whistleblowers. It should restate financial information if required, cooperate with regulators and communicate material facts without minimizing them. The board should appoint independent directors with relevant financial and industry expertise, separate the chair and chief executive roles, and establish a genuinely independent audit committee.

Compensation should be redesigned around cash conversion, customer acceptance, multi-year performance and compliance gates. Related-party transactions should require independent review, recusal and transparent disclosure. Internal audit should report functionally to the audit committee, while external auditors should reassess management representations and revenue risks.

Outcome and Learning Points

Assume that Meridian restored confidence only after acknowledging the problem, compensating affected customers, changing leadership and demonstrating improved controls over several reporting cycles. The principal lesson is that governance effectiveness depends on interactions among structures, incentives, information and culture. A board may satisfy formal independence requirements yet fail if it lacks curiosity and courage. A control may exist on paper yet fail if employees cannot escalate concerns.

10. Contemporary Governance Challenges

Sustainability and Climate Risk

Climate change, biodiversity loss, labour conditions and human-rights impacts may create financial, legal and reputational risks. Boards should consider material sustainability issues in strategy, capital allocation, supply-chain management and disclosure rather than treating them as separate public-relations activities. The correct approach depends on the organization’s industry, jurisdiction and materiality assessment.

Cybersecurity and Data Governance

Cyber incidents can disrupt operations, expose personal information and undermine financial reporting. Board oversight should include accountability for cyber risk, incident-response planning, access management, resilience testing, third-party risk and timely escalation. Directors need not become cybersecurity engineers, but they must understand the organization’s critical assets, dependencies and recovery capabilities.

Artificial Intelligence

AI systems can create governance risks through biased decisions, opaque recommendations, data misuse, cybersecurity vulnerabilities and uncontrolled automation. Boards should require clear ownership, documented use cases, data-quality controls, human oversight, model validation, monitoring for drift and procedures for contesting consequential decisions. Generative AI also creates risks involving confidential information, fabricated outputs and intellectual-property claims.

Global and Group Governance

Multinational groups face complex accountability because decisions may be distributed across subsidiaries, joint ventures, contractors and service providers. Parent boards should understand where legal liability, operational control and reputational exposure reside. “We did not know” is rarely a satisfactory governance response when oversight systems were inadequate.

11. An Integrated Governance Assessment Framework

Managers and directors can assess governance through six questions:

1. Purpose: Is the organization’s purpose clear and consistent with its obligations?
2. Authority: Are decision rights, delegations and escalation routes clear?
3. Capability: Does the board possess the expertise, independence and diversity required?
4. Information: Do decision-makers receive timely, reliable and sufficiently challenging information?
5. Incentives: Do remuneration and promotion systems reward ethical, sustainable performance?
6. Assurance and remedy: Are controls, audits, investigations and corrective actions credible?

Assessment should combine documentary review with interviews, observation of meetings, data analysis, employee surveys, control testing and examination of incidents. Governance cannot be evaluated solely through the absence of regulatory penalties. A company may be legally compliant yet strategically fragile or ethically compromised.

Best-Practice Principles

A practical governance system should:

• Establish a clear purpose and ethical expectations;
• Maintain a capable, diverse and appropriately independent board;
• Separate oversight from operational management while encouraging informed advice;
• Provide directors with reliable information and independent assurance;
• Align executive incentives with long-term, risk-adjusted performance;
• Identify and manage conflicts of interest;
• Protect whistleblowers and investigate concerns impartially;
• Integrate financial, operational, cyber, sustainability and conduct risks;
• Disclose material information accurately and promptly;
• Review governance effectiveness after crises, major transactions and strategic change.

Chapter Summary

Corporate governance is the system through which organizations are directed, controlled and held accountable. Agency theory emphasizes monitoring and incentive alignment; stewardship theory highlights trust, commitment and managerial responsibility; stakeholder theory broadens accountability beyond shareholders; resource-dependence theory explains the board’s contribution of expertise and legitimacy.

Effective boards combine independence, competence, diversity, constructive challenge and disciplined processes. Ownership concentration can strengthen monitoring but may expose minority investors to expropriation. Fiduciary duties require care, loyalty, good faith, proper purpose and responsible conflict management. Executive compensation should encourage sustainable performance rather than short-term manipulation.

Audit, internal control and risk management provide reasonable—not absolute—assurance. Transparency and whistleblowing enable accountability, but formal mechanisms fail when culture discourages challenge. Governance failures usually arise from interacting weaknesses in incentives, information, board oversight and ethical climate. Contemporary governance must also address sustainability, cybersecurity, data and artificial intelligence. The strategic test of governance is whether it supports responsible decisions, resilient performance and legitimate long-term value creation.

Key Terms

Agency theory: A theory focused on conflicts between principals and agents, especially shareholders and managers.

Board of directors: The body responsible for strategic oversight, supervision and accountability of the company.

Business judgment rule: A legal principle that may protect informed, good-faith board decisions from hindsight-based judicial review.

Control environment: The organizational culture, leadership conduct, structures and expectations that shape internal control.

Duty of care: The obligation to act with appropriate diligence, skill and attention.

Duty of loyalty: The obligation to place the company’s interests ahead of conflicting personal interests.

Fiduciary duty: A duty arising from entrusted power to act faithfully for another’s legitimate interests.

Internal audit: An independent function that evaluates governance, risk management and controls.

Internal control: Processes designed to provide reasonable assurance over operations, reporting and compliance.

Material information: Information that could reasonably influence the decisions of users of corporate reports.

Residual risk: Risk remaining after controls have been applied.

Risk appetite: The level and type of risk an organization chooses to accept.

Shareholder activism: Efforts by shareholders to influence corporate strategy, governance or management.

Stakeholder theory: The view that corporate accountability extends to groups affected by and contributing to the firm.

Stewardship theory: The view that managers can act as responsible stewards of organizational resources.

Transparency: The provision of accurate, timely, understandable and decision-useful information.

Whistleblowing: Reporting suspected wrongdoing through internal or external channels.

Related-party transaction: A transaction involving the company and a person or entity connected to its directors, executives or controlling owners.

Review Questions

Short Answer Questions

1. What is corporate governance, and why is it strategically important?
2. Distinguish agency theory from stewardship theory.
3. What are the principal responsibilities of an audit committee?
4. Explain the difference between inherent risk and residual risk.
5. Why is board independence a substantive rather than merely formal concept?

Long Answer Questions

1. Compare agency, stewardship and stakeholder theories and evaluate how each contributes to governance design.
2. Discuss the characteristics of an effective board, including composition, leadership, committees and processes.
3. Explain how executive compensation can create either alignment or governance failure.
4. Analyse the relationship among external audit, internal audit, internal control and risk management.
5. Discuss fiduciary duties and explain why ethical governance extends beyond legal compliance.

Analytical / Application Questions

1. A founder-controlled company has strong growth but a board composed largely of the founder’s former colleagues. Identify the governance risks and recommend reforms.
2. A company’s bonus plan rewards annual revenue growth, while customer returns and warranty claims rise sharply. Analyse the incentive problem and design a more balanced compensation system.
3. A whistleblower alleges that an AI system denies credit disproportionately to a protected group. As a board member, what governance, ethical, control and disclosure actions should you require?

Multiple Choice Questions with Answers

Question 1

Which theory primarily focuses on conflicts arising from the separation of ownership and management?

A. Agency theory

B. Stewardship theory

C. Institutional theory

D. Stakeholder theory

Correct Answer: A. Agency theory

Question 2

Which statement best describes the duty of loyalty?

A. Directors must guarantee that every strategic decision succeeds.

B. Directors must place the company’s interests ahead of conflicting personal interests.

C. Directors must maximize annual revenue regardless of risk.

D. Directors must avoid all decisions involving uncertainty.

Correct Answer: B. Directors must place the company’s interests ahead of conflicting personal interests.

Question 3

What is the principal purpose of an audit committee?

A. To manage daily production schedules

B. To negotiate employee salaries

C. To oversee financial reporting, audit and internal controls

D. To replace the chief executive in operational decisions

Correct Answer: C. To oversee financial reporting, audit and internal controls

Question 4

Which situation most clearly represents residual risk?

A. A threat identified before any controls are designed

B. The maximum risk an organization can absorb

C. The risk deliberately included in a strategic plan

D. The exposure remaining after controls are applied

Correct Answer: D. The exposure remaining after controls are applied

Question 5

Why can a compensation plan based only on revenue growth create governance problems?

A. It may reward sales that are unprofitable, risky or difficult to collect.

B. It prevents executives from receiving any compensation.

C. It makes financial reporting unnecessary.

D. It guarantees that customers will be satisfied.

Correct Answer: A. It may reward sales that are unprofitable, risky or difficult to collect.

Question 6

Which feature is most important for an effective whistleblowing system?

A. A requirement that complaints be approved by the alleged wrongdoer

B. Protection against retaliation and independent investigation

C. Publication of every complaint before investigation

D. Limiting reports to financial issues only

Correct Answer: B. Protection against retaliation and independent investigation

Question 7

What does stakeholder theory add to a narrow shareholder-centred view of governance?

A. It eliminates the need for board oversight.

B. It treats financial performance as irrelevant.

C. It recognizes responsibilities to groups affected by and contributing to the firm.

D. It requires every stakeholder to receive identical benefits.

Correct Answer: C. It recognizes responsibilities to groups affected by and contributing to the firm.

Question 8

Which statement about external financial statement audits is correct?

A. They provide absolute assurance that fraud does not exist.

B. They examine every transaction without sampling.

C. They replace the board’s responsibility for financial reporting.

D. They provide reasonable assurance within the applicable reporting framework.

Correct Answer: D. They provide reasonable assurance within the applicable reporting framework.

Question 9

A related-party transaction is most appropriately governed by which combination?

A. Disclosure, independent review and recusal where appropriate

B. Automatic approval by the related director

C. Confidential approval without documentation

D. Exclusion from all financial records

Correct Answer: A. Disclosure, independent review and recusal where appropriate

Question 10

Which governance response is most appropriate for a high-impact AI system?

A. Allow deployment without monitoring if it reduces costs.

B. Rely only on the system vendor’s assurances.

C. Establish ownership, human oversight, validation and monitoring for bias and drift.

D. Prohibit all use of data in organizational decisions.

Correct Answer: C. Establish ownership, human oversight, validation and monitoring for bias and drift.