Act as a Senior Finance Manager: evaluate strategic choices, interpret business conditions, recommend finance, manage risk and challenge controls. This guide combines 20 original written tasks with model responses and rubrics, plus 60 worked concepts connecting technical mechanisms to commercial decisions. Each task is self-contained; suggested times are practice allowances. The five domains retain their published names, with four tasks each; concept allocations are 13, 15, 10, 12 and 10. Coverage follows blueprint version 1, published 6 May 2025, applicable to the May, August and November 2026 and February 2027 case studies. It establishes no later version. Source s1 supports scope and format; technical explanations apply established subject knowledge.
What this guide covers
Practise CIMA SCS written decisions with 20 original tasks, model answers and 60 technical study concepts.
Develop business strategy
1. Suitability, acceptability and feasibility
Suitability asks whether an option addresses the organisation's strategic position and objectives. Acceptability examines expected returns, risk and stakeholder reactions. Feasibility tests whether finance, capabilities, people and operating capacity can deliver the option. These tests interact: an attractive market opportunity can fail because implementation consumes scarce expertise, while a feasible project can still lack strategic purpose. Apply them to competing options using explicit evidence and unresolved assumptions. Avoid treating them as a mechanical scorecard in which strong performance on one dimension automatically compensates for a critical failure elsewhere.
Worked example: A manufacturer considers remote maintenance subscriptions. Existing customers make the option suitable, but willingness to pay remains uncertain. Available funding supports feasibility, while a shortage of diagnostic engineers supports piloting with a limited customer group before expansion.
Common mistake: Assuming that available funding proves feasibility overlooks operational capabilities, while positive forecast profits do not establish stakeholder acceptability.
Official syllabus reference: [1]
2. Ansoff growth directions and capability gaps
Ansoff's matrix distinguishes market penetration, market development, product development and diversification through existing or new products and markets. Its value is identifying what the organisation must learn or acquire, rather than assigning an automatic risk ranking. Market development may require distribution and regulatory capabilities; product development may require technology and support expertise. Diversification changes both dimensions and can compound unfamiliarity, although related capabilities may reduce that challenge. Use the classification to expose assumptions about customers, channels, resources and competitive advantage before recommending a specific growth route.
Worked example: A sensor company sells its established devices to food processors for the first time. This is market development if the product remains materially unchanged. Finance tests distributor economics, customer qualification requirements and the cost of adapting sales support.
Common mistake: Calling every new revenue stream diversification hides whether the actual uncertainty concerns the product, the market or both.
Official syllabus reference: [1]
3. Competitive advantage through cost or differentiation
Porter's generic strategies explain advantage through a lower cost position or differentiation valued by customers, applied broadly or within a focused segment. Cost leadership concerns the underlying economics of delivering value, not simply charging low prices. Differentiation succeeds when customers' willingness to pay exceeds its additional cost. Strategic coherence matters because activities, skills and incentives must support the chosen proposition. Mixed features are possible, but an organisation should explain how they reinforce its advantage rather than assume that premium service and the lowest prices can coexist without trade-offs.
Worked example: A monitoring provider promises rapid specialist repairs and charges a premium. Maintaining regional engineers increases cost, so finance compares the premium and retention benefits with service expenditure. Cutting engineer coverage could damage the very differentiation supporting its margin.
Common mistake: Equating low selling prices with cost leadership confuses a pricing decision with the sustainable cost position needed to support it.
Official syllabus reference: [1]
4. Incremental cash flows and opportunity costs
Investment appraisal measures cash flows that change because the decision is taken. Include additional operating cash flows, tax effects, working capital, capital expenditure and displaced contributions. Exclude sunk expenditure because the current decision cannot recover it. Include opportunity costs when a resource has an alternative use, even if no new accounting expense appears. Discount cash flows consistently with their currency, inflation treatment and risk. Allocated overhead is relevant only to the extent that total cash expenditure changes. This approach prevents accounting labels from obscuring the economic consequences of strategic choices.
Worked example: A project uses a warehouse that could otherwise earn CU200,000 annual rental income. That forgone rent belongs in the appraisal. CU80,000 already spent investigating the project is sunk, while additional security expenditure is relevant if approval causes it.
Common mistake: Excluding an owned asset because it requires no purchase ignores the value sacrificed when another profitable use becomes unavailable.
Official syllabus reference: [1]
5. Real options and staged investment
A real option is managerial flexibility to change an investment as uncertainty resolves, such as delaying, expanding, abandoning or switching use. Staging can limit irreversible exposure while purchasing useful information. The option has value only if management can act on that information and the future choice remains available. Waiting also has costs, including lost cash flows, competitive entry and expiring rights. Assess the initial commitment, information expected, subsequent decisions and competitive consequences. Do not add a vague flexibility premium to valuation without specifying the decisions and cash-flow effects that create it.
Worked example: A company spends CU300,000 testing a service in one region before committing CU8 million nationally. The pilot is valuable if paid renewals and support costs inform a genuine expansion or abandonment choice before the larger expenditure becomes unavoidable.
Common mistake: Describing every small launch as a real option overlooks whether it generates decision-relevant information and preserves a meaningful future choice.
Official syllabus reference: [1]
6. Acquisition synergies and the buyer's price ceiling
An acquisition creates buyer value when the value obtained exceeds total consideration and implementation costs. Start with a consistent standalone valuation, add achievable incremental synergies and deduct integration expenditure and other transaction effects. Synergies may arise from costs, revenues, capabilities or financing, but overlapping benefits must not be counted twice. Their timing, tax treatment and execution risk matter. The resulting buyer value is a negotiation boundary, not a price that must be paid. Paying all estimated synergy value to the seller leaves the buyer exposed to downside without retaining expected acquisition gains.
Worked example: Standalone equity is worth CU50 million, synergy present value is CU14 million and integration costs are CU6 million. Buyer value is CU58 million before other adjustments. A CU55 million price retains CU3 million expected value, subject to execution assumptions.
Common mistake: Adding headline synergies to the offer without integration costs and delivery risk can turn an attractive target into a value-destroying purchase.
Official syllabus reference: [1]
7. Due diligence as hypothesis testing
Due diligence tests the investment thesis and identifies liabilities, valuation adjustments and implementation constraints. Financial work examines earnings quality, cash conversion and debt-like obligations. Commercial work tests customers, competition and sustainable demand. Operational, technology, people and legal reviews examine whether critical assets and capabilities transfer as assumed. Prioritise issues capable of changing price, structure or the decision itself. Findings may support warranties, indemnities, conditions or revised integration plans, but contractual protection depends on enforceability and the seller's ability to meet claims. Diligence reduces information gaps rather than guaranteeing acquisition success.
Worked example: A target's forecast assumes all major contracts continue after acquisition. Diligence discovers change-of-control consent clauses in two large accounts. The buyer revises valuation scenarios and requires consent before completion rather than relying solely on a warranty.
Common mistake: Treating due diligence as confirmation of a chosen deal discourages investigation of evidence that could invalidate the acquisition thesis.
Official syllabus reference: [1]
8. Divestment value and stranded costs
A divestment should be assessed against retaining, improving or closing the business. Sale proceeds are only one component: consider tax, separation expenditure, lost synergies, continuing obligations and effects on the remaining organisation. Stranded costs are expenses that remain after the sold operation no longer contributes toward them. Allocated accounting overhead does not automatically disappear. A carve-out may need standalone systems, staff and transitional services before it is saleable. Evaluate the buyer's ability to complete and the credibility of the post-sale operating model, not simply whether the disposal improves reported group margins.
Worked example: A division earns CU4 million before CU3 million allocated head-office costs. Selling it will eliminate only CU1 million of those costs. The retained group therefore loses CU3 million annual contribution before considering proceeds, separation costs and alternative uses of management capacity.
Common mistake: Assuming every allocated cost disappears after disposal overstates the improvement in the remaining group's earnings and cash generation.
Official syllabus reference: [1]
9. Build, buy or ally for strategic capabilities
Building develops capability internally, buying acquires it through ownership, and alliances access it through cooperation. Compare speed, strategic control, knowledge transfer, capital commitment and execution risk. Internal development can protect learning but delay entry. Acquisition can accelerate access but introduces valuation and integration risk. Alliances preserve flexibility yet require incentive alignment, information boundaries and workable exit arrangements. The preferred route depends on whether the capability is central to differentiation and whether its knowledge can be transferred. Evaluate total lifecycle dependence and organisational capacity rather than comparing upfront costs alone.
Worked example: A manufacturer needs predictive analytics quickly. It partners for basic infrastructure while developing proprietary diagnostic rules internally. The contract provides data portability and defined service obligations, allowing speed without transferring control of the knowledge that supports its competitive advantage.
Common mistake: Choosing partnership solely because it is initially cheaper ignores future dependency, bargaining power and the difficulty of transferring accumulated knowledge.
Official syllabus reference: [1]
10. Platform economics and network effects
A platform facilitates interactions between participant groups, such as equipment owners and maintenance providers. Cross-side network effects occur when participation on one side increases value for another; same-side effects may be positive or negative. Growth alone does not establish a network effect. Platform strategy must solve initial participation, pricing, trust and governance problems while balancing openness against control. Multi-homing and low switching costs can weaken value capture even when activity grows. Evaluate contribution after participant incentives, dispute costs and infrastructure expenditure, and examine who owns the customer relationship and transaction data.
Worked example: A maintenance marketplace attracts equipment owners by offering access to more qualified engineers. Engineers join because more owners create paid work. Finance tests whether subsidies can decline as matching improves, while tracking repeat transactions that migrate outside the platform.
Common mistake: Calling any expanding digital service a network business confuses increasing sales with participant-driven improvements in value and defensibility.
Official syllabus reference: [1]
11. AI investment economics and model drift
AI investment value depends on improved decisions or processes after the costs of data preparation, integration, operation and oversight. Model accuracy is not itself a financial benefit: error types have different commercial consequences. False alarms may create unnecessary service visits, while missed faults may cause downtime. Model drift occurs when changing equipment, behaviour or data relationships reduce performance after deployment. Evaluate representative validation, human escalation, ongoing maintenance and the availability of usable data. Strategic advantage is more defensible when AI combines with proprietary knowledge and workflows than when competitors can purchase an equivalent model.
Worked example: An AI fault predictor reduces missed failures but doubles false alarms. Finance compares avoided downtime with additional call-out costs using actual customer cohorts. A pilot includes newer equipment models because performance on historical machines may not generalise to the growing installed base.
Common mistake: Treating a high overall accuracy score as proof of value ignores unequal error costs, changing data and implementation expenditure.
Official syllabus reference: [1]
12. Circular models and lifecycle economics
Circular models retain product and material value through maintenance, reuse, refurbishment or recovery. Their economics depend on collection rates, reverse logistics, condition variability and viable secondary demand. Retaining asset ownership can support repair incentives but increases capital needs and residual-value exposure. Environmental benefits require lifecycle comparison using a consistent functional unit, including production, transport, use and end-of-life effects. Longer life is not automatically better if operation is highly inefficient. Assess cash generation and physical impacts separately, then examine trade-offs rather than treating circularity as conclusive evidence of profitability or sustainability.
Worked example: A provider refurbishes returned pumps and sells operating availability. Finance models collection costs, refurbishment yield and repeat service revenue. Environmental analysis compares emissions per reliable pumping hour with replacement equipment, including any energy-efficiency difference during customers' use.
Common mistake: Assuming refurbishment always reduces environmental impact overlooks transport, failed returns and the operating efficiency of newer alternative equipment.
Official syllabus reference: [1]
13. Change adoption and benefits realisation
Strategic implementation requires people to adopt new behaviours, not merely receive new systems. Kotter's change model highlights urgency, a guiding coalition, vision, mobilisation, removing barriers, short-term wins and embedding change. Use these ideas diagnostically rather than as a rigid sequence that guarantees success. Link implementation outputs to operational changes and then measurable benefits, assigning business owners for each connection. Training completion and system installation are intermediate outputs. Benefits arise only when workflows, incentives and customer outcomes change sufficiently to produce the intended financial or strategic result.
Worked example: A service platform launches on schedule, but engineers continue using spreadsheets. Management changes dispatch incentives, appoints respected engineers as champions and removes duplicate reporting. Benefits are then tested through response times and first-time fixes rather than software installation dates alone.
Common mistake: Declaring success at technical go-live confuses delivery of an asset with the behavioural changes required to realise strategic benefits.
Official syllabus reference: [1]
Evaluate business ecosystem and business environment
14. PESTEL and causal environmental analysis
PESTEL examines political, economic, social, technological, environmental and legal influences outside the organisation. Its purpose is to trace material developments into demand, costs, access, financing or risk, not to produce six unrelated lists. Separate observed changes from uncertain proposals and specify time horizons. The same development may create opportunities and threats for different business segments. Prioritise factors by their strategic consequences and uncertainty, then identify indicators that would change the response. PESTEL describes the wider environment; industry structure and internal capability analysis are needed to complete the strategic diagnosis.
Worked example: Proposed energy-efficiency rules may increase demand for monitoring systems while raising testing costs. Finance distinguishes confirmed requirements from consultation proposals, estimates affected customer segments and identifies which product developments remain worthwhile even if implementation dates change.
Common mistake: Listing inflation, technology and regulation without explaining their business transmission mechanisms produces description rather than a useful strategic analysis.
Official syllabus reference: [1]
15. Five Forces and industry value capture
Porter's Five Forces examines rivalry, entry threats, substitutes, buyer power and supplier power to explain pressure on industry returns. Analyse the economic mechanisms: switching costs, concentration, differentiation, capacity, access and alternative solutions. A substitute performs the customer's underlying function differently; a rival competes within the defined industry. Define that industry carefully because boundaries affect conclusions. Strong demand growth does not guarantee attractive margins if powerful participants capture the benefits. Use the analysis to identify strategic responses and likely profit distribution, while recognising that cooperation and ecosystem complementors may require additional tools.
Worked example: Customers replace standalone inspection devices with analytics embedded in existing machinery. This can be substitution rather than ordinary device rivalry. If a few machinery manufacturers control access to operating data, their bargaining power may also constrain independent diagnostic providers.
Common mistake: Treating all new competitors as substitutes obscures whether the threat comes from industry rivalry, easier entry or a different customer solution.
Official syllabus reference: [1]
16. VRIO and sustainable capability advantage
VRIO tests whether a resource or capability is valuable, rare, costly to imitate and supported by the organisation. Value connects it to customer needs or efficiency; rarity compares it with competitors. Imitation barriers may arise from accumulated experience, social relationships or causal ambiguity. Organisational support includes systems, incentives and decision rights that capture the benefit. Ownership alone does not establish advantage, and an isolated resource may be less important than a coordinated capability. Reassess VRIO when technology or customer expectations change because a previously valuable strength can become irrelevant.
Worked example: A service network has decades of failure data and engineers who interpret it effectively. The database alone may be replicable, but its combination with trusted customer relationships and dispatch routines may be harder to copy and economically valuable.
Common mistake: Describing an expensive asset as strategically valuable ignores whether it improves customer outcomes and whether competitors can obtain the same capability.
Official syllabus reference: [1]
17. Value-chain linkages and margin drivers
Value-chain analysis examines how primary and support activities create customer value and incur cost. Competitive advantage often arises from linkages, such as product design reducing installation time or better procurement improving reliability. Analyse the full effect of changing an activity, including downstream costs and customer consequences. A locally cheaper process may increase total system cost. Compare activities with competitors or external providers where evidence permits, but preserve capabilities central to differentiation. The tool supports decisions about redesign, outsourcing and investment by explaining why costs arise and where customers perceive benefits.
Worked example: Procurement selects a cheaper component, saving CU5 per unit. Installation failures then require additional field visits averaging CU12 per unit sold. Value-chain analysis reveals that the purchasing saving reduces overall margin and customer reliability despite improving procurement's reported target.
Common mistake: Optimising each department's cost independently can damage total value because activities interact and transfer consequences across organisational boundaries.
Official syllabus reference: [1]
18. Complementors, bottlenecks and ecosystem dependence
A business ecosystem includes organisations whose interconnected contributions shape the customer proposition, including complementors, platforms, distributors and infrastructure providers. Complementors increase the value of an offering when used together, but may also control access or capture margin. Identify bottlenecks such as proprietary interfaces, essential data or scarce technical certification. Examine dependency, substitution options and the consequences of a partner changing terms. Ecosystem analysis extends beyond direct competition because value creation and value capture may occur across organisational boundaries. Responses include interoperability, alternative partnerships, shared standards or selective ownership of critical capabilities.
Worked example: A diagnostics provider improves its service through a cloud platform, but the platform controls customer authentication. Finance assesses the effect of higher access fees and develops a second integration route before the provider becomes commercially dependent on one gateway.
Common mistake: Assuming a partner is permanently cooperative overlooks how control of an essential interface can later shift bargaining power and profits.
Official syllabus reference: [1]
19. Mendelow's power-interest stakeholder mapping
Mendelow's matrix considers stakeholder power and interest to guide engagement intensity. High-power, high-interest parties generally require close engagement; other groups need communication suited to their influence and concerns. Power may come from contracts, resources, expertise, collective action or reputation rather than formal authority alone. Positions change as issues develop, so mapping should be revisited. The matrix helps allocate attention but does not determine whose interests are ethically legitimate. Combine it with analysis of rights, impacts and dependencies, and explain how engagement changes the strategic decision or its implementation.
Worked example: Residents initially show little interest in a factory extension. Once delivery routes are published, their concern grows and coordinated media activity increases influence. Management revises engagement and traffic design instead of relying on the group's original low-power classification.
Common mistake: Treating the stakeholder map as permanent ignores issue-driven changes in interest, alliances and the sources of practical influence.
Official syllabus reference: [1]
20. Stakeholder salience and legitimate trade-offs
Stakeholder salience considers power, legitimacy and urgency when assessing which claims demand management attention. It complements power-interest mapping by recognising that a weak group can hold a legitimate, time-sensitive claim. Strategic decisions often involve incompatible interests, such as affordability, returns, employment and environmental protection. Identify the actual impacts, possible mitigation and decision principles rather than promising universal satisfaction. Engagement should improve information and reveal alternatives, while the board remains accountable for the choice. Document material unresolved trade-offs and explain why the chosen course is consistent with organisational purpose and obligations.
Worked example: Closing an inefficient site improves cash flow but harms a town dependent on its jobs. Management evaluates phased closure, retraining and alternative investment. The community's limited negotiating power does not remove the legitimacy of its concerns or their relevance to the decision.
Common mistake: Prioritising only powerful stakeholders mistakes influence for legitimacy and can overlook serious impacts that later become strategic or reputational problems.
Official syllabus reference: [1]
21. Financial and sustainability objective trade-offs
Strategic objectives translate purpose into desired financial, operational and sustainability outcomes. They should be specific enough to guide choices while recognising trade-offs and constraints. Profit, cash generation and growth measure different things; emissions intensity and absolute emissions also answer different questions. Define baselines, boundaries, time horizons and accountable owners. Some objectives act as constraints, while others describe outcomes to optimise. Avoid combining unlike measures into a single score without explaining the weighting and consequences. Evaluate whether the portfolio of objectives encourages sustainable value creation rather than shifting costs or impacts outside the measurement boundary.
Worked example: A company targets lower emissions per service visit and higher total service revenue. Better route planning improves intensity, but rapid expansion raises total emissions. The board therefore reviews both absolute emissions and intensity alongside contribution and customer coverage.
Common mistake: Assuming an improving intensity ratio proves lower total environmental impact overlooks the effect of rising output or activity.
Official syllabus reference: [1]
22. Balanced Scorecard cause-and-effect hypotheses
The Balanced Scorecard links financial, customer, internal-process and learning-and-growth perspectives to strategy. Its strength is the proposed causal chain: capability improvements support processes, which improve customer outcomes and ultimately financial performance. These links are hypotheses requiring evidence, not guaranteed relationships. Select a small set of measures that represent the specific strategy and include both outcomes and drivers. Targets should be consistent across perspectives so that one function is not rewarded for harming another. Adapt the scorecard where sustainability or stakeholder objectives require explicit representation, while preserving a clear explanation of value creation.
Worked example: Engineer training is expected to improve first-time fixes, reduce customer downtime and increase renewals. Management measures each link. If training rises but fixes do not improve, it investigates course relevance and dispatch practices rather than declaring success from attendance alone.
Common mistake: Placing unrelated measures into four boxes creates a dashboard, but does not establish the strategic relationships that make a scorecard useful.
Official syllabus reference: [1]
23. Leading indicators, denominators and gaming
Leading indicators track drivers of future outcomes, while lagging indicators record results already achieved. Neither is inherently superior: a leading measure is useful only when its relationship to outcomes is credible. Define numerator, denominator, population, exclusions and data source so performance cannot improve through reclassification alone. Incentives can cause gaming, such as rejecting difficult work to improve completion rates. Use complementary measures and investigate unexplained changes. Distinguish correlation from controllable causation, and avoid judging a team on outcomes heavily driven by factors outside its influence without appropriate interpretation.
Worked example: A repair team improves its average response time by declining distant customers. Adding service coverage and unresolved-fault measures reveals the trade-off. Management also checks the response-time definition so the clock starts at the customer's request rather than internal job allocation.
Common mistake: Assuming a numerical target is objective overlooks how definitions, exclusions and incentives can change behaviour without improving the underlying outcome.
Official syllabus reference: [1]
24. Scenario planning and strategic signposts
Scenario planning explores coherent alternative futures when important uncertainties cannot be represented adequately by one forecast. Select material drivers, examine their interaction and develop internally consistent narratives with operational and financial implications. Scenarios are not necessarily assigned probabilities, and they should not be disguised optimistic and pessimistic versions of the same plan. Use them to identify robust actions, contingent investments and vulnerabilities. Define signposts that indicate which conditions are emerging and specify the decisions they trigger. This turns scenario work into an adaptive management process rather than a one-off discussion document.
Worked example: A company examines high and low energy prices combined with rapid and slow customer automation. It invests in flexible service capability across scenarios, while postponing a specialised factory until customer orders and policy developments support one particular demand pathway.
Common mistake: Producing several forecasts without identifying different decisions or trigger indicators leaves management with more numbers but little additional strategic flexibility.
Official syllabus reference: [1]
25. Transaction, translation and economic currency exposure
Transaction exposure arises from foreign-currency cash flows such as receivables and payables. Translation exposure arises when foreign operations' financial statements are converted for group reporting. Economic exposure concerns longer-term effects of exchange rates on competitiveness and future cash generation, including firms without foreign invoices. These exposures overlap but require different responses. A forward may protect a specified receipt yet leave customer demand and relative production costs exposed. Analyse currencies, timing, contractual flexibility and competitor locations before selecting commercial or treasury actions. Avoid assuming a translation movement represents an equivalent immediate cash loss.
Worked example: A home-currency manufacturer invoices exports in dollars. Dollar weakness reduces converted receipts and may require repricing. Its foreign subsidiary also reports a lower translated asset value, while a dollar-based competitor gains a cost advantage that affects future sales opportunities.
Common mistake: Treating all exchange losses as identical encourages hedges that address reported figures while leaving the main commercial cash-flow exposure unresolved.
Official syllabus reference: [1]
26. Inflation, interest rates and strategic cash flows
Inflation affects selling prices, input costs, wages, working capital and customers' purchasing power at different rates and times. Interest-rate changes affect borrowing costs, investment demand and valuation discount rates. Analyse contractual repricing, fixed versus floating debt and customer financing dependence rather than applying one general percentage to every cash flow. Nominal cash flows require nominal discount rates; real cash flows require consistent real rates. Higher nominal revenue can coexist with weaker margins and cash generation if costs rise faster or receivables require more funding. Strategic responses should address the particular transmission mechanism.
Worked example: A supplier faces immediate wage increases but can reprice annual service contracts only at renewal. Revenue eventually rises, yet margins tighten during the delay and larger invoices increase receivables. Finance models contract cohorts and working-capital needs rather than assuming inflation is neutral.
Common mistake: Using a nominal discount rate with cash flows stripped of inflation understates value through an inconsistent treatment of purchasing-power changes.
Official syllabus reference: [1]
27. Political risk and location decisions
Political risk concerns policy or institutional developments that affect operations, cash flows or asset control. Examples include trade restrictions, capital controls, permit changes and instability. Distinguish an announced proposal from an enacted measure and assess exposure through specific contracts, locations and supply chains. Responses may include diversification, local partnerships, investment staging, contractual protection or appropriate insurance, each with limits. Local production can reduce one trade exposure while creating fixed-asset and governance risks. Compare full scenarios and reversibility rather than assuming a location change eliminates political uncertainty or that insurance covers every consequence.
Worked example: A possible import tariff prompts a manufacturer to examine local assembly. Finance compares imported-component exposure, plant commitment and alternative export markets. Management waits for defined policy milestones before major expenditure while developing a reversible distribution arrangement to preserve market access.
Common mistake: Treating proposed policy as certain can trigger costly commitments, while ignoring it entirely leaves the organisation without credible contingency options.
Official syllabus reference: [1]
28. Financial materiality and impact materiality
Financial materiality considers sustainability matters that could affect the organisation's prospects, cash flows, access to finance or cost of capital. Impact materiality examines significant effects the organisation has on people and the environment. Double-materiality approaches consider both, but reporting requirements and terminology depend on the applicable framework and jurisdiction. An issue can be materially important through impacts before a measurable financial effect appears. Define value-chain boundaries, time horizons and evidence sources, and avoid assuming that one reporting framework's requirements apply universally. Use the analysis to inform strategy, risk priorities and credible measurement.
Worked example: A supplier's water use has little immediate effect on purchase prices but materially affects a water-stressed community. Finance assesses that impact separately from future supply interruption, reputational exposure and potential cost changes, rather than waiting for a booked financial loss.
Common mistake: Calling an issue immaterial because no current expense is recorded confuses accounting recognition with broader sustainability impacts and future financial exposure.
Official syllabus reference: [1]
Recommend financing strategies
29. Funding maturity and repayment matching
Funding should reflect the duration, uncertainty and timing of the cash needs it supports. Long-lived assets generally require a sufficiently committed funding base, while temporary working-capital peaks may suit flexible facilities. Matching is not exact equality of asset life and loan tenor: amortisation, residual funding needs and contingency capacity also matter. Short-term facilities can appear cheaper but create renewal and repricing risk. Assess committed versus uncommitted availability, covenants, security and total fees. Stress-test repayment against cash generation, preserving headroom for delays rather than assuming forecast accounting profits will provide cash when debt falls due.
Worked example: A ten-year service centre is offered a seven-year amortising loan. Finance maps annual repayments against operating cash flows and the asset's remaining funding need at maturity. Seasonal inventory uses a separate revolving facility sized for adverse demand and collection scenarios.
Common mistake: Selecting the lowest initial interest rate overlooks facility withdrawal, refinancing exposure and repayment timing that may make cheaper funding less suitable.
Official syllabus reference: [1]
30. Capital structure and expected financial distress
The trade-off view of capital structure balances potential financing benefits of debt against expected distress and related costs. Where interest deductions apply, debt can create tax benefits, but higher fixed commitments reduce resilience and may raise both borrowing and equity return requirements. Distress costs include lost customers, constrained investment and restrictive negotiations, not only formal insolvency expenses. Optimal gearing is therefore organisation-specific and sensitive to cash-flow volatility, asset security and financing access. Evaluate downside debt-service capacity and flexibility rather than assuming more debt always lowers the weighted average cost of capital.
Worked example: A stable utility-style service business may support more debt than an early-stage analytics business with uncertain renewals. Finance compares downside cash headroom, covenant pressure and the value of preserving investment capacity before recommending the same gearing target for both.
Common mistake: Treating debt's quoted rate as its complete cost ignores increased financial risk, covenant constraints and the effect on shareholders' required returns.
Official syllabus reference: [1]
31. Rights issues and theoretical ex-rights value
A rights issue offers existing shareholders the opportunity to subscribe for new shares, usually in proportion to current holdings. The theoretical ex-rights price combines existing equity value and new cash across the enlarged share count, assuming no other value change or issue costs. A discounted subscription price does not by itself destroy shareholder wealth because rights can have value. Outcomes depend on whether rights are exercised, sold or allowed to expire, where transferability permits. Evaluate proceeds, underwriting, shareholder capacity and investment use, while distinguishing mechanical price adjustment from the market's assessment of the financing decision.
Worked example: Four existing shares trade at CU5 each and one new share is offered at CU3. The theoretical ex-rights price is CU4.60. An investor's economic position depends on the value of rights and participation, not merely the lower post-issue share price.
Common mistake: Calling the mechanical fall in share price a shareholder loss ignores subscription rights and the additional cash contributed to the business.
Official syllabus reference: [1]
32. Lease-versus-buy financing comparison
A lease-versus-buy analysis compares economically equivalent access to an asset, using incremental after-tax cash flows and consistent assumptions. Consider deposits, rentals, purchase expenditure, maintenance responsibilities, residual proceeds and financing-related effects. Discount financing cash flows at a rate appropriate to their risk rather than automatically using the operating project's hurdle rate. Contract flexibility, usage limits, termination charges and obsolescence exposure can outweigh a small present-value difference. Accounting presentation does not determine economic advantage, and a lease should not be described as automatically off-balance-sheet. Evaluate operational suitability separately from the financing comparison.
Worked example: Two proposals provide the same delivery vehicles for five years. The lease includes maintenance and mileage limits; buying leaves uncertain resale proceeds. Finance adjusts for maintenance equivalence and expected mileage charges before comparing discounted cash costs and flexibility under lower demand.
Common mistake: Comparing annual rent directly with purchase price ignores payment timing, service obligations and the residual asset value retained under ownership.
Official syllabus reference: [1]
33. Residual dividends, stability and signalling
A residual dividend approach distributes funds after financing acceptable investments within the intended capital structure. A stable dividend policy instead emphasises predictable payments, while signalling arguments consider what changes imply about management's expectations. These perspectives can conflict when cash is constrained. Distinguish earnings from distributable cash and assess liquidity, financing access, covenants and applicable distribution requirements. A positive-value investment does not automatically justify any funding terms, and maintaining dividends does not guarantee market confidence. Recommend a coherent policy and explain deviations transparently so investors can understand the capital allocation rationale.
Worked example: A company has CU12 million cash, a CU9 million investment and a CU4 million reserve requirement. It cannot fund both internally before dividends. The board compares financing and staging options, then explains why a temporary distribution reduction protects liquidity and investment capacity.
Common mistake: Assuming a historic dividend must be maintained overlooks changing investment needs, cash availability and the potential cost of borrowing solely to distribute funds.
Official syllabus reference: [1]
34. FCFF valuation and the enterprise-to-equity bridge
Free cash flow to the firm measures operating cash available to capital providers after operating taxes, reinvestment and working-capital needs, before financing distributions. Discounting consistent FCFF at an appropriate weighted average cost of capital produces operating enterprise value. Reconcile this to equity by deducting debt and other relevant non-equity claims and adding genuinely surplus assets, avoiding double counting. The exact bridge depends on what the operating valuation includes. Forecast cash conversion, terminal assumptions and valuation-date consistency often matter more than arithmetic precision. Equity cash flows instead require an equity discount rate and different treatment of financing.
Worked example: Operating enterprise value is CU150 million, debt is CU40 million and surplus cash is CU7 million, with no other adjustments assumed. Equity value is CU117 million. Cash needed for normal operations should not automatically be added again as surplus.
Common mistake: Discounting cash flows after interest at WACC mixes financing treatments and can misstate value through inconsistent claims and discount rates.
Official syllabus reference: [1]
35. Dividend growth valuation and terminal sensitivity
The constant-growth dividend model values equity as next period's dividend divided by the equity return requirement minus sustainable growth: P0 = D1/(ke − g). It assumes growth can continue indefinitely and ke exceeds g. Use it where dividends reasonably represent distributable shareholder cash, not automatically for businesses withholding cash for exceptional investment. Long-run growth must be consistent with reinvestment and economic capacity. Small changes in the discount-growth spread can cause large valuation changes. Multi-stage models can reflect transition, but their terminal assumptions still require a credible steady-state business and payout policy.
Worked example: Next year's dividend is CU0.60 per share, the required equity return is 9% and perpetual growth is assumed at 3%. Value is CU10 per share. Raising assumed growth to 4% produces CU12, illustrating sensitivity rather than proving higher value.
Common mistake: Using the dividend just paid without growing it to the next period understates the numerator required by the standard constant-growth formulation.
Official syllabus reference: [1]
36. Valuation multiples and comparable economics
Valuation multiples estimate value by applying a market relationship to a comparable financial measure. Price/earnings relates equity value to earnings attributable to equity, while enterprise-value multiples relate enterprise claims to an operating measure such as EBITDA. Match numerator and denominator and use consistent periods. Normalise exceptional items and examine growth, margins, risk, capital intensity and accounting differences. A similar industry label does not establish comparable economics. Multiples are useful cross-checks and market indicators, but they can import market mispricing. Any adjustments for control or marketability require evidence rather than automatic percentages.
Worked example: A listed peer trades at an enterprise value of eight times EBITDA. Applying that multiple to CU6 million maintainable EBITDA suggests CU48 million enterprise value, before a debt-and-cash bridge. Finance checks whether the target requires substantially greater maintenance capital expenditure.
Common mistake: Applying a price/earnings multiple to operating profit mixes equity and enterprise measures, producing a valuation without a consistent economic basis.
Official syllabus reference: [1]
37. WACC, market weights and project risk
Weighted average cost of capital combines required returns on equity and debt using an appropriate financing mix, commonly market-value weights. Where interest tax relief applies and is usable, the debt component reflects its tax effect. A company-wide WACC is suitable only when project operating risk and financing assumptions are sufficiently comparable. CAPM estimates equity return from a risk-free rate plus beta times the market risk premium, but input selection requires judgement. Changing leverage changes financial risk. Match the discount rate to cash-flow currency and inflation treatment, and avoid adding the same risk twice through both forecasts and an arbitrary rate premium.
Worked example: A mature equipment maker enters a volatile software market. Its existing WACC may understate the new activity's risk. Finance examines comparable business betas and a suitable financing structure rather than applying the corporate rate solely because the parent funds the investment.
Common mistake: Using book-value financing weights without considering current economic values can misrepresent investors' required return on the capital supporting the business.
Official syllabus reference: [1]
38. Adjusted present value and financing side effects
Adjusted present value separates the value of an investment without financing effects from the present value of financing side effects. These may include usable interest tax shields, issue costs, subsidies and expected financing-related costs. The separation can be useful when leverage changes substantially over time and one stable WACC is difficult to justify. Discount each component consistently with its risk and assumptions; tax-shield discounting is not universally the same in every financing policy. APV should reconcile conceptually with other valuation methods when assumptions align, rather than create value merely by changing the presentation.
Worked example: An expansion has an unlevered net present value of CU4 million. Estimated financing benefits have present value CU1.2 million, while issue costs are CU0.3 million. APV is CU4.9 million under those assumptions, before any omitted financing consequences are assessed.
Common mistake: Adding tax shields to a valuation already using an after-tax debt WACC can count the same financing benefit twice.
Official syllabus reference: [1]
Evaluate and mitigate risk
39. Risk appetite, tolerance and capacity
Risk appetite expresses the types and amount of risk an organisation is willing to take in pursuing objectives. Tolerances translate this into boundaries for particular exposures or performance variations. Risk capacity is the amount the organisation can absorb without threatening viability or essential obligations. Appetite should fit within capacity but may be much lower because of stakeholder expectations and strategic priorities. Use meaningful dimensions such as liquidity, service interruption or concentration rather than relying only on broad colour ratings. Link breaches to decisions, escalation and resources so appetite influences strategy instead of remaining a policy statement.
Worked example: A company can financially survive a prolonged outage but commits to much shorter customer disruption. Its operational tolerance is therefore tighter than its financial capacity. Investment in recovery capability is evaluated against that service commitment, with escalation when tests show it cannot be met.
Common mistake: Equating what the organisation could survive with what it should accept overlooks strategic promises, stakeholder impacts and deliberate risk preferences.
Official syllabus reference: [1]
40. Risk registers and control-adjusted exposure
A risk register links an objective to causes, uncertain events, consequences, ownership, controls and planned actions. Inherent risk is assessed before specified controls, while residual risk reflects controls that actually operate. Define the assessment basis because organisations use these terms differently. Proposed actions affect expected future exposure, not necessarily current residual risk. Record deadlines, indicators, evidence and escalation criteria so the register supports decisions. Avoid vague labels such as 'supplier risk' without a causal statement. Periodic updates should reflect changed operations, incidents and control effectiveness rather than simply refreshing review dates.
Worked example: A sole supplier may flood, interrupting production and delaying deliveries. Existing inventory reduces current impact; an unqualified second supplier does not yet reduce current exposure. The register records qualification milestones separately and assigns one executive responsibility for the overall risk.
Common mistake: Reducing the residual rating when an action is merely approved overstates protection before implementation and evidence of operating effectiveness.
Official syllabus reference: [1]
41. Expected loss, tail risk and correlation
Expected loss combines outcome probabilities and losses to describe an average across possible repetitions. It does not show the largest plausible loss or the organisation's ability to survive one event. Risk aggregation must consider dependence: events can share drivers such as energy prices, geography or common technology. Correlation assumptions based on normal conditions may understate joint stress. Compare expected outcomes with concentration, tail scenarios and liquidity consequences. Use probabilities only when defensible and identify uncertainty in estimates. Two risks with the same expected loss may require very different responses because their severity and timing differ.
Worked example: A 2% chance of a CU20 million loss and a 20% chance of a CU2 million loss both imply CU0.4 million expected loss. The first can threaten liquidity more severely, particularly if the same event also interrupts major customers' payments.
Common mistake: Treating expected loss as the maximum funding needed ignores low-frequency severe events and simultaneous losses caused by common underlying drivers.
Official syllabus reference: [1]
42. Sensitivity analysis and reverse stress testing
Sensitivity analysis changes an input to identify its influence on an outcome, commonly holding other assumptions constant. Scenario analysis changes a coherent combination of inputs. Reverse stress testing starts with an unacceptable outcome, such as exhausting liquidity, and asks which plausible conditions would cause it. This reveals vulnerabilities and the assumptions on which survival depends. None of these methods supplies probabilities automatically. Use operationally credible relationships, including delays and management response constraints. Findings should inform contingency triggers, funding buffers or strategic redesign rather than merely documenting that performance worsens when assumptions deteriorate.
Worked example: A company first tests the effect of a 5% sales decline. Reverse stress testing then asks what combination of delayed renewals, slower collections and restricted borrowing would exhaust cash. Management identifies earlier warning indicators and prepares actions before that combination develops.
Common mistake: Calling a single adverse percentage a complete stress test overlooks interacting drivers, timing effects and the possibility that management responses are constrained.
Official syllabus reference: [1]
43. Avoid, reduce, transfer or accept risk
Risk responses can avoid an activity, reduce likelihood or impact, transfer specified consequences or accept remaining exposure. The familiar transfer, avoid, reduce and accept framework supports comparison, but responses often work together. Insurance and outsourcing do not remove all accountability or consequences; exclusions, counterparty failure and reputational harm can remain. Acceptance should be informed, owned and consistent with appetite rather than result from inaction. Compare response cost with the exposure reduced and any new risks created. Include implementation time because an effective future control may leave a material interim vulnerability.
Worked example: A company reduces fire risk through maintenance, buys property and interruption insurance, and accepts the policy deductible within approved limits. It still prepares recovery arrangements because insurance proceeds cannot instantly restore customer service or protect every reputational consequence.
Common mistake: Assuming insurance transfers the entire risk overlooks deductibles, exclusions, settlement timing and operational or reputational consequences retained by the organisation.
Official syllabus reference: [1]
44. Ethical threats to integrity and objectivity
Professional ethical analysis identifies the principle at risk, the pressure creating the threat and actions that remove or reduce it. Common threats include self-interest, self-review, advocacy, familiarity and intimidation. Integrity requires honest communication; objectivity requires judgement free from inappropriate bias or influence. Professional competence, confidentiality and professional behaviour also matter. Gather relevant facts, challenge unsupported claims, document reasoning and escalate proportionately when necessary. Confidentiality does not justify participating in deception, but external disclosure obligations depend on applicable requirements. If threats cannot be addressed adequately, declining approval or association may be necessary.
Worked example: A bonus-linked manager pressures finance to omit a major forecast uncertainty from a lender presentation. The accountant identifies self-interest and intimidation threats, proposes accurate wording and escalates unresolved pressure through appropriate governance channels while retaining an evidence record.
Common mistake: Assuming an instruction from a senior executive removes personal professional responsibility confuses organisational authority with the obligation to exercise independent judgement.
Official syllabus reference: [1]
45. Conflicts of interest and inducement risk
A conflict of interest arises when personal or competing interests could improperly influence professional judgement. Disclosure makes the conflict visible but does not automatically resolve it. Appropriate responses may include recusal, independent evaluation, information barriers or declining an arrangement. Inducements require assessment of intent, influence and applicable policies and law; a gift's low monetary value alone does not prove acceptability. Consider reasonable stakeholder perceptions as well as actual bias. Record the conflict and safeguards, preserve objective decision evidence and distinguish legitimate commercial hospitality from arrangements designed to secure improper advantage.
Worked example: A procurement manager's relative owns a bidder. The manager declares the relationship and takes no part in specification, scoring or approval. An independent panel compares service and total cost, retaining records so the award can be justified even if that bidder wins.
Common mistake: Believing that disclosure alone cures a conflict overlooks continued influence over specifications, evaluation criteria or access to competing bids.
Official syllabus reference: [1]
46. Cyber risk through confidentiality, integrity and availability
Cyber risk can compromise confidentiality, integrity or availability of information and services. Confidentiality concerns unauthorised disclosure, integrity concerns unauthorised or erroneous change, and availability concerns access when required. Start with business assets and processes, then analyse threats, vulnerabilities and consequences rather than treating every technical issue as equally important. Controls should address plausible attack paths, including identity misuse, insecure configuration and third-party access. A control can protect one objective while leaving another exposed. Backups support recovery but do not prevent data theft, and encryption does not by itself ensure correct or available processing.
Worked example: An attacker copies customer data and then encrypts the service platform. Restoring backups addresses availability, while investigation and appropriate communication still need to address confidentiality. The organisation also verifies restored information and configurations before trusting the recovered service.
Common mistake: Assuming successful restoration resolves the incident overlooks stolen information, altered records and the possibility that compromised access remains active.
Official syllabus reference: [1]
47. Incident containment, evidence and trustworthy recovery
Cyber incident response coordinates identification, containment, investigation, eradication, recovery and lessons learned. Immediate actions balance limiting harm with preserving evidence and maintaining critical operations. Isolation decisions require technical and business coordination because shutting down one system can affect essential services. Recovery requires confidence in backups, configurations and access credentials, not simply restarting machines. Communications should distinguish confirmed facts from unresolved questions and provide useful update commitments. Assess contractual, insurance and jurisdiction-specific notification duties using appropriate expertise. A documented decision log supports accountability and learning without assuming that every incident has identical reporting requirements.
Worked example: A platform outage triggers the incident team. Engineers isolate affected services, preserve logs and test clean restoration. Customer support provides alternative arrangements and scheduled factual updates, while legal and insurance specialists assess obligations based on the actual systems and data involved.
Common mistake: Promising a recovery deadline before testing restoration can mislead stakeholders and pressure teams to reconnect systems whose integrity remains uncertain.
Official syllabus reference: [1]
48. Business impact analysis, RTO and RPO
Business impact analysis identifies critical processes, dependencies and the consequences of disruption over time. Recovery time objective specifies a target time for restoring a service after disruption. Recovery point objective specifies the targeted point to which data must be restored, expressing acceptable data loss in time terms. They answer different questions and are not guaranteed by backup frequency alone. Recovery capability depends on tested restoration, infrastructure, people and third parties. Set objectives from business needs and feasible investment, distinguish minimum service from full recovery, and test end-to-end dependencies rather than isolated systems.
Worked example: A service desk targets restoration within four hours and no more than thirty minutes of lost records. Hourly backups alone do not support that data objective. Management considers more frequent replication and tests whether staff, authentication and supplier connections can also recover.
Common mistake: Confusing recovery time with data loss can produce frequent backups while leaving the organisation unable to restore essential operations quickly.
Official syllabus reference: [1]
49. Forwards, options and forecast overhedging
A foreign-exchange forward fixes an exchange rate for a specified future transaction but creates an obligation. An option provides a right without the same exercise obligation, in exchange for a premium. Instrument choice should reflect exposure certainty, timing, cost and risk appetite. Hedging a forecast receipt that does not occur can create an uncovered delivery obligation or an offsetting transaction at an adverse rate. Match hedge amounts and maturities to credible cash forecasts, updating assumptions as contracts change. Evaluate the full economics, including premiums and counterparty exposure, rather than selecting protection solely from quoted rates.
Worked example: A business expects USD3 million, including USD1 million conditional on acceptance. It considers a forward for the more certain USD2 million and an option for the conditional portion. This limits forced delivery exposure while recognising that flexible protection has an upfront cost.
Common mistake: Hedging every forecast receipt forward can increase risk when cancellations or delays leave the organisation committed to deliver currency it has not received.
Official syllabus reference: [1]
50. Interest-rate swaps and basis risk
An interest-rate swap exchanges specified interest cash flows, commonly fixed payments for floating receipts on a notional principal. A floating-rate borrower paying fixed and receiving matching floating under a swap can stabilise its base-rate exposure, but the loan remains outstanding. Credit margins, fees and mismatched reference rates may remain variable. Basis risk arises when the floating rate received does not move exactly with the rate paid on the debt. Consider counterparty credit, collateral, early termination and debt repayment scenarios. A swap changes the risk profile rather than guaranteeing the lowest eventual interest cost.
Worked example: A borrower pays reference rate plus a credit margin on its loan. A matching swap receives that reference rate and pays 4% fixed. The combined base cost becomes 4% plus the loan margin, but a later margin increase is not hedged.
Common mistake: Assuming a swap fixes every borrowing cost overlooks credit spreads, basis differences and termination exposure if the underlying debt changes.
Official syllabus reference: [1]
Recommend and maintain a sound control environment
51. COSO components and reasonable assurance
The COSO internal-control framework comprises control environment, risk assessment, control activities, information and communication, and monitoring activities. These components work together to support objectives relating to operations, reporting and compliance. A strong approval procedure can be undermined by management override, poor information or incentives that discourage challenge. Internal control provides reasonable rather than absolute assurance because judgement, error, collusion and resource constraints remain. Evaluate design and operation across the system instead of counting policies. The control environment includes leadership conduct, accountability and competence, making governance behaviour relevant to the effectiveness of detailed transaction controls.
Worked example: A company has documented purchasing approvals, but executives routinely bypass them and staff fear reporting exceptions. Testing signatures alone would miss the weak control environment. The board addresses override reporting and accountability alongside repairing the purchasing workflow.
Common mistake: Equating a large policy manual with effective control ignores whether people understand, apply and challenge the procedures in practice.
Official syllabus reference: [1]
52. Segregation of duties and compensating review
Segregation of duties separates incompatible responsibilities such as authorisation, asset custody, transaction recording and reconciliation. The aim is to reduce the opportunity for one person to cause and conceal error or fraud. Small teams may require compensating controls, including independent review by group staff or directors. Those reviews must inspect relevant evidence at an appropriate level of detail and leave an audit trail. Nominal separation is ineffective when users share credentials or one person can override permissions. Assess both system access and actual practice, including cover during absence and urgent processing.
Worked example: A clerk prepares payments and can amend suppliers. A group controller independently approves bank changes using verified supplier contacts, while a director reviews payment beneficiaries and invoices. Independent reconciliations provide additional detection rather than relying on the total payment batch alone.
Common mistake: Assuming two signatures establish segregation overlooks whether both reviewers examine meaningful evidence or merely approve the same unsupported summary.
Official syllabus reference: [1]
53. IT general controls and dependable automation
IT general controls support the reliable operation of systems across applications. Important areas include access administration, privileged access, program changes, operations and recovery arrangements. Automated business controls depend on these foundations: an accurate calculation rule offers limited assurance if unauthorised users can change it unnoticed. Evaluate joiner, mover and leaver processes, approved development and testing, controlled production deployment and monitoring of exceptional activity. Distinguish permission design from evidence of periodic operation. Outsourced hosting does not remove management's responsibility to understand relevant provider controls and the customer responsibilities needed for them to work.
Worked example: An invoice system correctly blocks payments above approved limits, but developers can alter production rules directly. Internal audit therefore examines change access, deployment approval and logging before relying on the automated block as consistent evidence of control.
Common mistake: Relying on an automated control because it worked once ignores the access and change controls needed to keep it reliable over time.
Official syllabus reference: [1]
54. Application controls and exception handling
Application controls address completeness, accuracy, validity and authorisation within a specific business process. Examples include mandatory fields, duplicate checks, sequence checks, calculation validation and matching purchase orders, receipts and invoices. Preventive controls block unsuitable processing; detective controls identify problems requiring investigation. Their effectiveness depends on configuration, reliable input data and disciplined exception handling. A blocked item is not resolved merely because it appears on a report. Assign owners, deadlines and escalation, and test overrides as well as normal transactions. Controls should reflect realistic business exceptions without creating an unrestricted route around authorisation.
Worked example: A three-way match prevents payment when invoice quantity exceeds recorded goods received. Finance investigates whether goods were genuinely short or receipts were entered late. Overrides require independent approval and retained evidence, while repeated exceptions prompt review of receiving practices.
Common mistake: Treating an exception report as a completed control overlooks whether someone investigates discrepancies and ensures that corrective action occurs.
Official syllabus reference: [1]
55. Three Lines and internal audit independence
The Three Lines Model distinguishes management's operational responsibilities, management roles providing expertise and oversight, and internal audit's independent assurance. The governing body oversees the system and remains accountable for governance. The lines describe roles rather than necessarily separate departments, and coordination should avoid gaps and duplication. Internal audit can advise on control design without assuming management ownership or approving the risk response. Functional access to the audit committee supports independence, while competence and objective judgement support credible assurance. Evaluate conflicts when auditors later assess work they designed or decisions they previously managed.
Worked example: Operations owns supplier controls, risk specialists advise on concentration limits, and internal audit assesses whether the framework works. Audit may recommend improvements, but management selects and implements them; the audit committee reviews significant unresolved exposures and assurance limitations.
Common mistake: Making internal audit responsible for implementing controls weakens independent assurance because it would later evaluate its own management decisions.
Official syllabus reference: [1]
56. Risk-based audit planning and coverage gaps
Risk-based internal audit planning allocates assurance resources according to organisational objectives, significant exposures, change and existing assurance. Consider inherent risk, control concerns, incidents, time since review and specialist competence, rather than simply auditing the largest departments. Available days constrain coverage, so scope and residual assurance gaps must be explicit. Coordinate with other providers without assuming their work is sufficient or independent. Changes in strategy or incidents may justify revising the plan. The audit committee should understand resource limitations and approve priorities, while management remains responsible for risks that are not currently selected for audit.
Worked example: An acquisition doubles purchasing activity while a cyber incident exposes access weaknesses. Internal audit prioritises these areas over a routine low-risk expense review, explaining which procurement locations will be deferred and whether additional technical expertise is needed.
Common mistake: Prioritising engagements because they are easiest to finish can create reassuring completion statistics while leaving the most important exposures unexamined.
Official syllabus reference: [1]
57. Audit evidence, sampling and operating effectiveness
Control design asks whether a procedure could address the risk; operating effectiveness asks whether it actually worked consistently during the relevant period. Inquiry alone is usually weaker than corroborated inspection, observation or reperformance. Sampling requires a defined population, selection approach and interpretation appropriate to the objective. An exception rate from a small judgemental sample should not automatically be projected statistically across the population. Investigate the cause, timing and potential extent of exceptions, including whether evidence is missing or the control failed. Document sufficient, relevant and reliable evidence to support the conclusion and its limitations.
Worked example: Audit finds three unapproved changes in a sample of fifteen supplier amendments. It investigates whether they occurred during one manager's absence and expands targeted testing. The report distinguishes observed exceptions from any unsupported claim about the precise population-wide failure rate.
Common mistake: Concluding that a control works because staff describe it correctly confuses stated procedure with evidence of consistent operation.
Official syllabus reference: [1]
58. Compliance failures and proportionate response
A compliance failure requires containment, fact finding, assessment of obligations and correction of underlying causes. Establish what happened, affected parties, duration and continuing exposure while preserving relevant evidence. Consequences may include remediation costs, contractual claims, regulatory action and reputational damage, but these depend on applicable requirements and facts. Do not assume every breach creates the same reporting duty or penalty. Assign competent investigation and decision owners, protect appropriate confidentiality and assess notification deadlines promptly. Correct inaccurate records or statements, strengthen controls and test effectiveness. A response should address affected stakeholders as well as procedural compliance.
Worked example: A company discovers that some customer data was retained beyond its contractual retention period. It stops further unnecessary retention, identifies affected records and contracts, assesses applicable notification duties and implements deletion evidence and exception ownership before declaring the issue resolved.
Common mistake: Assuming no financial penalty means no significant failure overlooks contractual obligations, stakeholder harm and the possibility of continuing exposure.
Official syllabus reference: [1]
59. Board oversight, committees and information quality
Effective governance separates direction and oversight from day-to-day execution while ensuring that decision makers receive reliable, timely information. Boards challenge strategy, risk, performance and accountability; committees provide focused scrutiny within delegated responsibilities. Delegation does not remove the board's overall responsibilities. Independence, relevant competence, clear mandates and accurate minutes support challenge, but formal structures alone cannot overcome dominant leadership or suppressed information. Examine conflicts, reserved decisions and escalation routes using the organisation's arrangements and applicable requirements. Governance quality is demonstrated through decisions and follow-up, not merely the existence of committees or policy statements.
Worked example: An audit committee receives a summary showing every control finding as closed. It requests closure evidence, overdue actions and significant exceptions directly from internal audit. This changes oversight from accepting management's status labels to challenging whether risk has actually reduced.
Common mistake: Assuming committee approval transfers all responsibility away from the board overlooks continuing oversight duties and the need for reliable supporting information.
Official syllabus reference: [1]
60. Root-cause remediation and evidence-based closure
Remediation should address why a failure occurred, not only correct the observed transaction. Root causes may include unclear ownership, incompatible systems, inadequate competence, incentives or ineffective escalation. Separate immediate containment from permanent corrective action and assign owners, deadlines and measurable closure criteria. Management implements the remedy; independent assurance tests whether design and operation support closure. Training or a revised policy is not sufficient evidence where the process still fails. Follow-up should consider the relevant population and a meaningful operating period, while overdue or ineffective actions are escalated according to their continuing risk.
Worked example: Departed staff retain access because HR and IT use inconsistent identifiers. Disabling the known accounts contains exposure, but permanent remediation requires reconciliation, reliable notifications and accountable exception handling. Closure follows evidence that the revised process removes access consistently, including unusual departure cases.
Common mistake: Closing a finding when a reminder email is sent confuses completion of an activity with demonstrated correction of the underlying control failure.
Official syllabus reference: [1]