Management: Governance and assurance¶
Corporate governance¶
Rules found in this domain: P6, P56.
Illustrative, not evidence.
Scenario. A mid-sized manufacturer's board meets to choose a new logistics provider. One director owns shares in a bidder. She declares it, the company secretary adds it to the register of declared interests, and she leaves the room for that item. At the same meeting, the CEO's pay proposal goes to the board's remuneration committee of non-executive directors, not to the CEO.
- P6: The director has a personal interest in a bidder. She discloses it, it goes into the register of declared interests, and she steps out of the vendor decision.
- P56: The CEO's pay proposal is not approved by the CEO. The board's remuneration committee, which is independent of management, reviews it. The checker is not the author, and independence rises with the consequence.
Internal audit and assurance¶
Rules found in this domain: P40, P56.
Illustrative, not evidence.
Scenario. A retailer's online shop handles customer payment data. The shop team owns the access risk. A security function monitors it. Each year internal audit tests both.
- P40: Management owns the risk (first line). Security monitors it (second line). Internal audit tests both (third line). The lines are independent, and each is verified.
- P56: Internal audit is a checker that does not report to the team it checks. The checker's independence matches the consequence of failure.
Statutory audit¶
Rules found in this domain: P56.
Illustrative, not evidence.
Scenario. A listed company has used the same audit firm for many years. Its audit committee puts the audit out to tender and appoints a new firm, because the current one has reached the longest term the committee's policy allows. It also requires the new firm to rotate the lead audit partner after a set number of years.
- P56: The accounts are checked by an external auditor, the highest level of independence. Long-serving external auditors are rotated, so the checker stays independent.
Internal control¶
Rules found in this domain: P43, P42.
Illustrative, not evidence.
Scenario. A finance team at a distributor lets one clerk set up suppliers, approve invoices and release payments. Internal control splits these steps between roles and writes down a matrix of incompatible roles. Payments above a set amount also need two authorized people to release them.
Compliance management¶
Rules found in this domain: P60, P59.
Illustrative, not evidence.
Scenario. A services firm keeps a register of its legal obligations. Each entry points to an owner, a control and a test of that control, and a yearly report shows no obligation without a test and no test without an obligation. The firm treats the legal minimum as the floor, not the goal. For example, it caps overtime below the limit that working-time law sets.
- P60: The firm meets the law as the minimum and then applies other rules, such as limits on overtime. Compliance alone is not treated as proof of safety.
- P59: Each legal or contractual obligation links to a control and to a test of that control. No obligation lacks a test, and no test lacks an obligation.
Whistleblowing and speak-up¶
Rules found in this domain: P4.
Illustrative, not evidence.
Scenario. A warehouse employee sees that safety checks are signed off without being done. She reports it through the company's confidential reporting channel without asking her manager first. The company forbids retaliation against anyone who reports. Every report gets a follow-up, and each case is reviewed without blame.
- P4: The employee can raise the concern without permission and without retaliation. A confidential channel exists, every report is followed up, and each use is reviewed without blame.
Anti-bribery¶
Rules found in this domain: P6.
Illustrative, not evidence.
Scenario. A procurement officer sits on a tender panel. Her brother has just joined one of the bidders as a sales manager. Under the company's anti-bribery management system, she declares this in the register of declared interests. The compliance officer checks the register before the award, and she steps out of the evaluation.
- P6: A person who decides on a tender has a personal interest through a close relative. She discloses it, it is recorded in the register, the register is checked before the award, and she leaves the decision.