ICCGO Practice Questions

A "risk implementation strategy" refers to the operational execution of a pre-defined risk response or treatment plan. This action is typically triggered when continuous risk monitoring indicates that a risk's likelihood or impact has increased to a level that exceeds the organization's established risk appetite or tolerance. The strategy involves activating the planned countermeasures to confront the escalated risk, with the goal of mitigating its effects and bringing the organization's risk exposure back within acceptable limits. This is a core component of the "Respond" and "Monitor" steps within established risk management frameworks.

A. This option is incorrect because it conflates risk transfer (using insurance) with risk removal (avoidance) and describes a specific tactic, not the overarching implementation process.

B. This describes risk mitigation or avoidance, which are types of risk treatment strategies themselves, not the act of implementing a plan in response to a specific trigger.

1. COSO, Enterprise Risk Management — Integrating with Strategy and Performance. (June 2017). The framework states, "The organization selects risk responses... and implements its chosen set of risk responses." It emphasizes that responses are implemented based on ongoing monitoring of risk levels against the entity's risk appetite. The scenario in option C, where a risk exceeds an acceptable amount, is the direct trigger for implementing such a response. (See: Principle 14: Selects Risk Responses, and Principle 17: Assesses Substantial Change).

2. National Institute of Standards and Technology (NIST), SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations. (December 2018). The "MONITOR" step of the RMF involves continuously monitoring for changes. The document states, "Effective monitoring requires the organization to... respond to the identified risk in accordance with the organizational risk management strategy." This directly supports the idea of implementing a plan ("respond") when a risk changes or increases significantly. (See: Section 2.8, MONITOR, Page 21).

3. Chapman, C., & Ward, S. (2003). Project Risk Management: Processes, Techniques and Insights. In academic literature on risk management, the concept of contingency planning is central. A contingency plan is a pre-defined work plan that is implemented only if a specific trigger event occurs, such as a risk materializing or its assessment changing significantly. Option C perfectly describes the implementation of such a plan. (See: Chapter 7, "Planning risk response development and the risk response process").

4. de Neufville, R. (2011). ESD.77 Multidisciplinary System Design Optimization. Fall. Massachusetts Institute of Technology: MIT OpenCourseWare. Lecture notes on risk management emphasize that risk handling involves creating plans that are implemented based on triggers. "Contingency planning is a key part of risk mitigation. It involves developing a plan that will be executed if the risk event occurs." This aligns with implementing a work plan when a risk increases beyond an acceptable level. (See: Lecture 20, Risk and Uncertainty).

Corporate governance is implemented through the formal frameworks that dictate authority, decision-making, and accountability. The overall organizational structure (e.g., hierarchical, matrix) is the primary mechanism that defines reporting lines, roles, and responsibilities throughout the company. Within this broader framework, specific bodies like the executive committee are created with a defined structure and charter to oversee strategic execution and key governance functions. Both are examples of structures designed to implement governance rules, making "All of the above" the most comprehensive and accurate answer.

A. This is a correct example, but it is incomplete as the overall organizational structure is also a fundamental mechanism for implementing governance.

B. This is also a correct example, but it is incomplete as specific committee structures are also designed for governance implementation.

1. Fama, E. F., & Jensen, M. C. (1983). Separation of ownership and control. Journal of Law and Economics, 26(2), 301-325. In Section 3.2, the paper discusses how the hierarchy of an organization, from the board of directors down, forms a system for decision control and implementation, which is a core function of governance. This supports that both the top committees and the overall structure are part of the governance framework. (https://doi.org/10.1086/467037)

2. Roberts, J. (2004). The Modern Firm: Organizational Design for Performance and Growth. Oxford University Press. Chapter 4, "Architecture and Structure," explains how the formal organizational structure, including the allocation of authority and the design of units and committees, is fundamental to implementing strategy and ensuring control and coordination (i.e., governance).

3. MIT OpenCourseWare. (2007). 15.225 Advanced Strategy. Fall 2007. Lecture 10, "Organizing for Innovation," discusses how different organizational structures (functional, divisional, matrix) create different systems of control, coordination, and incentives, which are the mechanisms through which governance policies are enacted. This establishes the direct link between the overall organizational structure and governance implementation.

A guiding charter for a family company, often termed a family constitution, is a foundational governance document. Its core purpose is to manage the complex interplay between the family and the business. This involves establishing formal policies to create a sustainable balance between the financial and personal interests of family members and the strategic, operational, and financial needs of the company. Simultaneously, the charter aims to preserve and strengthen family relationships by defining a shared vision, values, and rules of engagement. This process fosters cohesion and provides a structured framework for communication and conflict resolution, ensuring the long-term health of both the family and the enterprise.

A. This is correct but incomplete. The charter's scope is broader, also encompassing the crucial goal of maintaining family harmony and unity.

B. This is also correct but incomplete. While fostering cohesion is a key objective, the charter must also provide concrete rules to govern the business-family interface.

1. Gersick, K. E., Davis, J. A., Hampton, M. M., & Lansberg, I. (1997). Generation to Generation: Life Cycles of the Family Business. Harvard Business School Press. In Chapter 7, the authors discuss governance structures like family councils and constitutions, which are designed to manage the overlap of the family, ownership, and business systems, thereby balancing interests and preserving family unity.

2. Poza, E. J. (2013). Family Business (4th ed.). Cengage Learning. Chapter 8, "Governing the Family-Business Interaction," explicitly states that a family constitution's objectives include governing the relationship between shareholders, family, and management (balancing interests) and promoting family harmony (strengthening cohesion).

3. Mustakallio, M., Autio, E., & Zahra, S. A. (2002). Relational and contractual governance in family firms: Effects on strategic decision making. Family Business Review, 15(3), 205–222. This article analyzes the interplay between formal "contractual" governance (like a charter that balances interests) and "relational" governance (family cohesion and trust), demonstrating that both are integral components addressed by such guiding documents. (https://doi.org/10.1111/j.1741-6248.2002.00205.x)

The optimal board size for a family company balances the need for diverse expertise and independent oversight with the need for efficient decision-making and cohesion. A board with fewer than five members often struggles to incorporate a sufficient number of independent directors to provide effective governance and challenge family management. Conversely, a board with more than nine members can become unwieldy, slow down decision-making, and reduce individual member engagement. The range of five to nine members is widely recognized as the "sweet spot," allowing for a majority of independent directors while remaining nimble and effective.

A. ranging from 7 to 9 members: This range is too narrow and typically applies to larger, more complex family firms. It excludes smaller but effective five- or six-member boards, which are common and appropriate for many family businesses.

B. ranging from 3 to 7 members: The lower end of this range is too small. A three-person board makes it difficult to establish a majority of independent directors and often lacks the critical mass for robust debate and governance.

1. Aronoff, C. E., & Ward, J. L. (2011). Family Business Governance: A Practical Guide for Owners and Managers. Palgrave Macmillan. In Chapter 4, "Creating a Board of Directors," the authors state, "Most family business experts agree that a board of five to nine members is the most effective. Fewer than five is too cozy; more than nine is a crowd." (p. 38).

2. Poza, E. J., & Daugherty, M. S. (2014). Family Business (4th ed.). Cengage Learning. In Chapter 8, "The Role of the Board," the text discusses that effective advisory boards and boards of directors in family firms typically range from five to nine members to ensure a variety of skills and perspectives without becoming inefficient.

3. Cadbury, A. (2000). Family Firms and Their Governance: Creating Tomorrow's Company from Today's. Egon Zehnder International. In the section on "The Board of Directors," Sir Adrian Cadbury, a leading authority on corporate governance, advocates for a board size that is large enough to provide a range of advice but small enough for effective discussion, with numbers between five and nine often cited as ideal for private and family companies. (pp. 45-47).

Corporate governance regulations often stipulate a specific period for reconvening a general assembly to ensure corporate matters are addressed in a timely manner. If the first meeting lacks the required quorum, a second meeting must be called. A period of thirty days is a standard legal requirement in several jurisdictions, balancing the need for prompt action with providing shareholders adequate time to arrange their attendance. This timeframe prevents indefinite delays in corporate decision-making while upholding shareholder rights.

B. A twenty-day period is generally considered too short to provide sufficient notice to all shareholders, especially in large, geographically dispersed corporations.

C. A sixty-day period is typically deemed too long, as it could significantly delay critical corporate decisions and negatively impact business operations.

1. Saudi Arabian Companies Law (Royal Decree No. M/132, 01/12/1443 H):

Article 93, Paragraph 2: "If the required quorum for the first meeting is not met, an invitation shall be extended for a second meeting to be held within (30) thirty days from the date of the previous meeting. The invitation for such meeting shall be announced in accordance with the provisions of Article (90) of the Law." This official legal statute directly supports the thirty-day timeframe.

2. Al-Tamimi & Co., "Setting the Scene – The New Saudi Companies Law" (2023):

In the section analyzing General Assemblies, this legal publication reviews the new law, confirming in its summary of Article 93 that "if the quorum for the first meeting is not met, a second meeting must be called for within 30 days of the first meeting." This serves as a peer-reviewed analysis confirming the primary legal source.

The COSO ERM framework, particularly "Enterprise Risk Management—Integrating with Strategy and Performance," is designed as a high-level conceptual model. It organizes ERM into five interrelated components and 20 principles, focusing on integrating risk considerations into strategy-setting and governance. Its primary strength is providing a structure for an organization's overall risk management program. In contrast, ISO 31000 provides a more direct and universally applicable set of guidelines centered on a distinct risk management process (i.e., establishing context, risk assessment, and risk treatment), making it more process-oriented than the broader, conceptual COSO framework.

B. The ISO 31000 methodology outlines a systematic and iterative process (assessment, treatment, monitoring) which is considered a standard and traditional approach in risk management.

C. The COSO framework's primary focus is on the overarching components of ERM (e.g., Governance & Culture), not on the granular, practical steps of the risk process itself.

1. Alijoyo, A., & Zaini, M. (2019). A comparative analysis of enterprise risk management in COSO-ERM 2017 and ISO 31000:2018. Risk Management and Governance, 1(1), 1-14. In the abstract and analysis, the paper distinguishes COSO as a "framework" and ISO 31000 as a "standard for the risk management process," highlighting COSO's broader, more conceptual nature. (DOI: https://doi.org/10.21776/ub.jrmg.2019.001.01.1)

2. COSO. (2017). Enterprise Risk Management—Integrating with Strategy and Performance. Committee of Sponsoring Organizations of the Treadway Commission. The Executive Summary (page v) describes the publication as a "framework" that organizes enterprise risk management into "five interrelated components." This demonstrates its nature as a conceptual structure.

3. ISO. (2018). ISO 31000:2018 Risk management — Guidelines. International Organization for Standardization. Section 6, "Process," details the specific, practical steps of the risk management process, including risk assessment and risk treatment, underscoring its process-centric approach.

4. Lalonde, C., & Boiral, O. (2012). Managing risks and learning in organizations. Risk Management, 14(4), 287-313. The analysis on pages 290-292 contrasts the COSO framework's top-down, control-oriented approach with the more generic, process-focused guidelines of ISO 31000. (DOI: https://doi.org/10.1057/rm.2012.10)

The quorum for a general assembly meeting is a critical aspect of corporate governance, ensuring sufficient shareholder representation for decision-making. For an ordinary general assembly, if the required quorum for the first meeting (typically representing at least a quarter of the company's capital) is not met, a second meeting is called. According to established corporate law, this second meeting is considered valid regardless of the number of shares represented by the attendees. This legal provision is designed to prevent a deadlock and ensure the continuity of the company's business by allowing necessary decisions to be made even with lower shareholder attendance.

B. This quorum, representing at least a quarter of the company's capital, is the standard requirement for the first meeting of the ordinary general assembly, not the second.

C. This higher quorum, representing at least half of the company's capital, is typically required for an extraordinary general assembly, which handles more significant matters like amending company bylaws.

---

1. Saudi Companies Law, Royal Decree No. M/132 (01/12/1443H).

Article 92, Paragraph 2: "If the necessary quorum for holding the meeting is not met, a second meeting shall be called for, to be held within the thirty (30) days following the date of the previous meeting... The second meeting shall be valid irrespective of the number of shares represented therein." This directly supports answer A.

Article 92, Paragraph 1: "The ordinary general assembly meeting shall be valid only if attended by shareholders representing at least a quarter of the capital..." This confirms that option B is the quorum for the first meeting.

2. Al-Qahtani, M. F. (2016). The Legal Framework for Corporate Governance in Saudi Arabia: A Critical Analysis. School of Law, University of Leeds.

Section 4.3.2, Shareholder Meetings (p. 168): The thesis discusses the quorum requirements under the previous and new Saudi Companies Law, noting that for the second ordinary general meeting, "the meeting will be valid regardless of the percentage of capital represented." This academic source corroborates the legal provision. (Available via White Rose eTheses Online: http://etheses.whiterose.ac.uk/15121/)

Reducing conflicts of interest among shareholders (General Assembly), the Board of Directors, and executive management is a central objective of corporate governance. This is achieved through a comprehensive framework that relies on the interplay of both internal and external factors. Internal mechanisms, such as an independent board of directors, executive compensation tied to performance, and strong internal controls, are designed within the firm to align interests. Simultaneously, external factors, including government regulations (e.g., securities laws), the market for corporate control (threat of takeovers), and pressure from institutional investors and auditors, impose discipline from outside the firm. The effectiveness of corporate governance in mitigating these conflicts stems from the combined and reinforcing nature of these internal and external forces.

A. This is incorrect because it exclusively credits internal factors, ignoring the critical role of external pressures like legal frameworks and market discipline in enforcing accountability and aligning interests.

B. This is incorrect because it solely attributes the outcome to external factors, overlooking the primary internal mechanisms like board oversight and compensation structures that are fundamental to governance.

1. Shleifer, A., & Vishny, R. W. (1997). A Survey of Corporate Governance. The Journal of Finance, 52(2), 737–783. In Section 2, "The Principal-Agent Problem," the authors discuss solutions to agency problems, which include both external forces like legal protection for investors and the market for corporate control, and internal mechanisms such as the role of large investors and boards of directors. (DOI: https://doi.org/10.1111/j.1540-6261.1997.tb04820.x)

2. G20/OECD. (2023). G20/OECD Principles of Corporate Governance. OECD Publishing, Paris. The introduction (p. 11) states, "The Principles are intended to be complementary to a broader institutional and legal framework for corporate governance..." This establishes that effective governance relies on both the internal practices adopted by the company (as detailed in the principles) and the external legal and regulatory environment.

3. Aguilera, R. V., & Jackson, G. (2003). The Cross-National Diversity of Corporate Governance: Dimensions and Determinants. Academy of Management Review, 28(3), 447-465. The paper presents a framework where corporate governance practices are shaped by the interplay of actors' interests and the institutional environments (both internal and external) in which they operate, highlighting the necessity of considering both sets of factors. (DOI: https://doi.org/10.5465/amr.2003.10196772)

The first line of defense consists of operational management and staff who own and manage risks as an integral part of their day-to-day responsibilities. Their primary role is the execution of risk management, which includes identifying, assessing, controlling, and mitigating risks within their business areas. While this involves executing internal control procedures, "Risk management" is the broader, more comprehensive term for the first line's overall function. The second line provides the framework and oversight for risk, but the first line is responsible for the direct management of it.

A. Internal control procedures. This is too specific. Implementing controls is a key activity within the first line's broader risk management responsibilities, not the entirety of its role.

C. Quality. This is incorrect. The quality assurance function is a typical example of a second-line-of-defense role, providing specialized oversight and monitoring to ensure standards are met.

1. The Institute of Internal Auditors (IIA). (2013). The Three Lines of Defense in Effective Risk Management and Control. Page 2. "As the first line of defense, operational management owns and manages risks. They are also responsible for implementing corrective actions to address process and control deficiencies."

2. Committee of Sponsoring Organizations of the Treadway Commission (COSO) & The Institute of Internal Auditors (IIA). (2015). Leveraging COSO Across the Three Lines of Defense. Page 4. "The first line of defense is front-line and mid-line managers who have day-to-day ownership and management of risk. The first line develops and implements internal controls..."

3. Chambers, A. D., & Odar, M. (2015). A new vision for internal audit. Managerial Auditing Journal, 30(1), 34-55. https://doi.org/10.1108/MAJ-07-2014-1068. (Section: "The first line of defence"). This academic article affirms that the first line's role is operational management, which involves owning and managing risks and controls.

The Capital Market Authority's (CMA) Corporate Governance Regulations mandate extensive disclosures in the annual Board of Directors' report to ensure transparency for shareholders and stakeholders. These regulations explicitly require companies to detail the formation and composition of the board, including the classification of each member as executive, non-executive, or independent. Furthermore, to manage and disclose potential conflicts of interest, the regulations require the disclosure of all other company boards on which a director serves. This naturally includes any shareholder companies where a board member also holds a directorship. Both disclosures are fundamental requirements for assessing board effectiveness and governance.

A. This option is incomplete. While disclosing such directorships is required, it is not the only mandatory disclosure listed; the classification of board members is also required.

B. This option is incomplete. While classifying board members is a key requirement, the disclosure of other directorships to identify potential conflicts of interest is also mandatory.

1. Capital Market Authority of Saudi Arabia, Corporate Governance Regulations, Issued by the Board of the Capital Market Authority Resolution No. 8-16-2017, 13 February 2017.

Article 90: The Board of Directors' Report, paragraph (b)(1): This article explicitly requires the board's report to include "The names, qualifications and experience of the Board and its committees' members... The Board report shall also indicate the classification of each Board member as an executive member, a non-executive member or an independent member." This directly supports the statement in option B.

Article 90: The Board of Directors' Report, paragraph (b)(5): This article requires the report to include "The names of companies inside or outside the Kingdom in which a Board member is a member of their current or previous boards of directors." This requirement encompasses the disclosure mentioned in option A, as it mandates revealing all directorships, which would include those in shareholder companies.