Corporate Governance Frameworks

Corporate governance is a key topic on the BAR section of the CPA exam. You must understand the roles and responsibilities of the board of directors, audit committee, management, and internal audit, as well as the requirements of the Sarbanes-Oxley Act.

Corporate Governance Structure

Body	Primary Role	Key Responsibilities
Board of Directors	Oversight of management	Set strategic direction; hire/evaluate CEO; approve major transactions; ensure adequate internal controls; represent shareholder interests
Audit Committee	Oversight of financial reporting and external audit	Select and oversee external auditor; review financial statements; oversee internal controls; handle whistleblower complaints
Management	Day-to-day operations	Prepare financial statements; design and maintain internal controls; implement strategy set by the board
Internal Audit	Independent assurance and consulting	Evaluate risk management; test internal controls; report to audit committee; assess operational efficiency
External Auditor	Independent assurance on financial statements	Express opinion on financial statements; communicate with audit committee; evaluate internal controls (issuers)

Sarbanes-Oxley Act (SOX) Key Provisions

Section	Requirement	Key Detail
§201	Prohibited non-audit services	External auditors cannot provide bookkeeping, financial system design, appraisal, actuarial, internal audit outsourcing, management functions, legal, or broker/dealer services to audit clients
§203	Audit partner rotation	Lead and concurring audit partners must rotate every 5 years with a 5-year cooling off period
§301	Audit committee independence	All members must be independent; at least one must be a financial expert; responsible for appointing external auditor
§302	CEO/CFO certification	CEO and CFO must certify the accuracy of financial statements and effectiveness of disclosure controls
§404	Internal control assessment	Management must assess and report on ICFR effectiveness; external auditor must attest (for accelerated filers)
§802	Document retention	Audit workpapers must be retained for at least 7 years; destruction of audit records is a criminal offense
§906	Criminal penalties for false certification	Up to $5M fine and 20 years imprisonment for willfully false certification

Audit Committee Requirements (SOX §301)

All members must be independent directors (no compensation from the company other than board fees)
At least one financial expert (SEC definition: understanding of GAAP, experience with internal controls, audit committee experience)
Directly responsible for appointment, compensation, and oversight of external auditor
Must establish procedures for receiving confidential complaints about accounting matters (whistleblower hotline)
Authority to engage independent counsel and advisors
Pre-approve all audit and permitted non-audit services

COSO Enterprise Risk Management (ERM) Framework

Component	Description
Governance & Culture	Board oversight; establishing operating structure; defining desired culture; demonstrating commitment to core values
Strategy & Objective-Setting	Analyzing business context; defining risk appetite; aligning strategy with mission and values
Performance	Identifying risks; assessing severity; prioritizing risks; implementing risk responses; developing portfolio view
Review & Revision	Assessing substantial change; reviewing risk and performance; pursuing improvement in ERM
Information, Communication & Reporting	Leveraging information and technology; communicating risk information; reporting on risk, culture, and performance

Three Lines Model (Formerly Three Lines of Defense)

First Line: Management and operational controls (own and manage risks day to day)
Second Line: Risk management, compliance, and quality functions (provide oversight and expertise)
Third Line: Internal audit (independent assurance to the board and senior management)

Test your governance knowledge with BAR mini exams and study with CPA flashcards. Sign up free to access all CPA study tools.