Corporate governance structure and responsibilities | CMA Governance, risk and compliance

Learning outcome statements

The learning outcome statements relevant for this section are:

explain how a company’s organizational structure, policies, objectives, and goals, as well as its management philosophy and style, influence the scope and effectiveness of the control environment
identify the Board of Directors’ responsibilities with respect to ensuring that the company is operated in the best interest of shareholders
identify the hierarchy of corporate governance (i.e., articles of incorporation, bylaws, policies, and procedures)
demonstrate an understanding of corporate governance, including rights and responsibilities of the CEO, the CFO, the Board of Directors, the audit committee, managers, and other stakeholders; and the procedures for making corporate decisions

What is corporate governance

Definitions

Corporate governance: The system of rules, practices, processes, and organizational structures that guide and control the way a company is directed and managed.

Corporate governance establishes the framework for achieving a company’s objectives, ensuring accountability, fairness, and transparency in the relationship among a company’s management, board of directors, shareholders, and other stakeholders.

Influence of organizational attributes on the control environment

The effectiveness of a company’s control environment is significantly shaped by various elements of its governance structure. These include the company’s organizational structure, management philosophy, operating style, and strategic objectives. A company with clearly defined goals, consistent values, and an ethical culture is more likely to establish a robust control environment. For example, a decentralized structure may promote innovation but could also increase risks if not properly monitored. Similarly, a management philosophy that values aggressive growth over regulatory compliance may undermine the control environment.

Personnel policies, accountability mechanisms, and communication protocols also reinforce governance by embedding expectations of integrity and performance throughout the organization.

The board of directors and the agency perspective

Central to corporate governance is the role of the Board of Directors, which acts as a fiduciary for shareholders. The Board is responsible for overseeing management’s actions, guiding corporate strategy, and ensuring the company operates in the best interests of its owners. This aligns with agency theory, which highlights the inherent tension between the interests of shareholders (principals) and management (agents). Without proper oversight, managers may pursue personal goals at the expense of shareholders’ wealth.

To mitigate agency risks, the Board can implement a variety of governance mechanisms. These include establishing independent audit and compensation committees, separating the roles of CEO and Chairperson, and tying executive compensation to long-term performance metrics such as return on equity or total shareholder return.

Policies that promote transparency (e.g., mandatory disclosure of related party transactions and whistleblower protection) also strengthen accountability. Regular board evaluations, director training, and a strong code of ethics further ensure that management actions align with shareholder interests. The Board must establish clear governance policies, monitor executive performance, set ethical standards, and ensure transparent reporting. Independence, competence, and active engagement are critical qualities that empower the Board to fulfill its governance responsibilities effectively.

The specific rights and responsibilities of the CEO, CFO, audit committee, and other stakeholders are covered in detail in the next chapter, Corporate governance roles and responsibilities.

The hierarchy of corporate governance

Corporate governance can be understood through two interrelated hierarchies:

the organizational (stakeholder) hierarchy and
the documentary (legal and procedural) hierarchy.

Each plays a distinct but complementary role in shaping how governance is established, maintained, and enforced within an entity.

Showing organizational and documentary hierarchies branching from corporate governance. — Corporate Governance Hierarchy

Organizational hierarchy of governance

This hierarchy defines the distribution of authority and oversight roles among different stakeholders within a company:

Shareholders: As the owners of the company, shareholders hold ultimate authority and typically exercise their power through voting rights at general meetings. They appoint members of the Board of Directors and can influence key strategic decisions through resolutions and shareholder activism.
Board of directors: Elected by shareholders, the Board is responsible for setting the company’s strategic direction, ensuring effective risk management, and overseeing executive performance. The Board operates through various committees, such as audit, risk, and compensation committees, which help in specialized oversight.
Executive management (e.g., CEO, CFO): Executives are accountable for the day-to-day management of the company. They translate the Board’s strategic vision into operational plans, implement policies, and manage performance. Executives also play a central role in promoting corporate culture and values.
Middle management and operational staff: These individuals execute corporate policies and procedures within their functional areas. They are the front line of governance, ensuring that activities align with organizational standards and that risks are reported and addressed appropriately.

This hierarchy ensures that checks and balances are embedded within the organizational structure: authority is delegated downward from shareholders to the Board to management, while accountability flows upward, with management answerable to the Board and the Board answerable to shareholders.

Other functions independent from the ones identified above are the internal and external audit functions:

Internal auditors: Operating independently from management, internal auditors assess the effectiveness of internal controls, risk management, and governance processes. They report directly to the audit committee or Board, providing assurance and recommendations for improvement.
External auditors: Appointed, compensated, and overseen by the audit committee (in public companies, often with shareholder ratification), external auditors offer an independent assessment of the company’s financial statements and, in some cases, internal controls. They serve as a critical external check on financial transparency and governance integrity.

Pitfall: internal audit reports functionally to the audit committee or Board, which is what preserves its independence, but administratively to management, which handles day-to-day matters like budget and staffing. Mixing up these two reporting lines is a common point of confusion.

Documentary hierarchy of governance

The second hierarchy consists of the formal documentation that governs how decisions are made and operations are conducted. These sources of authority typically follow this order:

Articles of incorporation (or Charter): This foundational legal document formally creates the corporation, outlines its purpose, and defines its basic legal framework, including the rights of shareholders and powers of directors.
Bylaws: These internal rules provide more detailed guidance on the governance structure, such as the frequency and procedures of board meetings, voting processes, and the roles of corporate officers.
Corporate policies: These articulate the organization’s standards and expectations in areas such as ethics, compliance, risk management, financial reporting, and information security. Policies guide consistent decision-making across the organization.
Procedures and operating manuals: These provide step-by-step instructions for implementing corporate policies in daily operations. They ensure that employees understand their responsibilities and execute tasks in line with governance standards.

Each level must be consistent with, and is subordinate to, the levels above it: bylaws cannot contradict the articles of incorporation, and policies and procedures cannot contradict the bylaws. Where a conflict arises, the higher-level document prevails.

For example, if the bylaws require board approval for any related-party transaction, a policy that lets a single officer approve such transactions without board sign-off is invalid, since it conflicts with the higher-level document.

Procedures for making corporate decisions

Corporate decision-making follows a hierarchical and procedural structure guided by governance documents, regulatory requirements, and industry best practices.

Strategic decisions are typically proposed by management and reviewed and approved by the Board of Directors. Operational decisions fall under the domain of executives and managers, within the boundaries set by board-approved policies.

Decision-making processes often include:

Proposal development by relevant departments
Internal review by management and functional committees
Presentation to the board or appropriate committee for approval
Documentation of decisions in meeting minutes and policy updates

In the United States, these procedures are influenced by legal and regulatory frameworks, including the Sarbanes-Oxley Act of 2002 (SOX) and Securities and Exchange Commission (SEC) rules, which promote transparency, accountability, and sound internal controls in public companies. These regulations emphasize the need for formalized decision-making structures and adequate documentation to support corporate governance and protect stakeholder interests.