Day 1: Governance Structure and Accountability Rights

Purpose of Corporate Governance

• Connect oversight with value, sustainability, integrity
• Distinguish strategic direction from day-to-day management
• Identify stakeholder interests to governance decisions
• Analyze failure caused by weak oversight

Board, Committees, and Management

• Define board, audit, risk committee roles
• Clarify management accountability for execution controls
• Prevent committees drifting into operational decisions
• Map decision across three governance bodies

Authority and Conflicts of Interest

• Set delegation boundaries according to consequence
• Identify disclosure, recusal, independent-review situations
• Address related-party transactions with appropriate safeguards
• Design decision process for conflict-of-interest case

Day 2: Internal Control System and Control Design

COSO Internal Control Components

• Connect control environment, risk, information, monitoring
• Translate principles into demonstrable working practices
• Assess tone as control-effectiveness driver
• Evaluate weak component within enterprise case

Risk-Based Control Design

• Define control purpose before selecting activity
• Balance prevention detection and correction
• Avoid excessive controls obstructing useful work
• Redesign a costly approval chain

Control Documentation and Ownership

• Describe control performer, timing, method
• Specify evidence required to demonstrate operation
• Assign controls to owners correcting failures
• Prepare process risk-control matrix

Day 3: Compliance System and Regulatory Obligations

Manageable Compliance Obligations

• Translate laws, contracts, policies into obligations
• Classify obligations by source and owner
• Connect regulatory change with affected processes
• Build obligations register for selected unit

Compliance Risk and Controls

• Estimate exposure created by noncompliance
• Distinguish regulatory from ordinary business controls
• Specify evidence sufficient to demonstrate compliance
• Analyze a gap against one requirement

Culture, Conduct, and Integrity

• Link incentives, behavior, and compliance exposure
• Operate speak-up channels and protect reporters
• Respond to breaches without selective enforcement
• Discuss case testing integrity in decision-making

Day 4: Three Lines and Combined Assurance

Positioning Roles Across the Three Lines

• Confirm management accountability for objectives, controls
• Define specialist challenge and monitoring functions
• Protect internal audit independence in assurance
• Resolve compliance and internal audit overlap

Enterprise Assurance Mapping

• Combine monitoring, inspection, review, audit sources
• Identify material controls lacking sufficient assurance
• Reduce duplicate testing over same control
• Build assurance map for compliance theme

Governance Reporting and Committees

• Define information at each oversight level
• Highlight recurring exceptions and control weaknesses
• Connect reports with decisions and owners
• Draft committee briefing on control weakness

Day 5: Governance, Compliance and Control Laboratory

Conducting Current-System Assessment

• Test consistency across structure, policies, practice
• Identify ownership, control, assurance gaps
• Prioritize improvements by exposure and significance
• Prepare a concise diagnostic for leadership

Target Governance and Control Framework

• Define essential committees rights and responsibilities
• Connect obligations registers with risk-control matrices
• Specify recurring reports and data sources
• Build operating map for control system

Audit Committee Simulation

• Present linked compliance and control issue
• Use questions uncovering cause and accountability
• Approve corrective actions using verified evidence
• Determine what later requires independent assurance

• Governance cases linking boards management and control functions
• Practical risk-control matrices and compliance obligation registers
• Role-allocation exercises using the Three Lines Model
• An audit committee simulation addressing an interconnected control issue