Corporate governance

CIMA-P3 · Chapter 5

Corporate governance

1 Why corporate governance is a risk topic

Corporate governance is the system by which companies are directed and controlled. It is examined in P3 because it is a risk control. Almost every large corporate failure of the last twenty-five years was, at bottom, a failure of direction and control: the risks the board should have been managing were the risks nobody in the organisation had the standing to challenge.

Corporate governance

The system by which companies are directed and controlled. It allocates rights and responsibilities between the board, management, shareholders and other stakeholders, and it sets out the rules and procedures by which decisions about the company are taken.

Its purpose in this paper is narrow and practical: governance is the mechanism through which an organisation decides how much risk it is willing to run, and through which somebody independent checks that it is running no more than that.

About the lecture for this chapter.

This recording predates the 2027 syllabus and the current edition of the UK Code. It is sound on what it covers; carry three things with you.

The five headings: the lecture asks you to learn leadership, effectiveness, accountability, remuneration and relations with shareholders. Those were the Code’s headings before 2018. The current UK Corporate Governance Code’s five sections are in section 5; everything taught under the old headings still holds and re-files: leadership under the Code’s sections 1 and 2, effectiveness under 3, accountability under 4, remuneration under 5, and relations with shareholders under 1.

Board and pay: at least half the board, excluding the chair, should be independent non-executive directors, and every director stands for re-election each year (section 5). The shareholder votes it describes, against pay already awarded, are advisory; the remuneration policy itself needs a binding vote at least every three years, and payments outside it are unlawful (section 6.4).

Notes-only: the 2024 declaration on material controls (section 5.1) and the risk committee (section 6.5).

YouTube video

The problem governance exists to solve is that the people who own a company are not the people who run it. Shareholders in a large company are numerous, dispersed and, historically, passive. Once they had appointed the board they often took very little further interest. The board, meanwhile, has the information, the time and the authority — and, left unchecked, an incentive to use all three in its own interest.

Until governance codes appeared, the only regular check on the board was the annual cycle shown below: the directors report once a year, an independent auditor gives an opinion on that report, and the shareholders read it. That cycle is worth understanding precisely, because everything a governance code adds is an attempt to plug the gaps in it.

Two features of that chain matter for risk:

the shareholders appoint both the directors and the external auditor — the auditor's independence rests on being answerable to the owners, not to the management being audited
the loop closes only once a year, and the report it carries is historical. A shareholder reading audited financial statements is learning what happened up to a balance sheet date that may be four months in the past, and the next report may be twelve or fifteen months away

Between those reports a great deal can happen. A dominant chief executive can commit the company to acquisitions the board never properly debated, award a remuneration package nobody independent has priced, or take on exposures nobody has measured. Enron (2001), WorldCom (2002) and the bank failures of 2008 were all discovered long after the decisions that caused them, and in each case the board was formally in place and the accounts had been audited.

Governance codes are the response. They do not add a new annual report; they add continuous structure — independent voices on the board, committees with defined remits, and an obligation to explain publicly when the structure is not followed.

2 Three theories of the board's duty

Governance debates usually turn on a prior question: whose interests is the board there to serve? Three answers are examined, and each carries a different view of what risk management is for.

Theory	What it says the board is	The risk it highlights	What it implies for risk management
Stewardship theory	A steward of the company's assets, trusted to conserve and grow them.	That stewards are undermined by passive owners who never check the stewardship.	Risk management protects the asset base. Emphasis falls on safeguarding, prudence and continuity.
Agency theory	An agent acting for the shareholders (the principals).	That agents pursue their own interests — pay, empire, prestige — rather than the principal's. This is the agency problem.	Risk management is a monitoring and incentive problem: align the agent's rewards with the owner's returns, and verify independently.
Stakeholder theory	A body owing a duty of care to a wider group — employees, pensioners, customers, suppliers, communities, the environment.	That a company can serve shareholders well while doing serious harm elsewhere, and that the harm eventually returns as risk.	Risk management is wider than financial exposure: it covers environmental, social and reputational risk, and the risk register reflects that.

The three are not alternatives to be chosen between in an exam answer. Agency theory explains why independent challenge and audit exist; stakeholder theory explains why modern codes require boards to consider the workforce, the environment and the long-term sustainability of the business. A good answer uses whichever one the scenario is asking about.

Stakeholder theory is the hardest to legislate for, because balancing the rights of a shareholder against those of an employee, a customer or a neighbour has no formula. Codes therefore deal with it by requiring the board to describe how it has considered those interests rather than by prescribing the answer.

3 International principles: the G20/OECD Principles

There is no global corporate governance law. What exists at international level is a set of high-level principles which individual countries then implement in their own way. The most widely used are the G20/OECD Principles of Corporate Governance, most recently revised in 2023. They are addressed to policymakers rather than to companies, and they are organised in six chapters:

ensuring the basis for an effective corporate governance framework
the rights and equitable treatment of shareholders and key ownership functions — including access to the same information, and protection for minority and foreign shareholders
institutional investors, stock markets and other intermediaries — the behaviour of the professional owners who now hold most listed equity
disclosure and transparency — timely and accurate information on all material matters
the responsibilities of the board — strategic guidance, effective monitoring of management, and accountability to the company and its shareholders
sustainability and resilience — added in the 2023 revision, covering climate and other sustainability-related risks and disclosures

The sixth chapter is the one to notice. The 2023 revision put sustainability and resilience alongside the traditional governance concerns for the first time, which is the international-level counterpart of the risk-reporting and cyber-reporting material later in this paper. The 2015 edition was organised in six chapters too — one of them the role of stakeholders in corporate governance. The 2023 revision redistributed that material and added sustainability and resilience in its place, so the change to notice is the subject matter, not the number of chapters.

Because the Principles are addressed to countries, the equitable-treatment point has a practical edge. A shareholder based on the other side of the world is inevitably slower to hear news than one in the same city as the head office, and a pension fund holding ten per cent of the shares will get the finance director's attention in a way a holder of one hundred shares never will. Equitable treatment means that price-sensitive information reaches all shareholders of a class at the same time — not that all shareholders get equal access to management.

4 How a governance code bites: rules or principles

Countries implement the international principles in two broadly different ways, and P3 names neither as the correct one.

Approach	Mechanism	Strengths	Weaknesses
Rules-based	Governance requirements are written into statute and enforced by law and by regulators, with criminal or civil penalties for breach.	Certain, enforceable, and the same for everyone. Non-compliance is unambiguous.	Rigid and expensive. It encourages box-ticking: a company can satisfy every rule and still be badly governed.
Principles-based (comply or explain)	A code sets out principles and provisions. Companies must either comply, or explain publicly why not. Enforcement is through the listing regime and shareholder pressure rather than the courts.	Flexible and proportionate. A departure that genuinely suits the business is permitted, and the explanation is itself information for shareholders.	Depends on shareholders reading and acting on the explanations. A boilerplate explanation is hard to police.

Comply or explain

A listed company must state in its annual report either that it has complied with each provision of the code, or which provisions it has departed from, for what period, why the departure was in the interests of the company, and — where the departure is intended to be temporary — when and how compliance will be restored. A departure the board intends to keep is equally capable of being explained: what the mechanism requires is a reasoned, company-specific explanation a shareholder can judge, not a promise to return to the provision. The code has no force of law: it is enforced through the listing rules of the exchange, whose ultimate sanction is to suspend or cancel the listing.

The point to take into the exam is that an explanation is not a confession. A departure is not automatically a governance failure — but an explanation that gives no reason, no period and — where the departure is temporary — no indication of when compliance will be restored is. A permanent alternative arrangement that is properly explained is not a failure either; a boilerplate sentence is.

Comply or explain

R plc is listed. Its chief executive resigned suddenly in March. The board asked the chair, who had been a non-executive director of R plc for six years, to act as executive chair while a successor was recruited. She did so for seven months of the financial year. R plc's annual report says only: “The company complied with the Code throughout the year except in respect of the separation of the roles of chair and chief executive.”

Required

State the governance provision R plc departed from, and the risk that provision exists to control.
Explain why R plc's disclosure is inadequate, and what an adequate one would contain.

Comply or explain

(a) The provision and the risk

The provision is the separation of the roles of chair and chief executive: no one individual should have unfettered powers of decision. The risk it controls is the dominant individual — a single person who both sets the board's agenda and runs the business, so that the body meant to challenge management is chaired by management. That was a common feature of the major governance failures, and it is why the provision exists.

Do not turn that into a second, different allegation. The Code applies a separate test — the chair should be independent on appointment — and taking executive duties now says nothing about whether she met it then. The scenario gives no facts about her appointment as chair, so the breach to argue is the combined role, not a retrospective finding that she was never independent. What can properly be added is that the Code treats service of more than nine years from first appointment as a threat to independence, so the board should say where she stands on that and how the six years already served have been assessed.

(b) Why the disclosure is inadequate

Comply or explain requires an explanation, and R plc has given only an admission. An adequate disclosure would state:

the provision departed from, and the exact period of the departure (seven months, from March);
why the board considered the departure to be in the interests of the company — here, that continuity of leadership during an unplanned succession outweighed the temporary loss of separation;
what mitigations were put in place — for example a senior independent director given an enhanced role, or a commitment that the chair would not sit on the nomination committee for the successor;
when and how compliance would be restored — the appointment of a chief executive and the chair's reversion to a non-executive role.

Without those four elements a shareholder cannot judge the departure, which is the entire purpose of the mechanism.

5 A code in practice: the UK Corporate Governance Code

P3B3 names no national regime. What it names are the roles — the separation of chief executive and chair, non-executive directors, the audit, remuneration, risk and nomination committees, and directors' remuneration. The UK Corporate Governance Code is used here as one illustration of how those roles are given effect, because it is the code most CIMA material quotes. The principles it expresses are found, in different words, in codes all over the world.

The Code is issued by the Financial Reporting Council. The current edition is the 2024 edition, which applies to financial years beginning on or after 1 January 2025, with its new board declaration on internal controls applying a year later. It is structured as five sections, each containing Principles (which companies must apply) and Provisions (which they must comply with or explain).

Section of the Code	What it covers	The risk it addresses
1 Board leadership and company purpose	An effective board, collectively responsible for the long-term sustainable success of the company; purpose, values and culture; engagement with shareholders and the workforce; and the board's assessment of the company's position and prospects.	Strategic drift, a culture that quietly rewards the wrong behaviour, and owners who never hear from the board between reports.
2 Division of responsibilities	The roles of chair and chief executive held by different individuals; a chair who is independent on appointment; at least half the board, excluding the chair, independent non-executive directors; a senior independent director; and enough time committed by every director.	The dominant individual, and a board with nobody able or willing to challenge the executive.
3 Composition, succession and evaluation	A formal, rigorous and transparent appointment procedure through a nomination committee; succession planning; board diversity; induction and development; annual evaluation of the board, its committees and individual directors; annual re-election.	Boards appointed by acquaintance, boards without the skills the strategy needs, and directors whose performance is never assessed.
4 Audit, risk and internal control	An audit committee of independent non-executive directors; the relationship with the external auditor; the board's identification of the principal risks and its statement of risk appetite; monitoring and annual review of the risk management and internal control framework; going concern and long-term viability.	Financial misstatement, unmanaged principal risks, and controls that exist on paper but not in practice. This is the section this paper is built on.
5 Remuneration	A remuneration committee of independent non-executive directors; remuneration policy that supports strategy and long-term success; variable pay linked to performance and subject to malus and clawback; no director involved in deciding his or her own pay.	Pay that rewards short-term reported profit, and so buys short-term risk-taking at the shareholders' expense.

5.1 What the 2024 edition changed

One change matters to this paper. Under the 2024 edition the board must declare in the annual report whether the company's material controls were effective at the balance sheet date, describe how it monitored and reviewed the risk management and internal control framework, and describe any material controls that did not operate effectively together with what is being done about them.

That is a significant tightening. A statement that the board has reviewed the effectiveness of its controls says only that a review happened. A declaration that the material controls were effective puts the board's name to the outcome, and makes the quality of the underlying control work — the subject of Chapter 6 — a board-level exposure rather than an internal audit matter.

The Code is not statute and it does not apply to every company. It applies, through the listing rules, to companies whose equity shares are admitted to the FCA’s equity shares (commercial companies) category and to closed-ended investment funds; other quoted and private companies follow lighter regimes or none. Size alone is not an exemption — a small company in the commercial companies category is in scope, and the Code’s only concessions to size are a few committee minima. When a scenario tells you the company is unlisted, the Code's provisions are best practice to be argued for, not obligations to be asserted.

6 The board's committees

A committee is how a board gives a task to people who can perform it independently of the executives it concerns. Independent membership is what makes a committee work, but the Code does not set the same membership rule for all four. The audit and remuneration committees are composed of independent non-executive directors only; the nomination committee must have a majority of independent non-executive directors; and where the board delegates risk oversight to a separate board risk committee, that committee too is composed of independent non-executive directors. Membership is a different question from attendance in every case: executives, the risk function, internal audit and outside specialists routinely attend and advise, and it is membership — who is in the room when the committee decides — that carries the independence.

6.1 Non-executive directors

A non-executive director is a full member of the board with full voting rights, but takes no part in day-to-day management. Executive directors — finance, operations, sales, IT — run functions. Non-executives sit on the board to monitor, advise, warn and, where necessary, vote against.

they should be of sufficient standing and experience to constructively challenge the executive, which is why a token appointment defeats the purpose
the UK Code’s board rule is that at least half the board, excluding the chair, should be independent non-executive directors. That is the board rule and it carries no smaller-company exception; the Code’s concessions to size are committee minima — an audit or remuneration committee of two rather than three independent non-executive directors — not a lower standard for the board itself
independence is judged on substance: length of service, former employment, material business relationships, cross-directorships and close family ties all threaten it
their fees should not be performance-related. A non-executive whose income rises with reported profit has been given the very incentive the board appointed them to police

6.2 The nomination committee

The nomination committee leads the process for board appointments and makes recommendations to the board. Its existence answers a specific abuse: directors appointing their acquaintances, who then feel obliged to the person who appointed them and are reluctant to vote against him.

it identifies the balance of skills, experience, independence and knowledge the board needs, and recruits against that specification
it plans succession for both the board and senior management, so that an unplanned departure does not force the kind of improvised arrangement seen in Example 1
it oversees induction for new directors and the development of existing ones
a majority of its members are independent non-executive directors — this is the one committee for which the Code sets a majority rather than an exclusively independent membership — and it is chaired by an independent non-executive director, or by the chair of the board, though not when the committee is choosing the chair's own successor

6.3 The audit committee

The audit committee is composed of independent non-executive directors, at least one of whom has recent and relevant financial experience. It is the single most important governance structure in this paper, because it is the point at which an auditor with bad news can reach the board without going through the person the bad news is about.

Before audit committees existed, both the external and the internal auditors dealt principally with the finance director — the person most often responsible for the accounting and control problems they were reporting. Auditors were reporting problems to the person who had caused them, and to the person who controlled the internal auditors' pay and promotion.

Responsibility	What the committee actually does	Why it reduces risk
Relationship with the external auditor	Recommends the appointment, removal and fees of the external auditor to the board; agrees the scope of any work beyond the statutory audit; reviews the auditor's independence and any non-audit services.	Removes the auditor's commercial dependence on the management it audits.
A route for the auditor's concerns	Receives the auditor's reservations about the financial statements, and any complaint that information or explanations are being withheld, and can raise either at the main board.	A finance director can no longer filter, delay or bury an auditor's finding.
Review of the financial statements	Reviews the significant judgements in the accounts, the going concern and viability assessments, and the fairness and balance of the narrative reporting.	Independent scrutiny of exactly the areas where management judgement can shade into misstatement.
Review of internal control	Reviews the effectiveness of the internal control system on the board's behalf, and supports the board's declaration on material controls.	Turns a board-level statement into work somebody independent has actually done.
Review of internal audit	Approves the internal audit plan, receives its reports, assesses its effectiveness and resourcing, and — where there is no internal audit function — keeps the need for one under annual review.	Internal audit reports to a body that does not manage the areas it audits, which is the foundation of its independence (Chapter 6).
Special investigations	Commissions investigations, from internal audit, the external auditor or a third party, into suspected fraud, bribery or control breakdown.	Ensures an investigation into management can be commissioned by somebody who is not management.

6.4 The remuneration committee and directors' remuneration

The remuneration committee is composed of independent non-executive directors. It sets the remuneration of the executive directors and the chair, so that no director is involved in deciding his or her own pay. It does not set the fees of the non-executive directors, which are a matter for the board or the shareholders.

The principles it works to are consistent across codes:

remuneration should be sufficient to attract, retain and motivate directors of the necessary quality, but no more than necessary. The cheapest available director is not a saving
a significant proportion of executive remuneration should be linked to corporate and individual performance, so that what is good for shareholders is good for the director
variable pay should be measured over the long term, and share awards should carry a total vesting and holding period of several years, so that a director cannot manipulate one year's reported profit into a bonus
malus and clawback provisions should allow awards to be reduced before payment, or recovered after it, where performance turns out to have been misstated or misconduct emerges
the policy should be put to shareholders, and the committee should be able to explain how it supports strategy. In the UK the two pay votes are different animals, and the exam can turn on it: a quoted company’s remuneration policy must be approved by a binding shareholder vote at least every three years, and payments outside an approved policy are unlawful, whereas the annual report on how the policy was implemented carries only an advisory vote. A shareholder “revolt” reported in the press is usually the advisory one

Performance-linked pay is itself a risk. An award that pays out on an upside but costs the director nothing on the downside is a one-way bet, and one-way bets encourage risk-taking. Long vesting periods, holding periods, deferral and clawback exist to make the director's exposure look more like a shareholder's.

Share options and the incentive they create

V plc's shares are currently $9. Its remuneration committee grants each executive director 100,000 share options with an exercise price of $14, exercisable after a five-year vesting period.

Required

Calculate the gain a director would make on exercising the options in full if, at the end of the vesting period, the share price is (i) $12 and (ii) $16.
Explain the incentive this award creates, and two features the committee should add to control it.

Share options and the incentive they create

(a) Gain on exercise

	Share price $12	Share price $16
Exercise price	$14	$14
Option exercised?	No – the option is out of the money	Yes
Gain per option	nil	$16 − $14 = $2
Gain on 100,000 options	$nil	$200,000

At $12 the director would be paying $14 for a share worth $12, so the options simply lapse. At $16 the director buys at $14 and can sell at $16, a gain of $2 × 100,000 = $200,000.

(b) The incentive, and how to control it

The award pays the director for share price growth above $14 and costs nothing if the price falls. Because the downside is capped at zero and the upside is not, the director's rational response is to take more risk than a shareholder would want: a strategy with a small chance of taking the price to $20 and a large chance of taking it to $6 is attractive to the option holder and disastrous for the owner. The award has bought the wrong behaviour while appearing to align interests.

Features that control it — any two of the following would answer the requirement:

a holding period after vesting — the director must retain the shares for a further period, so that value destroyed after the measurement date is felt personally
malus and clawback — the award can be cut before payment or recovered afterwards if the performance it rewarded proves to have been misstated, or if misconduct comes to light
a performance condition beyond the share price alone — for example a relative measure against a peer group, so that a market-wide rise does not pay out as if it were management's achievement

Whichever two are chosen, the underlying discipline is the same: the committee should test the range of outcomes the award could produce, not only the intended one — the sensitivity thinking Chapter 4 applies to investment decisions, applied to a pay package.

6.5 The risk committee

The fourth committee is the one most often missing from older material, and P3B3 names it explicitly. Where the audit committee looks principally at financial reporting and control, a risk committee looks at the whole risk profile of the business — strategic, operational, financial, compliance, cyber, reputational — and at whether the risks the company is running are the risks the board decided it wanted to run. The Code envisages this as a committee of the board: where the audit committee’s internal control and risk management work is instead given to a separate board risk committee, that committee is composed of independent non-executive directors. It is not the same body as a management risk committee — an executive forum chaired by the chief executive or the chief risk officer, which runs the risk process rather than overseeing it. Both exist in many companies, and an exam scenario that describes executives sitting on “the risk committee” is usually describing the management one.

Its work typically covers:

recommending the board's risk appetite and tolerances, and reviewing them as strategy changes
reviewing the principal risks and emerging risks reported in the risk register, and challenging the assessments behind them
overseeing the risk management framework, the risk function and its resourcing
reviewing risk-related disclosures in the annual report, including the principal risks and the viability statement
advising the remuneration committee on whether the incentives being offered are consistent with the agreed risk appetite — a link the 2008 bank failures made unavoidable

Whether a company needs a separate risk committee is a judgement, and the exam can ask for it either way:

	Audit committee	Risk committee
Principal focus	Financial reporting, external and internal audit, and the effectiveness of internal control.	The organisation's risk profile as a whole, and its appetite for risk.
Time perspective	Largely retrospective — has what happened been properly recorded, controlled and reported?	Largely prospective — what could happen, how much of it are we prepared to accept, and are we positioned for it?
Membership	Independent non-executive directors only.	Independent non-executive directors, where it is a committee of the board. Executives, the chief risk officer, internal audit and outside specialists attend and advise — risk expertise is often technical — but attendance is not membership. A management risk committee, which is a different body, is made up of executives.
Reports to	The board.	The board.
When a separate committee is justified	—	Where the risk profile is large, technical or fast-moving — financial services, energy, pharmaceuticals, or any business with a substantial cyber or regulatory exposure — so that risk oversight would otherwise crowd out the audit committee's reporting work.
When one committee will do	—	In a smaller or simpler company, combining the two (an “audit and risk committee”) avoids duplication and the risk that each committee assumes the other is covering an item.

The committee is a board structure. It is not the same thing as the management-level risk function that maintains the risk register day to day, and it is not internal audit. The distinction between the risk manager and the internal auditor — the one who owns and operates the risk process, and the one who independently assures it — is set out in Chapter 6, Internal control and auditing.

7 Governance failure and its impact on strategy

P3B3b asks for something more specific than a list of scandals: it asks how a failure of governance damages an organisation's strategy. The link is not simply that failures are expensive. It is that a governance failure removes the mechanisms an organisation relies on to choose, fund and change its strategy.

Governance weakness	How it fails	Effect on strategy
A dominant individual (chair and chief executive combined, or a board unwilling to challenge)	Major decisions are taken without genuine collective debate. Dissent is discouraged rather than answered.	Strategic options are never properly compared. The company commits to whichever direction one person favours, and the errors compound because there is no mechanism to reverse them.
A weak or captured audit committee	Accounting judgements are not independently challenged; auditors' concerns are filtered by management.	Misstatement, then restatement. Once reported results cannot be relied upon, the cost of capital rises and the ability to raise equity or debt for the strategy disappears — which is how accounting failures become terminal.
Remuneration tied to short-term reported performance	Directors are paid for this year's earnings and bear no cost for next year's consequences.	Systematic underinvestment in anything with a long payback — research, maintenance, systems, people — and a bias toward acquisitions and disposals that flatter short-term measures. The strategy is quietly sold for the bonus.
No agreed risk appetite, or no risk committee	Risk decisions are taken piecemeal by whoever is closest to them, with no organisation-wide view of the aggregate exposure.	The company discovers its true exposure only when a risk crystallises. Strategy is then set by the crisis — emergency disposals, rescue funding, retrenchment — rather than by choice.
Poor disclosure and weak shareholder engagement	Owners learn about problems late and from outside the company.	Loss of trust is priced in. Institutional shareholders discount the shares, oppose resolutions and resist the capital raisings the strategy needs; management time goes into defence rather than execution.

The historic illustrations remain instructive, and should be dated honestly. Enron (collapsed 2001) combined a dominant leadership, off-balance-sheet structures the board did not understand, and an auditor whose consultancy income exceeded its audit fee. WorldCom (2002) was a straightforward accounting fraud that a strong audit committee and a resourced internal audit function would have found earlier — internal audit did in fact find it. The bank failures of 2007–2009 were, in governance terms, failures of risk oversight: boards that had not set a risk appetite, remuneration that paid for volume, and non-executives without the technical knowledge to challenge what they were being told. Each of those three diagnoses produced a specific reform — auditor independence rules, audit committees with financial expertise, and board risk committees respectively.

Diagnosing governance risk

H plc is listed. Its board has nine members: the chief executive, who has also been chair since the previous chair retired two years ago; five other executive directors; and three non-executive directors, one of whom was H plc's finance director until four years ago and one of whom is a partner in H plc's principal law firm.

The audit committee consists of the three non-executive directors and is chaired by the former finance director. There is no risk committee. Executive bonuses are 100% dependent on the growth in reported earnings per share for the year, and are paid in cash each March. H plc is about to launch a large debt-funded acquisition programme.

Required

Identify four governance weaknesses at H plc, and for each state the strategic risk it creates and the change that would address it.

Diagnosing governance risk

Weakness	Strategic risk created	Change required
The roles of chair and chief executive are combined.	One person sets the board's agenda and runs the company. A debt-funded acquisition programme is exactly the kind of decision that needs collective challenge, and there is no structure to provide it.	Appoint a separate chair, independent on appointment. In the interim, appoint a senior independent director and disclose the departure under comply or explain.
Only three of nine directors are non-executive, and two of those three are not independent — one is a recent former finance director, the other is a partner in the company's principal law firm.	There is effectively one independent voice on a board of nine. The executive can carry any vote, so board approval of the acquisition programme is a formality rather than a control.	Recruit additional independent non-executive directors through the nomination committee so that at least half the board, excluding the chair, is independent.
The audit committee is chaired by the former finance director and contains no independent member with a clean relationship to the company.	The committee cannot credibly review the financial reporting and controls of a period much of which the chair was responsible for. Acquisition accounting — goodwill, fair values, provisions — will be judged by the person least able to be objective about it.	Reconstitute the committee with independent non-executive directors, at least one having recent and relevant financial experience, and appoint a different chair.
Bonuses are wholly dependent on one year's earnings per share growth, paid in cash annually, with no risk committee to comment on the incentive.	A debt-funded acquisition raises earnings per share immediately whenever the target's earnings yield exceeds the after-tax cost of the debt — whether or not the acquisition creates value. The directors are being paid to do the deals rather than to do the right deals, and the aggregate risk of the programme is not being assessed anywhere.	Rebalance the package onto multi-year measures with deferral, a holding period and clawback; and establish a risk committee (or an audit and risk committee) to set and monitor risk appetite for the acquisition programme.

A fifth point is available if required: H plc has no succession plan — the chair's retirement was met by doubling up the chief executive rather than by an appointment process, which is a nomination committee failure.

8 Test your knowledge

Two quick checks before you move on: work through the flashcards to fix this chapter’s key terms and definitions, then sit the objective questions for exam-style practice. Both mark themselves and explain the answers as you go.

Answer the questions one at a time. Your progress is saved so you can leave and come back.

Open chapter practice