CPA Ethics and Governance Cheat Sheet

Accounting and Society

15% of exam
Public Interest Social Contract Audit Expectation Gap IFAC vs APESB Roles IFEA (2023)

Ethics

20% of exam
Five Fundamental Principles Threats & Safeguards Framework Ethical Theories & Decision Models Independence Standards Tucker's 5 Questions

Governance Concepts

25% of exam
Corporate Form & Theories ASX 8 Principles (4th Ed.) Global Codes & Regulators Agency vs Stewardship Theory ASX 8 Principles Grouped

Governance in Practice

25% of exam
Board & Committees Remuneration & Risk Oversight Whistleblowing & Cyber Duties Two-Strikes Escalation Malus vs Clawback Timing

Corporate Accountability

15% of exam
CSR & Sustainability Reporting GRI vs ISSB Standards AASB S1 vs AASB S2 CSR Materiality Lenses AASB S1 vs S2 Status

Quick Facts

Exam E&G (CPA Program)
Body CPA Australia
Time 195 min (225 total)
Pass 540 scaled (100-900 scale)
Format Open book, computer-based
Modules Five official modules
Core Code APES 110
Question Type MCQ + extended response

IFAC vs APESB Roles AC

IFAC

Global federation of accountancy bodies
Sets member-body obligations only
Does not discipline individual accountants

APESB

Australian ethics standard-setter
Issues APES 110 directly
Independent of CPA Australia
Global body vs local standard-setter

Profession & Public Interest AC

Social Contract Trust for privileges granted
Public Interest Comes before client or employer
Audit Expectation Gap Belief vs actual assurance level
IFAC Global accountancy body, sets obligations
IFEA (2023) Houses IESBA and IAASB now
APESB Sets ethics standards, e.g. APES 110
AASB Sets accounting standards
AUASB Sets auditing standards

Five Principles Mnemonic ET

Integrity -> Objectivity -> Competence -> Confidentiality -> Behaviour
Integrity: honest, straightforward Objectivity: no bias or influence Competence: skill and diligence Confidentiality: limited disclosure duty Behaviour: comply, avoid discredit

Independence of Mind vs Appearance ET

Independence of Mind

Internal, subjective state
Actual objectivity in mind
Auditor's honest judgment

Independence in Appearance

Judged by outside perception
RITP test applied
Perception equals reality here
Both pillars are mandatory

Threat Response Steps ET

Threat is already acceptable → Proceed, monitor situation ( No action required )
Can remove the circumstance → Eliminate the threat ( R120.10(a) )
Threat can be reduced → Apply safeguards ( R120.10(b) )
Threat stays unacceptable still → Decline or end activity ( R120.10(c) )
Your superior is implicated → Escalate to higher authority ( Skip the compromised level )
Internal escalation gets nowhere → Brief the board or TCWG ( Audit committee, independent NEDs )
Governance route stays unresolved → Get independent external advice ( Ethics service or lawyer )
Client breaks a law → Apply the NOCLAR response ( Sections 260 and 360 )

Five Fundamental Principles ET

Integrity Honest and straightforward R111.1
Objectivity No bias or undue influence R112.1
Competence & Due Care Skill plus diligent care R113.1
Confidentiality No unauthorized disclosure R114
Professional Behaviour Comply, avoid discredit R115
Disassociation Duty Not associated with misleading reports R111.2

Five Threats Mnemonic ET

Self-interest, self-review, advocacy, familiarity, intimidation
Self-interest: your own gain Self-review: judge own work Advocacy: promote a position Familiarity: too close, biased Intimidation: pressured or coerced

Teleological vs Deontological Ethics ET

Teleological

Judge by the outcome
Utilitarian cost-benefit calculus
Used in AAA step six

Deontological

Judge by duty, rules
Rule-based consistency filter
Used in AAA step five
Outcome focus vs rule focus

Ethical Model Selector ET

Personal reporting dilemma → Use the AAA model ( Sequential seven steps )
Corporate strategic decision → Use Tucker's five questions ( Stakeholder filter check )
An option is illegal → Reject it immediately ( No mitigation possible )
An option is only unfair → Add a mitigation plan ( Compensate the affected group )
Weighing rules against outcomes → Filter first, then assess ( AAA steps five, six )

Threats & Safeguards Framework ET

Self-interest Own financial or personal gain
Self-review Re-judging your own work
Advocacy Promoting a client's position
Familiarity Too close, relationship bias
Intimidation Pressured or coerced judgment
RITP Test Reasonable informed third party
Eliminate Remove the threatening circumstance R120.10(a)
Safeguard Reduce threat to acceptable R120.10(b)
Decline or End Exit if threat remains R120.10(c)

Tucker's 5 Questions ET

Profitable -> Legal -> Fair -> Right -> Sustainable
Profitable: economic return Legal: statutory compliance Fair: equitable distribution Right: moral duty, honesty Sustainable: environmental, long-term

Ethical Theories & Decision Models ET

Teleological Judge by outcomes
Deontological Judge by duty, rules
Virtue Ethics Judge by character
Egoism Maximise own self-interest
AAA Model Seven-step accountant process
Tucker Model Five-question corporate filter
NOCLAR Respond to client law breach s260/360

Independence Standards ET

Independence of Mind Actual, internal objectivity
Independence in Appearance Perceived by a reasonable party
Part 4A Audit and review engagements
Part 4B Other assurance engagements
PIE Public interest entity, stricter rules

ASX 8 Principles Grouped GO

P1-2 board, P3 culture, P4-6 reporting, P7-8 risk+pay
P1: Lay solid foundations P2: Structure board effectively P3: Instil ethical culture P4: Safeguard report integrity P5: Timely balanced disclosure P6: Respect security holders P7: Recognise and manage risk P8: Remunerate fairly, responsibly

Agency vs Stewardship Theory GO

Agency Theory

Managers may self-serve
Needs monitoring and incentives
Assumes distrust by default

Stewardship Theory

Managers as trustworthy stewards
Needs empowerment, not control
Assumes trust by default
Distrust vs trust as default

Corporate Form & Theories GO

Separate Legal Personality Company owns itself
Limited Liability Shareholder risk is capped
Perpetual Succession Company outlives its owners
Agency Theory Managers may self-serve
Stewardship Theory Managers are trustworthy stewards
Stakeholder Theory Accountable to all affected
Resource Dependency Control over external resources
Managerial Hegemony Management dominates a weak board

ASX 8 Principles (4th Ed.) GO

Principle 1 Lay solid foundations
Principle 2 Structure board effectively
Principle 3 Instil ethical, lawful culture
Principle 4 Safeguard reporting integrity
Principle 5 Timely, balanced disclosure
Principle 6 Respect security holder rights
Principle 7 Recognise and manage risk
Principle 8 Remunerate fairly, responsibly
If Not, Why Not Explain any departure

Global Codes & Regulators GO

UK Code 2024 Comply or explain basis
Section 172 UK enlightened shareholder value
Sarbanes-Oxley US rules-based regime
OECD Principles G20 global benchmark
ASIC Market conduct regulator
APRA Prudential safety regulator
ACCC Competition and consumer regulator
Twin Peaks ASIC plus APRA model

Two-Strikes Escalation GO

25% Twice -> Spill Vote -> 90-Day Meeting
Strike 1: 25%+ against once Strike 2: 25%+ against again Spill vote: majority triggers s250V Spill meeting: within 90 days

Malus vs Clawback GO

Malus

Applies before reward vests
Forfeits an unpaid amount
Reduces a future payout

Clawback

Applies after reward is paid
Reclaims an already-paid amount
Recovers a past payout
Unpaid risk vs paid recovery

Two-Strikes Escalation GO

First AGM, 25%+ against → Record a first strike ( Board must explain next year )
Second AGM, 25%+ again → Put a spill resolution ( s250V )
Majority backs the spill → Call a spill meeting ( s250W )
Executive reward not yet paid → Apply malus ( Forfeit before vesting )
Reward already paid out → Apply clawback ( Reclaim the paid amount )

Board & Committees GO

Board Role Set strategy, oversee management
Management Role Run daily operations
Chair-CEO Split Chair independent, not CEO
Audit Committee Rec 4.1: three-plus, independent-chaired
Independent Director No material relationship
Board Diversity Reduces groupthink risk
Malus Forfeit unvested reward
Clawback Recover already-paid reward

NDB Scheme vs SOCI Act GO

NDB Scheme

Covers Privacy Act breaches
Regulator is the OAIC
Assess within 30 days

SOCI Act

Covers critical infrastructure assets
Regulator is the ACSC
Report in 12 or 72 hours
Data privacy vs infrastructure risk

Cyber & Privacy Response GO

Significant impact on CI asset → Report to ASD ACSC in 12h ( SOCI Act deadline )
Relevant impact on CI asset → Report to ASD ACSC in 72h ( SOCI Act deadline )
Suspect an eligible breach → Assess it within 30 days ( Privacy Act s26WH )
Serious harm is likely → Notify OAIC and individuals ( NDB scheme duty )
Remedial action stops the harm → No notification is required ( Safe harbour, s26WF )

Remuneration & Risk Oversight GO

Section 300A Requires a remuneration report
Section 308(3C) Auditor opines on report
Two-Strikes 25%+ against, twice [s250U] s250R
Spill Resolution Majority vote triggers re-election s250V
Spill Meeting Held within 90 days s250W
Three Lines of Defence Operations, risk, audit layers
COSO ERM Enterprise risk management framework
CPS 511 APRA's remuneration standard

Remuneration Vote vs Spill Vote GO

Remuneration Vote

Non-binding, advisory only
Held at every AGM
No automatic consequence

Spill Resolution

Binding escalation trigger
Needs two consecutive strikes
Forces director re-election
Advisory vote vs escalation trigger

Whistleblowing & Cyber Duties GO

Part 9.4AAA Corporate whistleblower protection regime
Eligible Discloser Officer, employee, or contractor
Large Proprietary 2 of 3: revenue, assets, staff
APPs Thirteen privacy principles
NDB Scheme Notify serious-harm data breach
30-Day Rule Assess a suspected breach
SOCI Act Eleven critical infrastructure sectors
Incident Reporting 12h significant, 72h relevant impact

CSR Materiality Lenses CO

GRI = Impact | ISSB = Financial | Both = Double
GRI: society's impact lens ISSB: investor's financial lens CSRD: double materiality, both lenses

GRI vs ISSB Standards CO

GRI

Impact materiality, inside-out lens
Serves multiple stakeholder groups
Set by the GSSB

ISSB / IFRS

Financial materiality, outside-in lens
Serves capital providers mainly
Set by the IFRS Foundation
Society lens vs investor lens

CSR & Sustainability Reporting CO

Triple Bottom Line Profit, people, and planet
Carroll's Pyramid Economic up to philanthropic
Legitimacy Theory Match society's values, norms
Stakeholder Theory Accountable beyond just shareholders
GRI Impact materiality, inside-out lens
Integrated Reporting Six capitals create value
ISSB Financial materiality, outside-in lens
Double Materiality EU CSRD uses both lenses
AASB S1 Voluntary general disclosure standard
AASB S2 Mandatory climate disclosure standard

AASB S1 vs AASB S2 CO

AASB S1

General sustainability disclosures
Voluntary to apply now
Broader ESG topic coverage

AASB S2

Climate-related disclosures only
Mandatory, phased by size
Groups 1, 2, and 3
Voluntary standard vs mandatory standard

Common Traps

Legal vs Ethical Minimum

Law is the floor ≠ Ethics can exceed the law

Pass Score vs Raw Percent

540 scaled score is fixed ≠ Raw percentage is never published

APESB vs CPA Australia

APESB writes the Code ≠ CPA Australia enforces it on members

Malus vs Clawback Timing

Malus stops an unpaid reward ≠ Clawback reclaims an already-paid reward

First Strike vs Second Strike

First strike just requires disclosure ≠ Second strike can trigger a spill

GRI vs ISSB Audience

GRI serves broad stakeholder groups ≠ ISSB serves investors and lenders

AASB S1 vs S2 Status

S1 general disclosure stays voluntary ≠ S2 climate disclosure is mandatory

NDB vs SOCI Deadlines

NDB gives 30 days to assess ≠ SOCI gives 12 or 72 hours

Last Minute

1. Governance modules: 25% each, largest
2. Exam: 195 minutes working, 225 total
3. Pass: scaled score 540 of 900
4. APES 110 has five threat categories
5. Threats: eliminate, apply safeguards, or decline
6. Independence needs mind and appearance both
7. Two strikes: 25%+ against, twice running
8. Spill resolution: re-election within 90 days
9. Malus forfeits pay before it vests
10. Clawback recovers pay already paid out
11. AASB S2 climate disclosure: mandatory, phased
12. AASB S1 general disclosure stays voluntary
13. Whistleblowers include current and former staff
14. Data breach: assess within 30 days
15. ASX Code sets 8 core principles

CPA Program — Ethics and Governance

Practice Questions 145 questions Study Guide 52 topics Cheat Sheet 94 facts Flashcards 50 cards Blogs 1 blog Podcast