GRCP cheat sheet

GRC integrates governance (direction and oversight), risk management (identify, assess, treat), and compliance (adherence to obligations) into one coordinated capability rather than three silos.

The OCEG GRC Capability Model organizes practice into four components in a closed loop: Learn, Align, Perform, Review; each component contains elements, and each element contains sub-elements.

A capability is a repeatable, documented, measurable organizational ability; it differs from a process in that it bundles people, process, technology, and information toward an outcome.

GRC capability maturity levels progress from ad hoc/reactive through defined and documented, to integrated across functions, to optimized/continuous improvement with metrics.

Principled performance means reliably achieving objectives while addressing uncertainty and acting with integrity; it is the target outcome of the GRC capability.

Key terms: obligation (internal or external requirement), risk (effect of uncertainty on objectives), control (measure that modifies risk), assurance (independent confidence that controls work).

Three lines model: first line owns and manages risk, second line provides oversight and challenge, third line (internal audit) gives independent assurance; GRC capability spans all three.

Culture is a GRC element, not a soft add-on: governance sets tone, incentives shape behavior, and culture metrics are a leading indicator of control failure.

Common GRC failure modes: duplicated assessments, conflicting risk taxonomies, fragmented data, and compliance-driven rather than objective-driven design.

Learn is the entry point of the loop: it establishes what the organization must know about its context, stakeholders, and obligations before it can align or perform.

Core Learn elements: understand the organization and its context (external and internal environment), understand stakeholders and their expectations, and understand the organization's obligations and objectives.

External context factors include legal/regulatory environment, market and competitive conditions, technology change, and social/geographic conditions; internal context covers structure, strategy, resources, and culture.

Stakeholder analysis identifies each stakeholder's expectations, influence, and tolerance; obligations are derived from laws, regulations, contracts, and voluntary commitments.

Learn outputs feed Align: a consolidated catalogue of obligations and objectives, a risk universe (risk taxonomy), and stakeholder expectations become the inputs to alignment decisions.

A risk universe or risk taxonomy is a structured inventory of risk categories used to ensure coverage and consistent naming across the enterprise; it is built in Learn and used downstream.

Learn is continuous, not one-time: changes in law, strategy, or environment trigger re-scanning and update of obligations and the risk universe.

Information quality matters in Learn: sources must be identified, currency tracked, and ownership assigned so downstream decisions rest on reliable inputs.

Align translates Learn's inputs into decisions: it sets direction by defining risk appetite and tolerance, assigning accountability, and allocating resources.

Core Align elements: define desired outcomes and strategy, set risk appetite and tolerance, assign roles and responsibilities, and allocate resources.

Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of objectives; risk tolerance is the acceptable variation around that appetite for specific categories.

Appetite statements should be qualitative (narrative boundaries) and quantitative (limits, thresholds, metrics) so they can be operationalized in Perform.

Governance structures and role clarity (boards, committees, risk owners, control owners) are established in Align; the 'three lines' accountabilities are defined here.

Policy and control framework design is an Align activity: policies express requirements, and controls are the mechanisms selected to meet them.

Alignment requires resolving conflicting stakeholder expectations and prioritizing obligations by criticality and impact before resources are committed.

Outputs of Align are decisions and mandates: approved appetite, assigned ownership, approved policies, and funded plans that Perform executes.

Perform executes the aligned plan: it implements controls, manages risk events, communicates, and monitors performance against the set appetite and objectives.

Core Perform elements: implement and operate controls, manage risk and compliance events (incidents, issues, breaches), and communicate and monitor performance.

Control types: preventive, detective, corrective; and manual vs automated. Control design is Align; control operation and evidence capture are Perform.

Risk treatment options are avoid, reduce/mitigate, transfer/share, and accept; the selected option and residual risk are recorded during Perform.

Issue and incident management requires defined intake, triage, escalation thresholds, root-cause analysis, and remediation tracking to closure.

Monitoring in Perform uses key risk indicators (KRIs) and key performance indicators (KPIs); a KRI crossing its threshold signals appetite breach and triggers escalation.

Evidence and documentation are core Perform outputs: control operation must be evidenced so that Review can rely on it.

Communication of GRC information to stakeholders (reporting, escalation, awareness) happens in Perform, with content and cadence set by Align.

Review provides assurance and learning: it evaluates whether the GRC capability is designed and operating effectively, then feeds improvements back into Learn.

Core Review elements: monitor and evaluate the GRC capability, assess performance against objectives and appetite, and identify and drive improvement.

Assurance sources include internal audit, second-line testing, self-assessments, and external audit; independence and objectivity determine the weight of each source.

Review distinguishes design effectiveness (would the control achieve its objective if operated) from operating effectiveness (was it actually operated as designed).

Findings should be rated by severity and linked to the underlying risk, control, and owner so remediation can be tracked in Perform.

Review closes the loop: root causes of failures and gaps in the risk universe or appetite are fed back to Learn and Align, not just fixed tactically.

Metrics for evaluating the GRC capability include coverage of obligations, timeliness of remediation, repeat findings, and trend of incidents.

Continuous improvement requires comparing actual capability maturity against a target and prioritizing gaps by risk impact.

GRC integrates governance (direction and oversight), risk management (identify, assess, treat), and compliance (adherence to obligations) into one coordinated capability rather than three silos.

The OCEG GRC Capability Model organizes practice into four components in a closed loop: Learn, Align, Perform, Review; each component contains elements, and each element contains sub-elements.

A capability is a repeatable, documented, measurable organizational ability; it differs from a process in that it bundles people, process, technology, and information toward an outcome.

GRC capability maturity levels progress from ad hoc/reactive through defined and documented, to integrated across functions, to optimized/continuous improvement with metrics.

Principled performance means reliably achieving objectives while addressing uncertainty and acting with integrity; it is the target outcome of the GRC capability.

Key terms: obligation (internal or external requirement), risk (effect of uncertainty on objectives), control (measure that modifies risk), assurance (independent confidence that controls work).

Three lines model: first line owns and manages risk, second line provides oversight and challenge, third line (internal audit) gives independent assurance; GRC capability spans all three.

Culture is a GRC element, not a soft add-on: governance sets tone, incentives shape behavior, and culture metrics are a leading indicator of control failure.

Common GRC failure modes: duplicated assessments, conflicting risk taxonomies, fragmented data, and compliance-driven rather than objective-driven design.

Learn is the entry point of the loop: it establishes what the organization must know about its context, stakeholders, and obligations before it can align or perform.

Core Learn elements: understand the organization and its context (external and internal environment), understand stakeholders and their expectations, and understand the organization's obligations and objectives.

External context factors include legal/regulatory environment, market and competitive conditions, technology change, and social/geographic conditions; internal context covers structure, strategy, resources, and culture.

Stakeholder analysis identifies each stakeholder's expectations, influence, and tolerance; obligations are derived from laws, regulations, contracts, and voluntary commitments.

Learn outputs feed Align: a consolidated catalogue of obligations and objectives, a risk universe (risk taxonomy), and stakeholder expectations become the inputs to alignment decisions.

A risk universe or risk taxonomy is a structured inventory of risk categories used to ensure coverage and consistent naming across the enterprise; it is built in Learn and used downstream.

Learn is continuous, not one-time: changes in law, strategy, or environment trigger re-scanning and update of obligations and the risk universe.

Information quality matters in Learn: sources must be identified, currency tracked, and ownership assigned so downstream decisions rest on reliable inputs.

Align translates Learn's inputs into decisions: it sets direction by defining risk appetite and tolerance, assigning accountability, and allocating resources.

Core Align elements: define desired outcomes and strategy, set risk appetite and tolerance, assign roles and responsibilities, and allocate resources.

Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of objectives; risk tolerance is the acceptable variation around that appetite for specific categories.

Appetite statements should be qualitative (narrative boundaries) and quantitative (limits, thresholds, metrics) so they can be operationalized in Perform.

Governance structures and role clarity (boards, committees, risk owners, control owners) are established in Align; the 'three lines' accountabilities are defined here.

Policy and control framework design is an Align activity: policies express requirements, and controls are the mechanisms selected to meet them.

Alignment requires resolving conflicting stakeholder expectations and prioritizing obligations by criticality and impact before resources are committed.

Outputs of Align are decisions and mandates: approved appetite, assigned ownership, approved policies, and funded plans that Perform executes.

Perform executes the aligned plan: it implements controls, manages risk events, communicates, and monitors performance against the set appetite and objectives.

Core Perform elements: implement and operate controls, manage risk and compliance events (incidents, issues, breaches), and communicate and monitor performance.

Control types: preventive, detective, corrective; and manual vs automated. Control design is Align; control operation and evidence capture are Perform.

Risk treatment options are avoid, reduce/mitigate, transfer/share, and accept; the selected option and residual risk are recorded during Perform.

Issue and incident management requires defined intake, triage, escalation thresholds, root-cause analysis, and remediation tracking to closure.

Monitoring in Perform uses key risk indicators (KRIs) and key performance indicators (KPIs); a KRI crossing its threshold signals appetite breach and triggers escalation.

Evidence and documentation are core Perform outputs: control operation must be evidenced so that Review can rely on it.

Communication of GRC information to stakeholders (reporting, escalation, awareness) happens in Perform, with content and cadence set by Align.

Review provides assurance and learning: it evaluates whether the GRC capability is designed and operating effectively, then feeds improvements back into Learn.

Core Review elements: monitor and evaluate the GRC capability, assess performance against objectives and appetite, and identify and drive improvement.

Assurance sources include internal audit, second-line testing, self-assessments, and external audit; independence and objectivity determine the weight of each source.

Review distinguishes design effectiveness (would the control achieve its objective if operated) from operating effectiveness (was it actually operated as designed).

Findings should be rated by severity and linked to the underlying risk, control, and owner so remediation can be tracked in Perform.

Review closes the loop: root causes of failures and gaps in the risk universe or appetite are fed back to Learn and Align, not just fixed tactically.

Metrics for evaluating the GRC capability include coverage of obligations, timeliness of remediation, repeat findings, and trend of incidents.

Continuous improvement requires comparing actual capability maturity against a target and prioritizing gaps by risk impact.