GRC Capability Model Details - Review Component
Review closes the loop. This domain tests monitoring, measurement, independent assurance, issue remediation and how findings feed back into Learn, Align and Perform so the capability improves rather than repeating the same failure.
Purpose
Review determines whether the capability is working and improves it: ongoing monitoring, objective evaluation, meaningful measurement, corrective action and feedback upstream.
Core elements
- Monitor - ongoing, embedded checks: risk indicators, control-health indicators, exception reports, management dashboards, near-miss tracking, first- and second-line oversight.
- Evaluate and assure - periodic, objective assessment: control testing, compliance assessments, self-assessments, internal audit, external audit or certification, maturity assessments.
- Measure - performance, risk and control indicators must be defined, owned, comparable and tied to objectives; thresholds drive escalation.
- Improve - root cause analysis, corrective and preventive action, remediation tracked to closure and verified by retest, with updates pushed into Learn, Align and Perform.
- Report - to management, the board and its committees, and where required to regulators and other stakeholders.
Assurance independence
Self-assessment is useful but is not independent assurance. Management owns and performs controls; the risk and compliance function sets frameworks and challenges; internal audit provides independent assurance. Reviewing your own control and calling the result assurance is a common design flaw.
Worked example
Testing shows only 70% of high-value purchase approvals were documented. Reasoning: quantify the exposure and judge materiality; establish root cause - unclear procedure (Align), system does not enforce the step (Perform), or capacity constraints; fix the cause rather than chasing the 30% sample; retest a fresh sample; update the indicator and its threshold; report to the audit or risk committee; and feed the finding back into Learn (is the obligation correctly understood?) and Align (is accountability clear?). A finding closed by "reminder email sent" is not closed.
Traps
- Measuring activity (training sessions delivered) instead of outcome (behavior changed).
- Closing issues without retest evidence.
- Review output that never re-enters Learn and Align, so the same issue recurs.
- Treating the annual audit as the only review activity.
- Indicators with no owner, definition or escalation threshold.