Follow up should be restricted to the recommendations and action plan

This statement is incorrect because it presents an overly restrictive view of the follow-up process. While verifying the implementation of recommendations and action plans is a critical part of follow-up, a mature GRC process requires a broader scope. Effective follow-up must also include assessing the effectiveness of the implemented actions. The goal is not simply to confirm that a task was completed, but to ensure that the underlying issue has been resolved and the associated risk has been mitigated to an acceptable level. This involves verifying outcomes, not just outputs.

The statement "True" is incorrect because it promotes a "checklist" mentality that can be dangerous. An organization could complete every item on an action plan, but if those actions were not effective, the organization remains exposed to the original risk. The OCEG GRC Capability Model emphasizes a continuous cycle of performance, review, and improvement, which necessitates evaluating the actual impact and effectiveness of corrective actions, not just their completion status.

1. OCEG, "GRC Capability Model," Version 3.5 (2021). The model's "Review" component (Component 4) describes activities that go beyond simple follow-up on action plans. Specifically, Element 4.3, "Monitor," involves "ongoing monitoring of the internal and external context, culture, and stakeholder needs as well as GRC activities, controls, and outcomes" (p. 58). This demonstrates that follow-up is about monitoring outcomes and effectiveness, not just the action plan itself.

2. OCEG, "GRC Capability Model," Version 3.5 (2021). The "Improve" component (within the "Review" section) emphasizes using information from monitoring and assurance to "determine and implement improvements to address the root cause of issues and mature the GRC capability" (p. 57). This confirms that the process is about resolving root causes and achieving improvement, a scope far broader than just checking off action plan items.