Producing Value and Protecting Value are trade-offs. You CANNOT do both at the same time. *

The statement is false. The core philosophy of the OCEG GRC Capability Model is centered on achieving "Principled Performance," which is defined as the reliable achievement of objectives while addressing uncertainty and acting with integrity. This framework posits that producing value (achieving objectives) and protecting value (addressing uncertainty and acting with integrity) are not mutually exclusive trade-offs but are two integrated and essential components of a successful, sustainable organization. Effective GRC enables an organization to balance these two aspects, making informed decisions that optimize both value creation and value protection simultaneously.

The "True" option is incorrect because it presents a false dichotomy that the OCEG framework explicitly refutes. The framework's guidance is clear that an organization focusing solely on producing value without protecting it is unsustainable, just as an organization that only protects value without creating it will fail to achieve its purpose. The goal is integration and balance, not a trade-off where one must be sacrificed for the other.

1. OCEG, "GRC Capability Model," Version 3.5, (2021).

Section 1.1, Page 10: Defines Principled Performance as "the reliable achievement of objectives [which is producing value] while addressing uncertainty and acting with integrity [which is protecting value]." This definition inherently combines both concepts.

Section 1.3, Page 14: States, "An organization that focuses only on opportunities without addressing threats and requirements is likely to find that it cannot sustain its success. Conversely, an organization that focuses only on threats and requirements without taking opportunities is likely to find that it has no success to sustain." This passage directly contradicts the idea that you cannot do both at the same time.

2. Racz, N., Weippl, E., & Seufert, A. "A frame of reference for research of integrated governance, risk, and compliance (GRC)." In International Conference on Wirtschaftsinformatik, (2010).

Section 3.1, "The OCEG Framework": The paper discusses the OCEG framework's approach, noting that GRC aims to "align IT with business objectives, while managing risks and meeting compliance requirements." This academic interpretation supports the concept of simultaneously pursuing business objectives (producing value) and managing risk/compliance (protecting value).