When performing an Assessment, it is important to NEVER change the execution plan

The statement is unequivocally false. Assessment execution plans are not meant to be rigid and unchangeable. In practice, an assessment is a dynamic process of discovery. As assessors gather evidence and perform tests, they may uncover new information, unexpected issues, or areas of higher-than-anticipated risk. A fundamental principle of effective assessment and assurance is the ability to adapt the plan based on these interim findings. Modifying the plan—for example, by expanding the scope, changing testing methods, or reallocating resources—is crucial to ensure that the assessment's objectives are met and that the final conclusions are accurate and relevant.

The "True" option is incorrect because it promotes a rigid, inflexible approach that is contrary to the principles of effective governance, risk management, and compliance. Adhering strictly to an initial plan, even when new evidence suggests it is flawed or incomplete, would undermine the very purpose of the assessment. The OCEG framework emphasizes an agile and responsive GRC capability that can adapt to a changing environment and new information.

1. OCEG GRC Capability Model 3.0 ("The Red Book"). The entire model is designed as an iterative loop (Learn -> Align -> Perform -> Review), indicating that findings from one stage inform and potentially alter subsequent stages. The "Review" component, which includes assessments, is designed to provide feedback to improve performance. This inherently requires the flexibility to act on new information, which may involve changing plans. The principle of Responsiveness is a core design objective, meaning the GRC capability must "react in a timely and appropriate manner to changes in the internal and external environment." An inflexible assessment plan would violate this principle. (OCEG, GRC Capability Model 3.0, 2015, Section 2.2, "Design and Operating Objectives").

2. Sobel, P. J. (2017). Auditor's Risk Management Guide: Integrating Auditing and ERM. While an IIA publication, its principles are foundational to the assurance activities described in the OCEG model. The guide emphasizes that audit (a form of assessment) planning is an iterative process. "The risk assessment is not a one-time event... As the audit progresses, the auditor may identify new risks or determine that the initial assessment of risks was incorrect. In such cases, the audit plan and program should be modified accordingly." (Sobel, P. J., 2017, Chapter 5: Performing the Engagement).

3. Massachusetts Institute of Technology (MIT) OpenCourseWare. 15.571, The Law of Corporate Finance and Financial Markets, Fall 2005. Course materials on internal controls and the role of auditors (as assessors) consistently describe audit planning as a dynamic process. Lecture notes and associated readings explain that auditors must exercise professional skepticism and adjust their audit plan based on evidence gathered. For instance, if initial sample testing reveals a high rate of exceptions, the audit plan must be changed to expand the sample size or perform alternative procedures. This adaptability is a hallmark of professional due care.