Which of the following is defined as "a measure of the desirable effect of uncertainty on objectives?

The official OCEG GRC Capability Model defines risk as "the effect of uncertainty on objectives." This definition is neutral and encompasses deviations from the expected that can be positive, negative, or both. A "desirable effect" refers to the positive side of risk, often termed an opportunity. Therefore, within the GRC framework, the term "Risk" is the correct umbrella concept that includes the measure of desirable (positive) effects of uncertainty on achieving objectives, not just undesirable (negative) ones.

B. Compliance: Compliance is the act of adhering to stated requirements, such as laws, regulations, and internal policies. It is an obligation, not a measure of uncertainty's effect.

C. Reward: Reward is the positive outcome or benefit realized after an opportunity is successfully pursued. It is the result of a desirable effect, not the measure of the effect of uncertainty itself.

1. OCEG, "GRC Capability Model," Version 3.5 (2021). In Appendix A: Glossary, the term Risk is formally defined as: "The effect of uncertainty on objectives. Note 1: An effect is a deviation from the expected. It can be positive, negative, or both, and can address, create, or result in opportunities and threats." This directly supports that "Risk" includes desirable effects.