GRCP Practice Questions

A values statement is a foundational governance document that articulates the core principles, beliefs, and ethical ideals of an organization. Its primary role is to guide the behavior and decision-making of everyone within the organization, from leadership to employees, and to communicate these principles to external stakeholders. It serves as the cornerstone for establishing and nurturing a desired organizational culture—one that is positive, productive, and aligned with strategic objectives. By defining "how we do things around here," the values statement helps ensure consistent and principled performance across all activities.

B. This describes financial or legal liability documents, not a statement of ethical principles and organizational beliefs.

C. This describes a supplier contract or Service Level Agreement (SLA), which governs operational transactions, not organizational culture.

D. While it can support marketing, its primary purpose is to guide internal culture and behavior, not just attract external parties.

1. OCEG. (2015). GRC Capability Model ("The Red Book") (Version 3.0). Open Compliance & Ethics Group. Section 2.2.1, "Learn about the Internal Context," which states, "The organization’s culture is the set of shared attitudes, values, and practices that characterizes the organization." This directly links values to the establishment of culture.

2. OCEG. (2015). GRC Capability Model ("The Red Book") (Version 3.0). Open Compliance & Ethics Group. Section 3.2.1, "Establish Context," emphasizes that a key governance activity is to define the "desired culture and conduct," which is articulated through mission, vision, and values statements.

3. O'Reilly, C. A., Chatman, J., & Caldwell, D. F. (1991). People and Organizational Culture: A Profile Comparison Approach to Assessing Person-Organization Fit. Academy of Management Journal, 34(3), 487-516. This foundational academic paper, widely used in university business curricula (e.g., Stanford GSB), establishes that organizational culture is rooted in shared values that guide employee behavior and decision-making, supporting the role described in the correct answer. (DOI: https://doi.org/10.2307/256404)

"Sensing" the external context, as defined by the OCEG GRC Capability Model, is a comprehensive and continuous process. It involves not only monitoring and tracking changes in the external environment (such as new regulations, market shifts, or geopolitical events) but also interpreting these changes to understand their potential impact. A critical final step in the "sense" element is the timely notification of relevant personnel and systems so that the organization can respond appropriately. This proactive approach ensures that the organization is not merely reacting to events but is actively anticipating and preparing for them.

A. This is incomplete. While making sense of changes and determining impact are parts of sensing, this option omits the crucial initial step of "watching for" changes and the final step of "notifying" stakeholders.

B. This describes an assurance or audit function that evaluates the sensing process's effectiveness. It is a meta-activity, not the act of sensing itself.

D. This is too restrictive. Effective sensing utilizes a combination of both qualitative (e.g., expert opinion) and quantitative (e.g., data analytics, metrics) methods, not just those based on experience and intuition.

1. OCEG. (2021). GRC Capability Model (The Red Book), Version 3.5. OpenCompliance & Ethics Group.

Reference: Component 2: LEARN, Sub-Component 2.1: EXTERNAL CONTEXT, Element 2.1.1 SENSE. The official definition provided is: "Continually watch for and make sense of changes in the external context that may have a direct, indirect, or cumulative effect on the organization and notify appropriate personnel and systems." This directly matches option C.

In the OCEG GRC Capability Model, the "Inquire" element involves gathering information from various pathways. This raw data is then processed in the "Analyze" element. The core purpose of this analysis is to transform data into actionable intelligence by identifying significant issues, trends, and root causes. This intelligence must then be prioritized based on its impact and likelihood and routed to the appropriate management and stakeholders for decision-making, remediation, or strategic adjustment. This ensures that critical findings receive the necessary attention and resources.

A. GRC encompasses governance, risk, and performance, not just compliance. Discarding non-compliance information would ignore critical operational risks, strategic opportunities, and governance failures.

B. A balanced GRC approach considers both unfavorable events (threats, weaknesses) and favorable ones (opportunities, strengths). Focusing only on negatives provides an incomplete picture for decision-making.

C. Indiscriminate sharing of all findings is inappropriate and potentially damaging. Information must be routed to relevant stakeholders based on confidentiality, sensitivity, and need-to-know principles.

1. OCEG, "GRC Capability Model," Version 3.5, 2021.

Section 4.2, ANALYZE: This section details the process following information gathering. It states, "The purpose of the Analyze element is to analyze information and findings to identify, prioritize, and route findings to management and stakeholders... This turns raw data into applied intelligence that can be used to make decisions and take actions." (p. 81). This directly supports option D.

Section 1.1, WHAT IS GRC?: The model defines GRC as an integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty, and act with integrity. This broad scope contradicts the narrow compliance-only focus in option A. (p. 11).

Section 2.4, COMMUNICATE: This section emphasizes that communication must be "appropriately tailored for and delivered to the right stakeholders at the right time." This contradicts the idea of sharing all findings publicly as suggested in option C. (p. 51).

The OCEG GRC Capability Model specifies that the REVIEW component's purpose is to monitor and assess the design and operating effectiveness of the GRC capability. This evaluation is conducted against four key criteria: Effectiveness (achieving stated objectives), Efficiency (optimizing resource use), Resilience (withstanding and recovering from adverse events), and Agility (adapting to change). These criteria provide a comprehensive framework for measuring the performance and maturity of the integrated GRC functions across the organization.

A. These represent specific business objectives or risk areas (e.g., compliance, safety) that GRC helps manage, not the criteria for measuring the GRC capability itself.

C. These are organizational values or cultural enablers that support a strong GRC capability but are not the primary, defined measurement criteria for its performance.

D. These are high-level financial and market performance indicators for the entire business, not the specific metrics used to evaluate the GRC capability's function.

1. OCEG. (2021). GRC Capability Model, Version 3.5. Section 2.3, "Measuring GRC Capability Performance," p. 21. The document states, "We recommend that every organization establish four key measurement criteria for its GRC capability: Effective, Efficient, Resilient, Agile." This section further defines each term in the context of GRC capability evaluation.

An after-action review (AAR) is a structured process for analyzing a past event to improve future performance. Its primary purpose within a Governance, Risk, and Compliance (GRC) framework is to facilitate organizational learning and continuous improvement. By deconstructing an event—whether a success or a failure—the AAR helps identify the root causes and contributing factors. This analysis provides critical insights used to enhance the design and effectiveness of proactive (preventive), detective, and responsive actions and controls, thereby strengthening the overall GRC capability. This aligns directly with the "LEARN" component of the OCEG GRC Capability Model.

A. This describes an incentive or rewards program, which is a motivational tool, not a retrospective analytical process for learning and improvement.

B. This describes a whistleblower or confidential reporting program, which is a specific control to encourage reporting, not the AAR process itself.

D. This describes an incident triage and escalation procedure, which is an initial step in incident management, whereas an AAR is a post-event learning activity.

1. OCEG, "GRC Capability Model 3.0" (The Red Book), 2015.

Section 1: LEARN Component, Element 1.3 "Analyze Root Cause": This section details the process to "Analyze the root cause of undesirable outcomes and the contributing factors for desirable outcomes to improve objectives, strategies, and actions." This is the foundational purpose of an after-action review. The output of this analysis is used to improve controls and processes, as stated in the correct answer.

2. U.S. Army, "Training Circular (TC) 25-20: A Leader's Guide to After-Action Reviews," 1993.

Chapter 1, Page 1-1: Defines an AAR as a "professional discussion of an event, focused on performance standards, that enables soldiers to discover for themselves what happened, why it happened, and how to sustain strengths and improve on weaknesses." This foundational definition, widely adopted in corporate management, directly supports the concept of uncovering causes to improve future actions.

3. Busby, J. S. (1999). "An assessment of the learning from failures in organisations." Journal of Engineering and Technology Management, 16(2), 139-158.

DOI: https://doi.org/10.1016/S0923-4748(99)00004-X00004-X)

This peer-reviewed article discusses how organizations learn from failures. It emphasizes that effective learning involves moving beyond superficial causes to understand systemic root causes to prevent recurrence, which is the core objective of an AAR in a GRC context.

Within the OCEG GRC Capability Model, the REVIEW component of the LEARN element focuses on continuous oversight. Monitoring is a critical activity in this context because it provides the ongoing data and information necessary for leadership and governing bodies. This information allows them to assess the effectiveness of GRC activities, track progress toward achieving strategic objectives, and verify that risks (obstacles), opportunities, and compliance requirements (obligations) are being appropriately managed. It is the mechanism for providing assurance that the organization is on track.

A. Monitoring in GRC is much broader than just financial reporting; it encompasses all aspects of governance, risk, and compliance relevant to achieving objectives.

B. While GRC performance might influence individual evaluations, the primary purpose of GRC monitoring is to assess organizational performance, not individual employee performance.

C. While monitoring is often a component of regulatory compliance, its purpose in GRC is more comprehensive, supporting strategic goals and internal governance, not just external mandates.

1. OCEG. (2021). GRC Capability Model (The Red Book) (Version 3.5). Open Compliance & Ethics Group. Section 4.3.3, "REVIEW," p. 54. This section states, "The purpose of the REVIEW component is to monitor and review the design and operating effectiveness of GRC capabilities and specific controls to provide assurance to stakeholders that objectives are met and that risks are mitigated to an acceptable level." This directly supports the idea of understanding progress and addressing obstacles.

2. OCEG. (2021). GRC Capability Model (The Red Book) (Version 3.5). Open Compliance & Ethics Group. Section 2.1, "Principled Performance," p. 12. The concept of Principled Performance, which underpins the entire model, is about reliably achieving objectives [D] while addressing uncertainty [D] and acting with integrity [D]. Monitoring is the key process to ensure this is happening.

The fundamental distinction between prescriptive and proscriptive norms lies in the nature of the behavior they address. Prescriptive norms define socially or organizationally approved behaviors, essentially stating what individuals should do. They encourage actions that the group considers appropriate and positive. Conversely, proscriptive norms identify behaviors that are disapproved of, outlining what individuals should not do. They function to discourage and prevent actions the group deems negative or harmful. This distinction is central to shaping organizational culture and conduct within a GRC framework, as both types of norms are necessary to guide employee behavior effectively.

A. The mandatory or optional nature of a norm is separate from whether it is prescriptive or proscriptive; both types can range from informal expectations to strict, mandatory rules.

B. Both prescriptive and proscriptive norms can apply to any domain, including financial performance, ethical conduct, safety, and operational procedures, not just one or the other.

C. The source of a norm (e.g., government, industry body, internal policy) does not determine its type; regulations and standards can contain both prescriptive and proscriptive elements.

1. OCEG GRC Capability Model, Version 3.5, Section 4.2.3, "Define Culture and Conduct Objectives." This section details the need to establish "the desired culture and behaviors" and "define acceptable and unacceptable behaviors." This directly maps to the concepts of prescriptive norms (desired/acceptable behaviors) and proscriptive norms (unacceptable behaviors) as foundational elements of a GRC capability.

2. Cialdini, R. B., & Trost, M. R. (1998). Social influence: Social norms, conformity and compliance. In D. T. Gilbert, S. T. Fiske, & G. Lindzey (Eds.), The handbook of social psychology (4th ed., Vol. 2, pp. 151–192). McGraw-Hill. This foundational text defines prescriptive (injunctive) norms as specifying what one ought to do and proscriptive norms as specifying what one ought not to do (p. 155).

3. Schwartz, M. S. (2002). A code of ethics for corporate code of ethics. Journal of Business Ethics, 41(1/2), 27-43. https://doi.org/10.1023/A:1021353111423. The article discusses the content of corporate codes of ethics, which are formal manifestations of organizational norms. It implicitly distinguishes between prescriptive statements (e.g., "act with integrity") and proscriptive statements (e.g., "do not accept lavish gifts"), demonstrating the application of both norm types in a corporate governance context.

Mapping objectives is a fundamental practice within the GRC capability model for aligning strategy. It creates a clear "line of sight" from high-level strategic goals down to operational and departmental objectives. This process visually demonstrates how various objectives support, depend on, or conflict with one another. By understanding these interdependencies, leadership can make informed, risk-aware decisions about where to allocate finite resources—such as budget, personnel, and time—to ensure that efforts are focused on achieving the most critical strategic priorities and delivering value.

A. Mapping objectives highlights interdependencies, which increases the need for communication and collaboration between departments to ensure alignment and avoid conflicts.

C. This practice is critical for all types of objectives (e.g., operational, compliance, reputational), not just financial, to provide a holistic view of organizational performance and value creation.

D. The purpose is to connect and align subordinate-level objectives with superior-level ones to ensure they contribute effectively, not to ignore them.

---

1. OCEG, "GRC Capability Model," Version 3.5 (2021).

Section 3.2, "Align Objectives & Strategy," Page 51: This section states that aligning objectives "provides a clear line of sight from the highest-level strategic objectives down to operational objectives" and is essential for "making risk-informed decisions about resource allocation."

Section 3.2, "Actions," Page 52: A key action listed is to "Map relationships and interdependencies between objectives," which directly supports the idea of understanding how objectives impact one another.

According to the OCEG GRC Capability Model, objectives are the cornerstone of the ALIGN component. They provide the essential context for all subsequent GRC activities. The process of identifying, analyzing, and prioritizing events as either opportunities (which can help achieve objectives) or obstacles (which can hinder them) is fundamentally driven by these established objectives. Without clearly defined objectives, an organization cannot meaningfully assess the potential impact of internal and external factors, making it impossible to align actions with strategic goals.

B. Risk tolerance is a distinct strategic parameter that defines the acceptable level of risk in pursuing objectives; objectives do not determine risk tolerance.

C. Roles and responsibilities are defined within the governance and organizational structure, not by the objectives themselves, which focus on desired outcomes.

D. Objectives are strategic goals and do not dictate operational specifics like the software or technology to be used in the alignment process.

1. OCEG, "GRC Capability Model 3.5," 2021.

Section 4.2.2, "Identify opportunities, threats, and requirements," Page 40: This section explicitly states that identification occurs "in the context of the organization’s objectives." It defines an opportunity as an event that could "enhance the ability to achieve objectives" and a threat (obstacle) as one that could "inhibit the ability to achieve objectives," directly linking identification and analysis to objectives.

Section 4, "Element 4: ALIGN," Page 38: The introduction to the ALIGN component states, "The organization must understand its objectives and how they cascade... This understanding provides the context for all other GRC activities." This reinforces that objectives are the primary driver.

When examining an organization's internal context, the focus is on the internal elements that influence its objectives and ability to manage risk and compliance. This includes the organization's foundational principles like its mission, vision, and values, which dictate its purpose and culture. It also involves understanding the operational structure, such as operating models and organizational charts, and the internal drivers of behavior, like departmental purposes and potential perverse incentives. These factors are entirely within the organization's control and define its internal environment, directly impacting how GRC capabilities are designed and implemented.

A. These elements (regulatory compliance, legal disputes, contractual obligations) primarily originate from the external context, as they are imposed by or involve outside entities like governments, courts, and business partners.

B. Supplier relationships, distribution channels, and pricing strategies are part of the organization's interaction with its external market and supply chain, not its core internal context.

D. Market share, customer satisfaction, and brand reputation are outcomes and measures of the organization's performance within its external competitive and social environment.

1. OCEG. (2021). GRC Capability Model, Version 3.5. Section 2.2.1, "Understand External and Internal Context," pp. 28-29. The document explicitly lists the following as key considerations for the internal context: "Mission, vision, and values," "Organizational structure, roles, and accountabilities," "Culture of the organization," and "Incentive and reward systems." Conversely, it lists "legal, regulatory," "competitive environment," and "relationships with... external stakeholders (including suppliers, partners, customers)" as part of the external context.

2. Rasmussen, M. (2015). GRC by Design: The GRC Capability Model. In M. Anand & S. R. Singh (Eds.), Corporate Frauds: The Fault is in Our Stars (pp. 111-126). Bloomsbury Publishing. This academic book chapter, authored by an OCEG founder, explains that understanding the internal context involves analyzing the "culture, structure, and mission/values of the organization" to align GRC strategies effectively.

3. George Mason University, School of Business. (n.d.). Course Syllabus: ACCT 738 - Governance, Risk, and Compliance. The course curriculum, based on the OCEG framework, specifies a module on "Understanding Organizational Context," which details the analysis of internal factors such as organizational structure, culture, values, and mission as a prerequisite for designing GRC processes. This aligns with the elements listed in the correct answer.