How do organizations address opportunities and obstacles?

The OCEG GRC Capability Model establishes a framework where organizations strive to reliably achieve objectives. This involves both pursuing opportunities and managing obstacles. Opportunities are addressed by setting objectives and managing performance towards them, which is monitored using Key Performance Indicators (KPIs). Obstacles, which represent uncertainty and potential negative impacts on objectives (i.e., risks), are managed through formal risk management processes and monitored using Key Risk Indicators (KRIs). This dual approach of performance and risk management is central to an integrated GRC capability, ensuring both value creation and preservation.

A. These are specific, tactical responses, not the systematic management frameworks used to address all opportunities and obstacles.

B. These represent specific functional strategies rather than the comprehensive, integrated GRC systems for managing performance and risk.

D. Responsibility for addressing opportunities and obstacles exists at all levels of an organization, not strictly segregated between units and the governing body.

1. OCEG, "GRC Capability Model 3.0" (The Red Book), 2015.

Page 20, Section 2.2.1, "What is GRC?": Defines GRC as the capability to "reliably achieve objectives [addressing opportunity] while addressing uncertainty [addressing obstacles] and acting with integrity." This establishes the core principle reflected in the correct answer.

Page 41, Section 3.3, "PERFORM to Achieve Objectives": This section details how performance is managed to achieve objectives, which is the mechanism for realizing opportunities.

Page 43, Section 3.3.3, "Proactively Identify and Address Issues": This section explicitly discusses monitoring the internal and external context for "changes that may affect objectives, using both performance and risk indicators (KPIs and KRIs)." This directly supports the distinction and use of KPIs for performance/opportunity and KRIs for risk/obstacles.

Page 14, Figure 2, "GRC Capability Model": The diagram visually integrates the concepts of setting objectives, performing actions to achieve them, and reviewing performance and risk, illustrating the interconnected systems described in option C.