In which organizational departments do Protectors typically advise and work?

In the OCEG GRC framework, "Protectors" are the GRC professionals and functions responsible for providing advice, oversight, and assurance to help the organization achieve its objectives, address uncertainty, and act with integrity. The departments listed in option C—such as risk, compliance, legal, ethics, security, and audit—are the core functions that fulfill this protective role. They establish policies, monitor risks, ensure compliance with laws and standards, and provide independent assurance. These functions work across the enterprise to support the governing body and management in safeguarding value and promoting principled performance, distinguishing them from the operational or revenue-generating parts of the business.

A. These are first-line operational departments responsible for executing business processes, which are overseen by GRC protector functions.

B. These are core value-creation departments. They operate within the GRC framework but are not the primary advisors or overseers of it.

D. These are primarily revenue-generating and customer-facing functions that must adhere to the policies and controls established by protector departments.

1. OCEG. (2021). GRC Capability Model, Version 3.5. Section 4.3: Design & Implement Controls, discusses the roles of various functions in control activities, which are central to the "Protector" role. The functions listed in option C are explicitly or implicitly covered as key to designing and implementing controls, policies, and communication about GRC matters.

2. OCEG. (2021). GRC Capability Model, Version 3.5. Introduction, "What is GRC?", page 6. The document describes GRC as the "integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty and act with integrity." The departments in option C are the primary owners of these capabilities.

3. Rasmussen, M. (2015). GRC by Design: An OCEG GRC ARCHITECT APPLICATIONS GUIDE. This official OCEG publication details how GRC functions (like those in option C) are designed and integrated, reinforcing that these specific departments form the backbone of an organization's GRC/Protector capabilities.