Who has ultimate accountability (plenary accountability) for the governance, management, and assurance of performance, risk, and compliance in the…

In the OCEG Lines of Accountability Model, the Fifth Line is the Governing Authority (e.g., the Board of Directors). This body holds ultimate or "plenary" accountability for the organization's entire Governance, Risk Management, and Compliance (GRC) capability. While it delegates the day-to-day operation and management of GRC activities to management (the other Lines), the Governing Authority retains the final responsibility for oversight, strategic direction, and ensuring that objectives are met, uncertainty is addressed, and the organization acts with integrity. The other lines are accountable to the Governing Authority.

B. The Second Line, or the individuals and teams that establish performance, risk, and compliance programs.

This line provides expertise and oversight but is accountable to senior management and the governing body, not ultimately accountable for the entire organization.

C. The First Line, or the individuals and teams involved in operational activities.

This line owns and manages risk in daily operations. They have direct responsibility but are accountable to the Second Line and senior management.

D. The Third Line, or the individuals and teams that provide assurance.

This line (typically internal audit) provides independent assurance on the effectiveness of GRC activities to the governing body; it does not hold accountability for them.

1. OCEG. (2021). GRC Capability Model, Version 3.5. Section 2.3.2, "Define Roles and Responsibilities," pp. 48-50. This section details the roles of the different lines, explicitly placing the Governing Body (Fifth Line) at the top with ultimate oversight responsibility and accountability for the GRC capability.

2. Steinberg, R. M. (2020). Governance, Risk Management, and Compliance: It Can't Really Be That Difficult. John Wiley & Sons. Chapter 5, "Roles and Responsibilities," discusses the accountability structure, reinforcing that the board of directors holds ultimate accountability for the organization's GRC framework, consistent with the OCEG model's Fifth Line. (Note: Richard Steinberg is a co-founder of OCEG and a principal author of the GRC Capability Model).