Why is monitoring important in the context of the REVIEW component?

Within the OCEG GRC Capability Model, the REVIEW component of the LEARN element focuses on continuous oversight. Monitoring is a critical activity in this context because it provides the ongoing data and information necessary for leadership and governing bodies. This information allows them to assess the effectiveness of GRC activities, track progress toward achieving strategic objectives, and verify that risks (obstacles), opportunities, and compliance requirements (obligations) are being appropriately managed. It is the mechanism for providing assurance that the organization is on track.

A. Monitoring in GRC is much broader than just financial reporting; it encompasses all aspects of governance, risk, and compliance relevant to achieving objectives.

B. While GRC performance might influence individual evaluations, the primary purpose of GRC monitoring is to assess organizational performance, not individual employee performance.

C. While monitoring is often a component of regulatory compliance, its purpose in GRC is more comprehensive, supporting strategic goals and internal governance, not just external mandates.

1. OCEG. (2021). GRC Capability Model (The Red Book) (Version 3.5). Open Compliance & Ethics Group. Section 4.3.3, "REVIEW," p. 54. This section states, "The purpose of the REVIEW component is to monitor and review the design and operating effectiveness of GRC capabilities and specific controls to provide assurance to stakeholders that objectives are met and that risks are mitigated to an acceptable level." This directly supports the idea of understanding progress and addressing obstacles.

2. OCEG. (2021). GRC Capability Model (The Red Book) (Version 3.5). Open Compliance & Ethics Group. Section 2.1, "Principled Performance," p. 12. The concept of Principled Performance, which underpins the entire model, is about reliably achieving objectives [D] while addressing uncertainty [D] and acting with integrity [D]. Monitoring is the key process to ensure this is happening.