OCEG GRC Capability Model 3.5 (Red Book)
- ClassificationCategoryGovernance, Risk, and ComplianceDomainRisk ManagementFramework FamilyOther
- Regulatory ContextTypeFrameworkLegal InstrumentStandardSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionGlobalRegion DetailGlobal (OCEG)PublisherOCEG (Open Compliance and Ethics Group)
- VersioningVersion3.5 (2023)Effective Date2023Issue Date2023 (version 3.5, released on OCEG's 20th anniversary; first Red Book 2004)
- AdoptionAdoption ModelVoluntaryImplementation ComplexityMedium
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
OCEG publishes the GRC Capability Model 3.5 in a free version for download from its website and a premium edition for All Access Pass holders; the text is obtained from OCEG and is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- OCEG's GRC Capability Model (the Red Book) is the open-source standard that integrates governance, strategy, risk, audit, compliance, ethics, and IT.
- OCEG released the first Red Book in 2004 and version 3.5 in 2023, on its 20th anniversary.
- Its goal is Principled Performance: the reliable achievement of objectives while addressing uncertainty and acting with integrity.
- The model's four components, LEARN, ALIGN, PERFORM, and REVIEW, have been taught unchanged for more than 20 years.
- SmartSuite holds a capability inventory organized by the four components, with Enterprise Risk, Compliance, and Internal Audit Management supplying the evidence.
Overview
The GRC Capability Model, known as the OCEG Red Book, is the open-source standard from OCEG (Open Compliance and Ethics Group) that teaches GRC professionals how to achieve Principled Performance, which OCEG defines as the reliable achievement of objectives while addressing uncertainty and acting with integrity. OCEG, the global nonprofit that created the terms GRC and Principled Performance, released the first Red Book in 2004 and the current version 3.5 in 2023, on its 20th anniversary, to its 130,000 members and to the public. OCEG describes the model as the first and only open-source standard that integrates the sub-disciplines of governance, strategy, risk, audit, compliance, ethics and culture, and IT into a unified approach.
OCEG studied more than 500 organizations with a panel of more than 300 experts to document the practices in the model. The Red Book unifies vocabulary across disciplines, defines common components and elements, defines common information requirements, standardizes practices for activities such as policies and training, and identifies communication for everyone involved. It is published in three parts, GRC Concepts, GRC Capabilities and GRC Glossary, with a Tools and Techniques Appendix of 90 resources in the premium edition for All Access Pass holders; a free version is available for download from OCEG.
Organizations apply the model through its four components, which OCEG has taught unchanged for more than 20 years. They LEARN about the organization's context, culture and key stakeholders to inform objectives, strategy and actions; ALIGN strategy with objectives and actions with strategy through decision-making that addresses values, opportunities, threats and requirements; PERFORM actions that promote and reward desirable things, prevent and remediate undesirable things, and detect when something happens as soon as possible; and REVIEW the design and operating effectiveness of the strategy and actions and the ongoing appropriateness of objectives.
Why does it matter?
Most organizations run governance, risk, compliance, audit and ethics as separate functions with separate vocabularies and tools. The Red Book gives them a shared structure and language so that those functions work as one capability: OCEG defines GRC as the integrated collection of capabilities that enable an organization to achieve Principled Performance, and says the management of risk, compliance and ethical conduct cannot be separated from the objective-seeking activity. The model is written to be used and evolved for situations from small projects to organization-wide rollouts and for subject areas from anti-corruption to business continuity to third-party management.
Key benefits include:
- Unify vocabulary across disciplines
Give governance, risk, compliance, audit, ethics and IT teams one set of terms, with Part III, the GRC Glossary, as the alphabetical reference for untangling terminology across departments.
- Define common components and elements
Provide the four components, LEARN, ALIGN, PERFORM and REVIEW, and their elements as the common map that any GRC program can be built from or assessed against.
- Define common information requirements
Standardize what the organization needs to know about its context, objectives, obligations, risks and actions so the same information serves every discipline.
- Standardize core practices
Apply consistent practices for recurring activities such as policies and training, rather than a different approach in every function.
- Frame the conversation with leadership
OCEG describes the model as a tool to frame conversations about GRC capabilities with the board, senior executives and managers.
How does it work?
The model is organized into three parts. Part I, GRC Concepts, sets out the pervasive ideas and models that underlie all aspects of GRC. Part II, GRC Capabilities, is the structured expression of high-performing GRC, organized around the four components. Part III, the GRC Glossary, lists consistent terms and definitions. The premium edition adds a Tools and Techniques Appendix that collects the 90 tools, resources and references cited throughout the model, available to OCEG All Access Pass members.
The four components form a cycle. LEARN gathers the organization's context, culture and key stakeholders to inform objectives, strategy and actions. ALIGN connects strategy to objectives and actions to strategy through decision-making that addresses values, opportunities, threats and requirements. PERFORM runs the actions that promote and reward desirable things, prevent and remediate undesirable things, and detect when something happens as soon as possible. REVIEW examines the design and operating effectiveness of the strategy and actions and whether the objectives remain appropriate, so the organization improves.
OCEG suggests a reading order: the Introduction for the drivers of Principled Performance and GRC, then GRC Concepts, the Glossary for consistent vocabulary, GRC Capabilities to identify areas for improvement, and finally Tools and Techniques. Teams map their existing governance, risk, compliance and audit activities to the components, identify gaps and build the missing practices. OCEG also recommends using the model with narrower frameworks from organizations such as ISO, COSO, ISACA, IIA and NIST to jump-start a program appropriate for the organization.
Key Elements
- LEARN
Understand the organization's context, culture and key stakeholders to inform objectives, strategy and actions.
- ALIGN
Align strategy with objectives, and actions with strategy, using effective decision-making that addresses values, opportunities, threats and requirements.
- PERFORM
Take actions that promote and reward desirable things, prevent and remediate undesirable things, and detect when something happens as soon as possible.
- REVIEW
Review the design and operating effectiveness of the strategy and actions, and the ongoing appropriateness of objectives, to improve the organization.
- Three parts and an appendix
Part I GRC Concepts, Part II GRC Capabilities, Part III GRC Glossary, plus the premium edition's Tools and Techniques Appendix with 90 resources.
- Principled Performance
The goal of GRC: the reliable achievement of objectives while addressing uncertainty and acting with integrity.
- Protectors
OCEG's name for GRC professionals, who bring a Protector Mindset and an interdisciplinary Protector Skillset to safeguard the organization against unprincipled conduct.
What does it cover?
The model applies to any organization, in any sector, that wants to integrate governance, strategy, risk, audit, compliance, ethics and culture, and IT into one capability. OCEG says it may be used and evolved for situations from small projects to organization-wide rollouts and for subject areas from anti-corruption to business continuity to third-party management, and that it is a tool to frame GRC conversations with the board, senior executives and managers. It is used by GRC, risk, compliance, internal audit and IT governance teams and by the consultancies and technology providers that design programs around it, and it is the model taught to OCEG's GRC Professional (GRCP) community.
What are its objectives?
OCEG publishes the Red Book so that organizations can achieve Principled Performance through an integrated GRC capability. The model:
Unifies vocabulary across the governance, risk, compliance, audit, ethics and IT disciplines.
Defines common components and elements that any GRC program can be built from or assessed against.
Defines common information requirements so the same information serves every discipline.
Standardizes practices for recurring activities such as policies and training.
Identifies communication for everyone involved.
Helps GRC professionals plan, assess and improve their GRC capabilities to achieve Principled Performance.
Framework in Context
The Red Book is an integrating model rather than a control catalog. OCEG says it may be used with more specific frameworks from organizations such as ISO, COSO, ISACA, IIA and NIST, which supply the risk management, internal control, IT governance and assurance detail that the model's components organize. Version 3.5 pursued three objectives, simplifying, clarifying and augmenting the model, by adding, editing and removing content, updating the GRC Concepts and introducing concepts, models and practices that have become common in the GRC ecosystem, while keeping the four components OCEG has taught for more than 20 years. Companion infographics in the GRC Capabilities Illustrated series cover each component.
Common Framework Mappings
Organizations map the Red Book's components and elements to the standards and frameworks their program already follows, so that one integrated capability satisfies several references.
Mapped frameworks include:
ISO 31000:2018
COSO ERM 2017
COSO IC 2013
COBIT 2019
IIA Three Lines Model
USSG §8B2.1
DOJ ECCP
ISO 27001:2022
NIST CSF 2.0
ISO 42001
ISO 37301:2021
How SmartSuite Supports the OCEG GRC Capability Model
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
For the Red Book, SmartSuite holds a capability inventory organized by LEARN, ALIGN, PERFORM and REVIEW, with Enterprise Risk Management, Compliance Management and Internal Audit Management supplying the objectives, obligations, policies, training records, controls and reviews that evidence each component.
Capability Inventory by Component
Record the organization's GRC capabilities under LEARN, ALIGN, PERFORM and REVIEW, each with an owner, a maturity rating and the Part II elements it covers, so the program can be assessed against the model in one place.
LEARN: Context and Stakeholders
Use Enterprise Risk Management to keep the external and internal context, culture indicators and key stakeholders that inform objectives, strategy and actions, reviewed on a set cadence.
ALIGN: Objectives and Obligations
Link objectives to the values, opportunities, threats and requirements that decisions must address, and to the risks and obligations held in Enterprise Risk Management and Compliance Management.
PERFORM: Policies, Training and Controls
Use Compliance Management to centralize the policies, training records, controls and evidence through which the organization promotes desirable things, prevents and remediates undesirable things, and detects events.
REVIEW: Audits and Improvement
Use Internal Audit Management to plan reviews of the design and operating effectiveness of strategy and actions, record findings and track remediation to closure.
Shared Vocabulary and Reporting
Hold the Part III Glossary terms the program uses as a shared reference and report capability maturity, open gaps and review status by component to leadership and the board.
Related frameworks
ISO 31000:2018 gives guidelines on managing risk through eight principles, a framework and a process for any organization. It is not certifiable. ISO published it on February 14, 2018.
COSO ERM (2017) sets five components and 20 principles for integrating risk management with strategy and performance. It is voluntary guidance from COSO, not a regulation.
COSO Internal Control (2013) defines five components and 17 principles of internal control. Public companies commonly use it as the ICFR framework for SOX section 404.
COBIT 2019 is ISACA's framework for governing and managing enterprise IT, with 40 objectives in five domains, six governance principles and 11 design factors.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
Frequently Asked Questions For OCEG GRC Capability Model
LEARN about the organization's context, culture and key stakeholders to inform objectives, strategy and actions; ALIGN strategy with objectives and actions with strategy, using decision-making that addresses values, opportunities, threats and requirements; PERFORM actions that promote and reward desirable things, prevent and remediate undesirable things, and detect when something happens as soon as possible; and REVIEW the design and operating effectiveness of the strategy and actions and the ongoing appropriateness of objectives. OCEG says these components have stayed true to the core framework it has taught for more than 20 years.
Principled Performance is the reliable achievement of objectives while addressing uncertainty and acting with integrity. OCEG defines GRC as the integrated collection of capabilities that enable an organization to achieve Principled Performance, and the Red Book teaches GRC professionals how to get there. OCEG created both terms.
OCEG released version 3.5 in 2023 on its 20th anniversary, with three objectives: simplifying, clarifying and augmenting the model. Content was added, edited and removed to make the document easier to navigate, the GRC Concepts were updated, and new concepts, models and practices common in the GRC ecosystem were introduced. The four components were unchanged, and a premium edition added a Tools and Techniques Appendix with 90 resources.
OCEG offers a free version of the GRC Capability Model 3.5 for download from its website. A special premium edition, with the 90-resource Tools and Techniques Appendix, is available in English to OCEG All Access Pass holders. OCEG certifies people through its GRC Professional (GRCP) program; the public pages describe no certification of organizations against the Red Book.
It has three parts: Part I GRC Concepts, Part II GRC Capabilities and Part III GRC Glossary, with the Tools and Techniques Appendix in the premium edition. OCEG suggests reading the Introduction first, then GRC Concepts, consulting the Glossary for consistent vocabulary, working through GRC Capabilities to identify improvements, and finishing with Tools and Techniques. OCEG recommends pairing the model with narrower frameworks from ISO, COSO, ISACA, IIA or NIST to jump-start a program.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.