What is Principled Performance?

What is Principled Performance?

Principled Performance is OCEG's term for the reliable achievement of objectives while addressing uncertainty and acting with integrity, the outcome that governance, risk management and compliance capabilities exist to produce.

OCEG introduced the term to give GRC a purpose beyond the three functions in its name. In OCEG's definition, GRC is the integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty and act with integrity, and the GRC Capability Model (the Red Book) is the open-source framework for building those capabilities through its Learn, Align, Perform and Review components. The phrase is deliberately balanced: performance without principles and principles without performance both fail the organization.

Why it matters

• It reframes GRC as enablement. The point is not to stop the business but to help it reach its objectives with acceptable risk and within its values and obligations.
• It aligns three functions. Governance, risk and compliance teams that share this outcome stop optimizing their own metrics in isolation.
• It gives the board a test. Any GRC investment can be asked how it improves reliability of objectives, handling of uncertainty or integrity.

The three parts

• Reliably achieve objectives: the governance element, setting direction and ensuring performance against it.
• Address uncertainty: the risk element, understanding threats and opportunities and keeping exposure within appetite.
• Act with integrity: the compliance and ethics element, meeting mandatory obligations and voluntary commitments and behaving in line with values.

Integrity in OCEG's usage includes more than legal compliance: promises to customers, contractual commitments and the organization's own code of conduct all count.

How the Capability Model delivers it

The Red Book organizes practices into four components. Learn covers understanding the external and internal context, culture and stakeholders. Align connects strategy, objectives and decisions with the organization's values, opportunities, threats and requirements. Perform covers the actions and controls that promote desirable conduct and outcomes, prevent undesirable ones and detect problems early. Review evaluates whether the design and operation of the capability are effective and whether objectives remain appropriate. Together they form a continuous cycle aimed at Principled Performance.

Measuring it

Principled Performance is measured through outcomes rather than activity: objectives met within tolerance, risks kept within appetite, obligations met without incident, issues detected and resolved early, and culture indicators such as reporting rates and survey results. GRC dashboards that show only counts of policies, controls and assessments measure effort, not the outcome.

Related terms

• GRC
• Integrated risk management (IRM)
• Compliance management
• Accountability
• Risk appetite and risk tolerance
• Risk culture

In SmartSuite

SmartSuite Compliance Management connects objectives, obligations, risks, controls and issues in one system, so reporting can show whether obligations are met and risks are within appetite alongside performance, which is the view Principled Performance asks for.

Frequently asked questions

Who defined Principled Performance?

OCEG (originally the Open Compliance and Ethics Group), a nonprofit think tank that also coined the term GRC. OCEG defines Principled Performance as the reliable achievement of objectives while addressing uncertainty and acting with integrity, and positions it as the purpose of integrated GRC in its GRC Capability Model.

How is Principled Performance different from compliance?

Compliance is one part of it, the acting-with-integrity element, and even there it extends to voluntary commitments and values, not only legal obligations. Principled Performance also includes reliably achieving objectives and addressing uncertainty, so an organization that complies with every rule but misses its objectives or ignores its risks has not achieved it.

Is Principled Performance a framework?

No. It is the outcome. The framework for achieving it is OCEG's GRC Capability Model, with its Learn, Align, Perform and Review components. Other frameworks such as COSO ERM and ISO 31000 pursue closely related goals with their own vocabulary; Principled Performance is the OCEG term for the combined result.