1. oceg © 2011 Driving Principled Performance An Overview of the OCEG GRC Capability Model

2. OCEG and Risk Management What is OCEG? Is the OCEG Red Book a risk management standard?

3. OCEG is a nonprofit organization that uniquely helps organizations drive Principled Performance ® by enhancing corporate culture and integrating governance, risk management, and compliance processes by providing: Guidelines and Standards Community of Practice Evaluation Criteria & Benchmarks

4. OCEG Red Book 2.1 What it is and what it is not…

5. Let’s start with the “Big Picture” The goal is Principled Performance

6. The Goal: Principled Performance OBJECTIVES strategic, operational, customer, process, and compliance objectives OPTIMIZE PERFORMANCE strategy, people, process, technology, and infrastructure in place to drive toward objectives MANDATED BOUNDARY boundary established by external forces including laws, government regulation, and other mandates VOLUNTARY BOUNDARY boundary defined by management including public commitments, organizational values, contractual obligations, and other voluntary policies OPPORTUNITIES OBSTACLES

7. Principled Performance reliable achievement of objectives while addressing uncertainty and acting with integrity

8. GRC Defined a capability that enables an organization to reliably achieve objectives while addressing uncertainty and acting with integrity… (c) OCEG. All rights reserved. …including the governance, assurance and management of performance, risk, and compliance.

9. Or, you could say GRC is the integration of capabilities that enable principled performance (c) OCEG. All rights reserved.

10. What does this capability look like?

11. Management Assurance Governance High Level View © OCEG. All rights reserved. RiskCompliancePerformance Principled Performance The rigorous governance, assurance and management of performance, risk and compliance helps an organization reliably achieve objectives while addressing uncertainty and acting with integrity.

12. Management Assurance Governance Too Much Fragmentation © OCEG. All rights reserved. RiskCompliancePerformance Principled Performance NACD, OECD, King 3 Domain-Specific Governance (IT, Project, etc.) Balanced Scorecard Strategic Planning Business Intelligence Decision Science Quality Management COSO CoCo Turnbull PCAOB US FSG AS 3806 Quality Management Domain-Specific COSO ERM ISO 31000 / BSI 31100 UK Orange Book IRM / ALARM / Airmic Domain-Specific (BASEL)

13. Management Assurance Governance Red Book – Makes it Easier and ‘Better’ © OCEG. All rights reserved. RiskCompliancePerformance Principled Performance OCEG Red Book GRC Capability Model

14. GRC Body of Knowledge ›Open Source ›Quality Controlled ›Complete 8 Components 40 Elements 100s Practices www.oceg.org/standards © OCEG. All rights reserved. OCEG Red Book GRC Capability Model

15. © OCEG. All rights reserved. 8 UNIVERSAL OUTCOMES Enhance Organizational Culture Increase Stakeholder Confidence Prepare & Protect the Organization Prevent, Detect & Reduce Adversity Motivate & Inspire Desired Conduct Improve Responsiveness & Efficiency Optimize Economic & Social Value Achieve Business Objectives INTERACT DETECT ORGANIZE ASSESSMEASURE PROACTRESPOND 8 INTEGRATED COMPONENTS

16. What the Red Book is and is not It is not a risk management standard/framework You can use ISO or COSO if you prefer It addresses the optimized delivery of value, and risk management is an essential element Optimized performance requires multiple elements to work together in an orchestrated fashion

17. Thank You! Norman Marks SAP Palo Alto, California norman.marks@sap.com http://www.theiia.org/blogs/marks// http://normanmarks.wordpress.com/ Twitter: normanmarks