Governance, Risk & Compliance (GRC) operating-model frameworks
GRC operating models assign single deciders and RAPID roles across the Three Lines, an Authority and Coordination design, standardize a common control framework as auditable Evidence, and pilot each domain in ongoing Learning waves.
Open Compliance and Ethics Group (OCEG), 2003
The origin of the framework, as the directory records it. The mark grades the origin, not this page.
Umbrex, Governance, Risk & Compliance (GRC) operating-model frameworks
The directory entry this score was read from. Umbrex is a consultancy network; its summary is the reference, not a primary source.
Scored against the twelve cells, it loads four: Authority, Coordination, Evidence, and Learning. The other eight it leaves to you. Of Composition, Evidence, and Mastery, the three cells that go blank first when an agent enters a workflow, it loads Evidence.
Treated ev as primary because OCEG's GRC Capability Model is a named published standard rather than one firm's proprietary method.
This is not a summary of the framework. Umbrex has one; the link under Sources goes there.
Which decisions may an agent make alone, and who is able to stop it?
What synchronizes the work when there is no room and half the team is not a person?
What would you show an auditor, and can the system produce it without being asked?
How does tacit judgment become reusable, and who owns the loop that has to close?