OCEG GRC Capability Model (Red Book 2.1)

International

vGRC Capability Model (Red Book) version 2.1

8 domains

136 controls

OCEG's open capability model for governance, risk management and compliance, version 2.1: 136 practices across eight components, from understanding context and organising accountability through assessing risk, preventing, detecting and responding to issues, to monitoring performance and managing information and technology.

Verified

OCEG GRC Capability Model (Red Book 2.1) is a compliance framework from International with 8 domains and 136 controls. The largest domains are Proact (P) – OCEG GRC Capability Model (Red Book 2.1) (29 controls), Respond (R) – OCEG GRC Capability Model (Red Book 2.1) (22 controls), Assess (A) – OCEG GRC Capability Model (Red Book 2.1) (20 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (8)

Assess (A) – OCEG GRC Capability Model (Red Book 2.1)

20 controls

Controls in the Assess (A) – OCEG GRC Capability Model (Red Book 2.1) domain of OCEG GRC Capability Model (Red Book 2.1): 20 controls
Code	Title	Description
oceg-grc-capability-model-red-book-2-1::A1.1	Review objectives, processes and resources	Settle which business objectives, lines of business, projects, processes and resources sit inside the scope of the capab...
oceg-grc-capability-model-red-book-2-1::A1.2	Identify external sources and forces	Look outward and anticipate the external drivers that could create an obligation or change the odds of hitting objective...
oceg-grc-capability-model-red-book-2-1::A1.3	Identify internal sources and forces	Turn the same lens inward and anticipate internal drivers that may create requirements or shift the chances of success....
oceg-grc-capability-model-red-book-2-1::A1.4	Identify opportunities and threats	From the drivers already gathered, name the opportunities and threats that bear on objectives. Treat opportunities as ev...
oceg-grc-capability-model-red-book-2-1::A1.5	Identify mandatory and voluntary requirements	From the same driver set, list the obligations the organisation has to meet, whether imposed or self-assumed. Cover lega...
oceg-grc-capability-model-red-book-2-1::A1.6	Identify interrelatedness and trends	Establish how the opportunities, threats and requirements you identified are connected, and trace the direction each has...
oceg-grc-capability-model-red-book-2-1::A1.7	High level risk and reward analysis	Produce an early view of risk and reward across inherent, current and planned residual positions so the biggest items st...
oceg-grc-capability-model-red-book-2-1::A1.8	High level requirements impact analysis	Run a similar first pass on how well requirements are being met, at inherent, current and planned levels, including a ro...
oceg-grc-capability-model-red-book-2-1::A1.9	Assign accountability for monitoring change	Name who watches each underlying source for developments that could create or reshape events affecting objectives. Inter...
oceg-grc-capability-model-red-book-2-1::A2.1	Analyze approach to requirements	Examine the actions and controls, present and planned, that deal with requirements, and weigh what they cost. Establish...
oceg-grc-capability-model-red-book-2-1::A2.2	Analyze inherent risk and reward	Judge the effect of threats and opportunities as if no controls or actions existed. Cover how likely an event is, whethe...
oceg-grc-capability-model-red-book-2-1::A2.3	Analyze current risk and reward approach	Establish what actions and controls are actually in place for each threat or opportunity and whether they work. Classify...
oceg-grc-capability-model-red-book-2-1::A2.4	Determine current residual risk and reward	Work out what risk and reward remain once current actions and controls are counted. Look at how those actions change lik...
oceg-grc-capability-model-red-book-2-1::A2.5	Prioritize threats, opportunities and requirements	Rank and group the identified threats, opportunities and requirements so effort and money point at the right ones. Flag...
oceg-grc-capability-model-red-book-2-1::A3.1	Explore options to address requirements	Where conformance falls short of the mark, or current actions and controls are not the best available, look for further...
oceg-grc-capability-model-red-book-2-1::A3.2	Explore options to address risk and reward	Where residual risk is unacceptable or the current approach could be better, search for alternatives. Choose among accep...
oceg-grc-capability-model-red-book-2-1::A3.3	Determine planned residual position	Work out what risk, reward and conformance will remain once the chosen actions and controls are in place and working. If...
oceg-grc-capability-model-red-book-2-1::A3.4	Address inherently high risk	Identify precisely which present and intended actions and controls are there to contain the inherently high risks: those...
oceg-grc-capability-model-red-book-2-1::A3.5	Develop key indicators	Create indicators that show management where performance, risk and conformance stand. Define performance measures for ob...
oceg-grc-capability-model-red-book-2-1::A3.6	Develop integrated plan	Produce a single plan that governs, assures and manages the response to performance, risk and compliance. Look first to...

Context (C) – OCEG GRC Capability Model (Red Book 2.1)

17 controls

Controls in the Context (C) – OCEG GRC Capability Model (Red Book 2.1) domain of OCEG GRC Capability Model (Red Book 2.1): 17 controls
Code	Title	Description
oceg-grc-capability-model-red-book-2-1::C1.1	Analyze the external business context	Identify the external business factors that may influence whether the organization meets its objectives, covering indust...
oceg-grc-capability-model-red-book-2-1::C1.2	Analyze external stakeholder and influencer needs	Identify the key external stakeholders and opinion influencers, such as shareholders, ratings agencies, creditors, custo...
oceg-grc-capability-model-red-book-2-1::C2.1	Define the internal context	Identify the structures and assets that make up the internal context: business units and departments, key processes, peo...
oceg-grc-capability-model-red-book-2-1::C2.2	Determine internal context changes needed	Decide which parts of the internal setting may be changed, and which ought to change, so the GRC capability can support...
oceg-grc-capability-model-red-book-2-1::C3.1	Analyze ethical culture	Use a representative employee sample to gauge the ethical climate, including how far stated values are supported, whethe...
oceg-grc-capability-model-red-book-2-1::C3.2	Analyze ethical leadership	Survey the workforce on whether leaders make ethics a priority, model ethical conduct, link ethics to performance, make...
oceg-grc-capability-model-red-book-2-1::C3.3	Analyze risk culture	Survey a sufficient workforce sample on risk culture, including whether leadership communicates the risk appetite and mo...
oceg-grc-capability-model-red-book-2-1::C3.4	Analyze Board involvement	Ask Board members whether they can raise issues, challenge management and contribute to strategy, and ask management whe...
oceg-grc-capability-model-red-book-2-1::C3.5	Analyze governance culture and management style	Map where management decision authority is delegated and how the organization assigns duties and holds people to them. E...
oceg-grc-capability-model-red-book-2-1::C3.6	Analyze workforce engagement	Assess whether personal values match the organization's mission and values, and survey a sample on satisfaction with pay...
oceg-grc-capability-model-red-book-2-1::C4.1	Define mission and vision	Write a formal statement that sets out the organization's mission, meaning what it will do. The statement covers both th...
oceg-grc-capability-model-red-book-2-1::C4.2	Define values	Write a formal statement of the beliefs the organization treats as core and applies when making business decisions, deve...
oceg-grc-capability-model-red-book-2-1::C4.3	Define business objectives	Set a balanced group of measurable business goals that fit the mission, vision and values, grouped into categories and c...
oceg-grc-capability-model-red-book-2-1::C4.4	Define risk appetite and decision criteria	For each objective or objective category, set a qualitative or quantitative risk tolerance and a matching risk appetite,...
oceg-grc-capability-model-red-book-2-1::C4.5	Define indicators, targets and tolerances	Use a balanced mix of leading and lagging indicators to show what has happened and to anticipate what may happen. Set ta...
oceg-grc-capability-model-red-book-2-1::C4.6	Secure commitment to direction and goals	Obtain commitment from senior management and Board members to the mission, vision and values and to the objectives. Secu...
oceg-grc-capability-model-red-book-2-1::C4.7	Communicate mission, vision and values	Create a consistent template for formal communications of the mission, vision and values. Reinforce them informally and...

Detect (D) – OCEG GRC Capability Model (Red Book 2.1)

14 controls

Controls in the Detect (D) – OCEG GRC Capability Model (Red Book 2.1) domain of OCEG GRC Capability Model (Red Book 2.1): 14 controls
Code	Title	Description
oceg-grc-capability-model-red-book-2-1::D1.1	Set up detective actions and controls	Put management actions in place that detect unwanted events and conditions, and actions that detect wanted ones, drawing...
oceg-grc-capability-model-red-book-2-1::D1.2	Set up detective process controls	Build controls and procedures into processes so that adverse events, non-compliance and misconduct get caught. Look at f...
oceg-grc-capability-model-red-book-2-1::D1.3	Set up detective human capital controls	Put people-related controls and procedures in place that catch adverse events, non-compliance and misconduct. Use a perf...
oceg-grc-capability-model-red-book-2-1::D1.4	Set up detective physical controls	Install physical controls that keep watch over preventive controls and over places where noncompliance or unethical cond...
oceg-grc-capability-model-red-book-2-1::D1.5	Set up detective technology controls	Run automated detective controls built on technology and track the signals they give off, so that real or suspected wron...
oceg-grc-capability-model-red-book-2-1::D1.6	Consolidate and analyse detection findings	Bring together and analyse everything detection gathers so recurring misconduct, adverse events and other weaknesses bec...
oceg-grc-capability-model-red-book-2-1::D2.1	Capture notifications	Keep a notification system running that flags to the organisation any incident or suspicion of legal noncompliance, poli...
oceg-grc-capability-model-red-book-2-1::D2.3	Filter and route notifications	Vet and route each notification into handling, whichever pathway it arrived by. Use uniform procedures with one incident...
oceg-grc-capability-model-red-book-2-1::D2.4	Meet data protection requirements for hotlines	Make the hotline pathway satisfy the specific rules of the place the notice comes from and of every place the organisati...
oceg-grc-capability-model-red-book-2-1::D3.1	Open pathways to workforce and stakeholder views	Create opportunities for the workforce and stakeholders to give their views on risk, the capability, conduct and how far...
oceg-grc-capability-model-red-book-2-1::D3.2	Coordinate surveys across the organisation	Build a survey approach that lightens the burden on respondents and gives one consolidated picture of what the workforce...
oceg-grc-capability-model-red-book-2-1::D3.3	Integrate self-assessments	Integrate self-assessment of GRC responsibilities and outcomes with the other self-assessments management already carrie...
oceg-grc-capability-model-red-book-2-1::D3.4	Gather views by observation and conversation	Create informal channels for collecting views: watching what happens, holding group meetings, running focus groups and t...
oceg-grc-capability-model-red-book-2-1::D3.5	Report inquiry information and findings	Give management what each inquiry method produces. Analyse it so that matters needing immediate attention are referred,...

Interact (I) – OCEG GRC Capability Model (Red Book 2.1)

8 controls

Controls in the Interact (I) – OCEG GRC Capability Model (Red Book 2.1) domain of OCEG GRC Capability Model (Red Book 2.1): 8 controls
Code	Title	Description
oceg-grc-capability-model-red-book-2-1::I1.1	Develop GRC information classification structure	The organization should settle the definitions, categories and processes it needs to identify and handle GRC information...
oceg-grc-capability-model-red-book-2-1::I1.2	Develop information collection policies	The organization should establish policies and processes for gathering GRC information from sources within the organizat...
oceg-grc-capability-model-red-book-2-1::I1.3	Manage information access use and transfer	The organization should set policies and processes for getting at, using and moving GRC information, under the Informati...
oceg-grc-capability-model-red-book-2-1::I1.4	Manage information storage and disposition	The organization should set policies and processes for keeping and disposing of GRC information in line with what is req...
oceg-grc-capability-model-red-book-2-1::I2.1	Develop reporting plan	The organization should set a plan for meeting mandatory reporting duties and for giving management, the Board and stake...
oceg-grc-capability-model-red-book-2-1::I2.2	Develop communication plan	The organization should define how it manages GRC communications that are not formal reports. Planning starts from the a...
oceg-grc-capability-model-red-book-2-1::I3.1	Assess technology needs and gaps	The organization should find the gaps and weak systems in its current technology environment. It identifies processes an...
oceg-grc-capability-model-red-book-2-1::I3.2	Develop GRC technology plan	The organization should develop the technology part of the GRC strategic plan for implementing technology that enables G...

Measure (M) – OCEG GRC Capability Model (Red Book 2.1)

13 controls

Controls in the Measure (M) – OCEG GRC Capability Model (Red Book 2.1) domain of OCEG GRC Capability Model (Red Book 2.1): 13 controls
Code	Title	Description
oceg-grc-capability-model-red-book-2-1::M1.1	Monitor external context	The organization should keep continuous watch on the outside environment for shifts that could affect it directly, indir...
oceg-grc-capability-model-red-book-2-1::M1.2	Monitor internal context	The organization should keep continuous watch on its own internal environment for shifts with direct, indirect or combin...
oceg-grc-capability-model-red-book-2-1::M2.1	Monitor and evaluate capability design	The organization should set a schedule for re-examining whether the capability design still fits its objectives, opportu...
oceg-grc-capability-model-red-book-2-1::M2.2	Review and reconsider risks	Previously assessed and newly identified risks should be reviewed, and their priority reconsidered or set for the first...
oceg-grc-capability-model-red-book-2-1::M2.3	Identify relevant actions and controls	The organization should examine the measures and safeguards it relies on to meet its most important objectives and to re...
oceg-grc-capability-model-red-book-2-1::M2.4	Analyze potential for failure	The organization should analyze how likely each risk optimizing activity is to fail and in what ways. Factors include th...
oceg-grc-capability-model-red-book-2-1::M2.5	Identify monitoring information	The organization should decide what information will show whether a risk optimizing activity, or the whole capability, p...
oceg-grc-capability-model-red-book-2-1::M2.6	Perform monitoring activities	Monitoring should actually be carried out on the information identified: documents and data samples are reviewed, interv...
oceg-grc-capability-model-red-book-2-1::M2.7	Analyze and report monitoring results	Findings from monitoring should be examined to surface weaknesses and openings for improvement across the whole system....
oceg-grc-capability-model-red-book-2-1::M3.1	Develop improvement plan	The organization should build a prioritized plan for improving the program. That means assembling a portfolio of initiat...
oceg-grc-capability-model-red-book-2-1::M3.2	Implement improvement initiatives	The improvements set out in the plan should be executed. Priorities and plans get revised so the additions are absorbed,...
oceg-grc-capability-model-red-book-2-1::M4.1	Plan assurance assessment	Before an assurance assessment, the organization should settle its scope, the level of assurance wanted, and the standar...
oceg-grc-capability-model-red-book-2-1::M4.2	Perform assurance assessment	The assessment should be performed by applying the agreed procedures, judging results against the criteria, and deliveri...

Organize (O) – OCEG GRC Capability Model (Red Book 2.1)

13 controls

Controls in the Organize (O) – OCEG GRC Capability Model (Red Book 2.1) domain of OCEG GRC Capability Model (Red Book 2.1): 13 controls
Code	Title	Description
oceg-grc-capability-model-red-book-2-1::O1.1	Set the scope of the GRC capability	Decide whether the capability will cover the whole enterprise or be built in stages, addressing a broad risk area such a...
oceg-grc-capability-model-red-book-2-1::O1.2	Set the style and goals of the capability	Set the mission and vision for the capability as the opening of the GRC strategic plan, and state the overall approach b...
oceg-grc-capability-model-red-book-2-1::O1.3	Obtain Board and management commitment	Obtain explicit written authorization from the Board for the GRC capability. Secure a matching commitment from senior ma...
oceg-grc-capability-model-red-book-2-1::O2.1	Oversight roles and accountability	Define the oversight structure and the people who sit in it, and set the attributes required of them: independence from...
oceg-grc-capability-model-red-book-2-1::O2.2	Management roles and accountability	Assign management the parts of the capability that need management judgement, including vetting how business objectives...
oceg-grc-capability-model-red-book-2-1::O2.3	Leadership roles and accountability	Select people at different levels of the organization to act as leaders and champions, and set out what they do: removin...
oceg-grc-capability-model-red-book-2-1::O2.4	Operational roles for the capability	Define the roles that run the capability across its working parts: methods, policy, standards and vocabulary, risk and r...
oceg-grc-capability-model-red-book-2-1::O2.5	Assurance roles and accountability	Define the assurance roles, such as the chief audit executive and the external auditor, with the attributes they need: i...
oceg-grc-capability-model-red-book-2-1::O3.1	Allocate duties to people and committees	Allocate the capability's duties to individuals and committees, combining them with existing posts only where that yield...
oceg-grc-capability-model-red-book-2-1::O3.2	Integrate capability processes with the business	Define a process model for the capability, then say how and when each key process runs alongside the business: risk asse...
oceg-grc-capability-model-red-book-2-1::O3.3	Define how the capability is measured	Set out how the capability's effectiveness will be measured and evaluated, together with its efficiency and how quickly...
oceg-grc-capability-model-red-book-2-1::O3.4	Manage organizational change	Identify where the capability will significantly affect business units and departments, the people and stakeholder relat...
oceg-grc-capability-model-red-book-2-1::O3.5	Build, maintain and authorize the business case	Build a plan and business case for the capability that states the intended outcomes, the need and the value added, the s...

Proact (P) – OCEG GRC Capability Model (Red Book 2.1)

29 controls

Controls in the Proact (P) – OCEG GRC Capability Model (Red Book 2.1) domain of OCEG GRC Capability Model (Red Book 2.1): 29 controls
Code	Title	Description
oceg-grc-capability-model-red-book-2-1::P1.1	Establish proactive management actions and controls	Put management actions in place to discourage unwanted events and to encourage the ones you want, drawing on levers such...
oceg-grc-capability-model-red-book-2-1::P1.2	Establish preventive process controls	Preventive process controls should cover the approvals, authorisations, pre-submission reviews and quality reviews that...
oceg-grc-capability-model-red-book-2-1::P1.3	Establish preventive human capital controls	Human capital controls should begin with role descriptions for key positions, explicit decisions about which duties are...
oceg-grc-capability-model-red-book-2-1::P1.4	Establish preventive technology controls	Agree one shared set of terms for describing and naming technology controls, so coverage can be compared between systems...
oceg-grc-capability-model-red-book-2-1::P1.5	Establish preventive physical controls	Preventive physical controls should satisfy legal and mandated requirements, protect people's health and safety, protect...
oceg-grc-capability-model-red-book-2-1::P2.1	Develop the code of conduct	The code should be produced through a repeatable method with stakeholders drawn from several levels of authority, and sh...
oceg-grc-capability-model-red-book-2-1::P2.2	Implement and manage the code	Distribution should be planned and launched, with help desk staff and other answerers trained before release, the code d...
oceg-grc-capability-model-red-book-2-1::P2.3	Develop ethical decision guidelines	Guidelines should be built with stakeholders from several levels of authority and from the different cultures inside the...
oceg-grc-capability-model-red-book-2-1::P3.1	Establish policy structure	A policy structure should be built by listing the policies that mandates, standards and voluntary commitments require, t...
oceg-grc-capability-model-red-book-2-1::P3.2	Develop preventive and directive policies	Only people with appropriate authority may issue or change a policy, and each policy should state its objective, its aud...
oceg-grc-capability-model-red-book-2-1::P3.3	Implement and manage policies	Each policy should be made available in a form that reaches its target audience, with a decision on whether training or...
oceg-grc-capability-model-red-book-2-1::P4.1	Define an awareness and education plan	A plan should be written for each target population, accounting for how far awareness needs to reach into the extended e...
oceg-grc-capability-model-red-book-2-1::P4.2	Define a curriculum plan	A curriculum should be set for each role and level, starting with courses the law requires and recording who is trained,...
oceg-grc-capability-model-red-book-2-1::P4.3	Develop or acquire learning content	Existing awareness messages and courses, including vendor offerings, should be inventoried with their key details and co...
oceg-grc-capability-model-red-book-2-1::P4.4	Implement and manage education	Training should be folded into existing job training where possible, delivered and measured with suitable technology, an...
oceg-grc-capability-model-red-book-2-1::P4.5	Provide a helpline	A helpline should give the workforce and other stakeholders a route to ask about future conduct and general GRC responsi...
oceg-grc-capability-model-red-book-2-1::P4.6	Provide integrated support	Supervisors and GRC personnel working inside the business should be able to answer questions on authority, responsibilit...
oceg-grc-capability-model-red-book-2-1::P5.1	Hire and promote on conduct expectations	Conduct expectations should be built into how roles are described, who is hired, how staff are reviewed, promoted, paid,...
oceg-grc-capability-model-red-book-2-1::P5.2	Compensation that reflects conduct expectations	Pay and bonus schemes for employees and business partners should be designed to reward compliance and ethical behaviour...
oceg-grc-capability-model-red-book-2-1::P5.3	Reward programmes that recognise desired conduct	A reward scheme should reach employees, business partners and other stakeholders, and should honour both individuals and...
oceg-grc-capability-model-red-book-2-1::P6.1	Understand stakeholders and their concerns	Stakeholder groups, and the important people within them, should be researched and analysed so that their concerns and t...
oceg-grc-capability-model-red-book-2-1::P6.2	Stakeholder relations and communication plans	A relations plan, including a communications plan, is needed for each stakeholder constituency. The plans should identif...
oceg-grc-capability-model-red-book-2-1::P6.3	Track authorities that issue requirements	The organization should work out which government bodies, standards setters and other issuing authorities materially aff...
oceg-grc-capability-model-red-book-2-1::P6.4	Comment on planned and proposed items	The organization should take an active part in shaping mandates, standards and guidance through the comment routes avail...
oceg-grc-capability-model-red-book-2-1::P6.5	Propose mandates, standards or guidance	Beyond reacting to proposals, the organization should put forward its own suggestions for new mandates, standards or gui...
oceg-grc-capability-model-red-book-2-1::P7.1	Assess risk financing need and options	The need or appetite for financing risk, and the choices open, should be assessed against the risk assessment findings....
oceg-grc-capability-model-red-book-2-1::P7.2	Set risk financing objectives and limits	Objectives and limits for sharing a given risk, or a portfolio of risks, should be set. This requires working out which...
oceg-grc-capability-model-red-book-2-1::P7.3	Design the risk financing portfolio	A set of ways to share risk should be worked out. The design settles which risks go to an insurer, which the organisatio...
oceg-grc-capability-model-red-book-2-1::P7.4	Implement the risk financing strategy	The instruments or structures chosen should be put in place and cover bought. That means drafting indemnity, assignment,...

Respond (R) – OCEG GRC Capability Model (Red Book 2.1)

22 controls

Controls in the Respond (R) – OCEG GRC Capability Model (Red Book 2.1) domain of OCEG GRC Capability Model (Red Book 2.1): 22 controls
Code	Title	Description
oceg-grc-capability-model-red-book-2-1::R1.1	Set up responsive actions and controls	Put in place responsive actions and controls that reward wanted conduct, stop or slow a harmful event, help the organisa...
oceg-grc-capability-model-red-book-2-1::R1.2	Corrective process controls	Create corrective process controls able to halt or slow an adverse event, bring the process back to a stable state, and...
oceg-grc-capability-model-red-book-2-1::R1.3	Corrective human capital controls	Create corrective human capital controls that stop, delay and recover from harmful events while discouraging repeats. Th...
oceg-grc-capability-model-red-book-2-1::R1.4	Corrective technology controls	Create corrective technology controls that stop, delay and recover from harmful events while discouraging repeats. Once...
oceg-grc-capability-model-red-book-2-1::R1.5	Corrective physical controls	Create corrective physical controls that stop, delay and recover from harmful events while discouraging repeats. Once de...
oceg-grc-capability-model-red-book-2-1::R1.6	Corrective control monitoring and reporting	Track and report how corrective control work is progressing. Assign a monitoring method and an accountable owner, and se...
oceg-grc-capability-model-red-book-2-1::R2.1	Inquiry and investigation procedures	Set up procedures for looking into complaints or reports of compliance or ethical concerns, and into issues surfaced by...
oceg-grc-capability-model-red-book-2-1::R2.2	Preparing the investigation phase	Get the investigation phase ready. Settle the scope and tier, decide whether the Board, independent auditors or regulato...
oceg-grc-capability-model-red-book-2-1::R2.3	Conducting investigations to plan	Run the investigation as planned and keep stakeholders informed while preserving privilege. Notify interviewees, tell ev...
oceg-grc-capability-model-red-book-2-1::R2.4	Reporting investigation results	Report investigation results to the right management, oversight bodies and, where fitting, other stakeholders and regula...
oceg-grc-capability-model-red-book-2-1::R3.1	Handling third-party inquiries	Identify and answer questions that come from third parties. Offer several intake routes including an anonymous helpline,...
oceg-grc-capability-model-red-book-2-1::R3.2	Spotting third-party investigations	Make sure the right people hear about a third-party investigation once it starts. Send questions received by helpline or...
oceg-grc-capability-model-red-book-2-1::R3.3	Managing third-party investigations	Set policy, procedure and ownership for handling each kind of third-party investigation. Keep an inventory of the possib...
oceg-grc-capability-model-red-book-2-1::R3.4	Selecting the internal response team	Set out how the internal team that represents the organization in a given investigation is picked. Keep initial role lis...
oceg-grc-capability-model-red-book-2-1::R3.5	Responding to a specific investigation	Set out how the response to a particular third-party investigation is built. Decide whether the Board, independent audit...
oceg-grc-capability-model-red-book-2-1::R4.1	Crisis response and continuity plans	Build plans for answering different crises and recovering from business interruption. List crises that are likely or wou...
oceg-grc-capability-model-red-book-2-1::R4.2	Crisis readiness and response teams	Name who owns crisis preparedness and who staffs the response teams for each crisis type. For each type, identify the pe...
oceg-grc-capability-model-red-book-2-1::R4.3	Crisis plan testing	Test and evaluate the crisis plans and procedures. For each crisis type, define an exercise plan with scope, frequency,...
oceg-grc-capability-model-red-book-2-1::R4.4	Coordinating continuity plans	Coordinate continuity and response plans for disruption that may hit more than one facility. Align local, regional and n...
oceg-grc-capability-model-red-book-2-1::R5.1	Remediating the GRC capability	Resolve every reported issue or incident, record the outcome, and propose changes that keep similar issues from recurrin...
oceg-grc-capability-model-red-book-2-1::R5.2	Disciplining individuals for misconduct	Take disciplinary action when people commit misconduct. Set out a documented process and decision rules, keep them in fo...
oceg-grc-capability-model-red-book-2-1::R5.3	Disclosing issue resolution	Tell stakeholders about investigation findings and resolution when required or appropriate. Disclose results to external...

What is OCEG GRC Capability Model (Red Book 2.1) and who does it apply to?

OCEG GRC Capability Model (Red Book 2.1) is a compliance framework from International with 8 domains and 136 controls. OCEG's open capability model for governance, risk management and compliance, version 2.1: 136 practices across eight components, from understanding context and organising accountability through assessing risk, preventing, detecting and responding to issues, to monitoring performance and managing information and technology. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does OCEG GRC Capability Model (Red Book 2.1) actually require?

OCEG GRC Capability Model (Red Book 2.1) has 136 controls organised across 8 domains. The largest domains are Proact (P) – OCEG GRC Capability Model (Red Book 2.1) (29 controls), Respond (R) – OCEG GRC Capability Model (Red Book 2.1) (22 controls), Assess (A) – OCEG GRC Capability Model (Red Book 2.1) (20 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of OCEG GRC Capability Model (Red Book 2.1) do I already cover?

OCEG GRC Capability Model (Red Book 2.1) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement OCEG GRC Capability Model (Red Book 2.1)?

Start your OCEG GRC Capability Model (Red Book 2.1) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about OCEG GRC Capability Model (Red Book 2.1) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 136 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,305 frameworks.

Get Started Free →

Free forever, no credit card required