Our summary
The GRC Capability Model, also called the OCEG Red Book, is the main framework of OCEG, a global nonprofit. Version 3.5 was released for OCEG’s 20th anniversary. OCEG describes it as an open-source standard that brings governance, strategy, risk, audit, compliance, ethics and IT together in one approach, instead of separate silos. OCEG says it was built with a panel of more than 300 experts and a study of more than 500 organizations.
The model has four components: LEARN (understand the organization’s context, culture and stakeholders), ALIGN (link strategy, objectives and actions), PERFORM (promote good conduct, prevent and detect problems) and REVIEW (check design and operating effectiveness, and improve). It gives a shared vocabulary and common elements for things such as policies and training. The free version can be downloaded from the OCEG page; a premium edition with a toolkit of 90 resources is for paying All Access Pass holders. OCEG also lists translations, including an Arabic version.
How auditors use it: Use the four components as a structure to assess how well risk, compliance, ethics and audit work together, and to find gaps and overlaps between functions. It works well next to narrower frameworks such as COSO, ISO 37301 or the IIA Three Lines Model when you review an integrated GRC program.