An assurance professional's fundamental role is to provide an independent and objective assessment. Their professional standards and organizational function (typically as a second or third line of defense) mandate impartiality and a focus on factual, evidence-based reporting. This structural independence is designed to minimize bias. In contrast, a process owner (the first line of defense) has direct operational responsibility and a vested interest in the process's perceived success. This makes their reports or statements, whether written or vocalized, inherently more subjective. The formal, structured nature of an assurance report further enhances its objectivity.

A. Vocalized statements from a process owner are subjective and informal. They are influenced by the owner's inherent bias due to their direct responsibility.

C. A written report by a process owner is a self-assessment. It lacks the critical independence and impartiality provided by a separate assurance function.

1. OCEG. (2021). GRC Capability Model, Version 3.5 ("The Red Book"). Section 4.3.3, "Provide Assurance": "Assurance activities are performed by competent individuals who are objective and independent of the activity being evaluated." This directly states that objectivity and independence are core requirements for assurance providers.

2. OCEG. (2021). GRC Capability Model, Version 3.5 ("The Red Book"). Section 2.2, Principle 4: "Assurance on objectives and the effectiveness of controls is provided by a variety of roles, some of which are independent of management." This principle underscores the value of independence in providing reliable assurance.

3. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing. Standard 1100 – Independence and Objectivity: "The internal audit activity must be independent, and internal auditors must be objective in performing their work." This standard is a cornerstone of assurance practices taught in university auditing and GRC courses and establishes the expectation of objectivity for assurance professionals.

The core attributes of an assurance professional are fundamental to providing credible and reliable assessments within a Governance, Risk, and Compliance (GRC) framework. Independence ensures the assurance function is free from organizational or political pressures that could compromise its findings. Objectivity refers to the professional's unbiased mental attitude, allowing for impartial judgments. Diligence, a component of due professional care, requires the professional to apply the care and skill expected of a reasonably prudent and competent practitioner. Together, these three attributes form the foundation of trustworthy assurance.

B. "Fallibilism" is a philosophical principle concerning the possibility of being wrong; it is not a standard professional attribute for assurance practitioners in GRC frameworks.

C. "Freedom" is too general and ambiguous. Independence is the specific, professionally defined term that describes the necessary freedom from conditions that threaten objectivity.

1. OCEG, "GRC Capability Model," Version 3.5 (2021). Section 4.3, "Monitor, Audit, and Assure," emphasizes the necessity for assurance functions to be "independent and objective" to provide reliable information to the governing body and stakeholders. The concept of diligence is embedded in the expectation of competent and thorough performance of these assurance activities.

2. The Institute of Internal Auditors (IIA), "International Standards for the Professional Practice of Internal Auditing (Standards)," (2017). The IIA Standards are a foundational source for assurance principles within GRC.

Standard 1100 – Independence and Objectivity: States that "The internal audit activity must be independent, and internal auditors must be objective in performing their work."

Standard 1220 – Due Professional Care: States that "Internal auditors must apply the care and skill expected of a reasonably prudent and competent internal auditor." This standard explicitly covers diligence in its application.

3. Brink, V. Z., & Witt, H. (1982). Modern Internal Auditing: Appraising Operations and Controls. John Wiley & Sons. This foundational academic text on auditing, often used in university curricula, extensively details independence, objectivity, and due professional care (including diligence) as the essential characteristics of an auditor (an assurance professional). Chapter 3, "The Conceptual Framework of Internal Auditing," is dedicated to these principles.

Compliance is defined within the OCEG framework as the state of adherence to an organization's obligations. These obligations include both mandatory requirements (e.g., laws, regulations) and voluntary commitments (e.g., internal policies, ethical codes). Therefore, the process of measuring how well an organization is meeting these defined obligations is the core activity of assessing compliance. This measurement confirms whether the organization is operating within its required boundaries and commitments.

A. Performance: Performance measures the achievement of strategic and operational objectives. While meeting obligations can be an objective, performance is a broader concept focused on effectiveness and efficiency in reaching goals.

B. Risk: Risk is the effect of uncertainty on objectives. It represents the potential for future events to impact the achievement of goals, including the goal of meeting obligations, rather than the current state of adherence.

1. OCEG. (2021). GRC Capability Model ("The Red Book"), Version 3.5.

Section 2.2.3, The Outcome of Principled Performance: "Compliance is the state of adherence to the organization’s mandatory and voluntary obligations." This directly links the concept of compliance to meeting obligations.

Glossary, Page 113: Defines "Compliance" as "Act of adhering to, and the ability to demonstrate adherence to, mandatory requirements and voluntary commitments."

Glossary, Page 116: Defines "Obligation" as "A requirement that an organization must, or chooses to, meet."

2. Racz, N., Weippl, E., & Seufert, A. (2010). A frame of reference for research of integrated Governance, Risk, & Compliance (GRC). Proceedings of the 43rd Hawaii International Conference on System Sciences.

Section 3.2, GRC Definitions: The paper, referencing OCEG, discusses compliance as being concerned with conforming to stated requirements (obligations), distinguishing it from risk management (addressing uncertainty) and governance (steering the organization). (DOI: https://doi.org/10.1109/HICSS.2010.374)

OCEG defines “Total Performance” as the overall result of a GRC capability when it is judged along three measurement dimensions:

• Effectiveness – are desired objectives achieved?

• Efficiency – are objectives achieved with optimal use of resources?

• Responsiveness – how quickly and accurately does the capability detect and react to change?

These three dimensions are listed together in the “Evaluate Total Performance” element of the OCEG GRC Capability Model (Red Book). No other dimensions (e.g., agility or resiliency) are named as part of Total Performance in the official model.

B. Agility, Efficiency and Effectiveness – “Agility” is not included in the OCEG definition of Total Performance; responsiveness is the required third dimension.

C. Effectiveness, Resiliency, and Agility – Includes neither efficiency nor responsiveness, both mandated by OCEG, and substitutes two dimensions not used in the model.

1. OCEG GRC Capability Model (Red Book) v3.0, Section 3.E “Evaluate Total Performance,” Bullet list 1-3, pp. 82-83.

2. OCEG GRC Capability Model (Red Book) v2.1, Element PER-5 “Total Performance,” para. 2, p. 69 (lists effectiveness, efficiency, responsiveness).

The inspection of a RACI (Responsible, Accountable, Consulted, Informed) matrix for best practice content is a test of a control's design effectiveness. A RACI matrix is a control mechanism that clarifies roles and responsibilities to ensure processes operate as intended and objectives are met. By evaluating its content against established best practices, the assurance provider is assessing whether the control is properly designed to prevent or detect issues related to accountability and responsibility. This is a core function of a control test, which focuses on the control's design and operating effectiveness, rather than verifying the substance of individual transactions or data points.

B. Substantive test: This is incorrect because a substantive test is designed to detect material misstatements in data, such as financial account balances or transactions, not to evaluate the control itself.

1. OCEG GRC Capability Model 3.5 (The "Red Book"):

Section 4.3, Test Controls: "Testing is the process of verifying that controls are designed appropriately and operating effectively." The scenario describes an inspection to verify the appropriate design of the RACI matrix (a control), which aligns perfectly with this definition of a control test.

Glossary, Definition of Control: A control is defined as "An activity or set of activities designed to ensure that a desired outcome is achieved, an undesired outcome is prevented, or progress toward objectives is made." A RACI matrix serves this purpose by preventing confusion over roles.

2. University of Illinois at Urbana-Champaign, Courseware (ACCY 405 - Assurance and Attestation):

Lecture Notes on Audit Evidence and Procedures: "Tests of controls are audit procedures to test the effectiveness of controls in support of a reduced assessed control risk... Substantive tests of transactions are to test for dollar misstatements... in the financial statements." The inspection of a RACI matrix is a test of the control's effectiveness, not a test for dollar misstatements. This distinction is a fundamental principle in auditing and assurance education.

While the assessor must maintain ultimate independence and objectivity regarding the conclusions, opinions, and recommendations within the Assessment Report, best practices in assurance and auditing require engagement with the personnel who perform the work being assessed. This engagement is critical for the specific purpose of validating the factual accuracy of the assessor's observations and findings before the report is finalized. This step, often conducted by sharing a draft of the findings, prevents the report from being based on misunderstandings and increases its credibility, acceptance, and the likelihood that its recommendations will be implemented effectively. The final judgment remains with the assessor, but the factual basis should be confirmed.

The statement "True" is incorrect because it promotes a level of isolation that is counterproductive and can lead to factually inaccurate reports. A complete lack of "help" or input from process owners ignores the crucial step of factual validation. An assessment report based on incorrect facts is of little value to the organization and undermines the credibility of the assurance function. This practice of validating facts does not compromise the assessor's independence; rather, it strengthens the quality and utility of the final report.

1. OCEG GRC Capability Model 3.5, "The Red Book": While not stating this exact phrase, the principles within Component 3: PROACTIVELY ASSURE, particularly Element 3.4: Communicate Assurance, emphasize that communication of results must be "understandable and useful to the recipients." A report containing factual errors is neither understandable nor useful. The process of ensuring factual accuracy, which involves communication with the assessed party, is an implicit and necessary step to meet this objective. The entire feedback loop of GRC relies on accurate communication between those who do the work and those who provide assurance.

2. Sawyer, L. B., Dittenhofer, M. A., & Scheiner, J. H. (2003). Sawyer's Internal Auditing: The Practice of Modern Internal Auditing. The Institute of Internal Auditors Research Foundation. This foundational text, widely used in university auditing courses, outlines the audit process. In chapters covering the communication of audit results (e.g., Chapter 21 in the 5th edition), it details the importance of the "exit conference" or discussion of draft findings with management (the personnel assessed). The purpose is explicitly stated as ensuring that there are no misunderstandings of fact before the final report is issued. This confirms that "help" in the form of factual validation is a standard and required practice.

3. Arens, A. A., Elder, R. J., & Beasley, M. S. (Various Editions). Auditing and Assurance Services. Pearson Education. This is a standard textbook in university accounting and auditing programs worldwide. In the sections on completing the audit and reporting, the text describes the process of communicating findings to management and the audit committee. It consistently emphasizes the importance of discussing findings with management to resolve any disagreements over facts, which is a form of collaboration or "help" that enhances the report's quality.

This statement is incorrect because it presents an overly restrictive view of the follow-up process. While verifying the implementation of recommendations and action plans is a critical part of follow-up, a mature GRC process requires a broader scope. Effective follow-up must also include assessing the effectiveness of the implemented actions. The goal is not simply to confirm that a task was completed, but to ensure that the underlying issue has been resolved and the associated risk has been mitigated to an acceptable level. This involves verifying outcomes, not just outputs.

The statement "True" is incorrect because it promotes a "checklist" mentality that can be dangerous. An organization could complete every item on an action plan, but if those actions were not effective, the organization remains exposed to the original risk. The OCEG GRC Capability Model emphasizes a continuous cycle of performance, review, and improvement, which necessitates evaluating the actual impact and effectiveness of corrective actions, not just their completion status.

1. OCEG, "GRC Capability Model," Version 3.5 (2021). The model's "Review" component (Component 4) describes activities that go beyond simple follow-up on action plans. Specifically, Element 4.3, "Monitor," involves "ongoing monitoring of the internal and external context, culture, and stakeholder needs as well as GRC activities, controls, and outcomes" (p. 58). This demonstrates that follow-up is about monitoring outcomes and effectiveness, not just the action plan itself.

2. OCEG, "GRC Capability Model," Version 3.5 (2021). The "Improve" component (within the "Review" section) emphasizes using information from monitoring and assurance to "determine and implement improvements to address the root cause of issues and mature the GRC capability" (p. 57). This confirms that the process is about resolving root causes and achieving improvement, a scope far broader than just checking off action plan items.

The statement is unequivocally false. Assessment execution plans are not meant to be rigid and unchangeable. In practice, an assessment is a dynamic process of discovery. As assessors gather evidence and perform tests, they may uncover new information, unexpected issues, or areas of higher-than-anticipated risk. A fundamental principle of effective assessment and assurance is the ability to adapt the plan based on these interim findings. Modifying the plan—for example, by expanding the scope, changing testing methods, or reallocating resources—is crucial to ensure that the assessment's objectives are met and that the final conclusions are accurate and relevant.

The "True" option is incorrect because it promotes a rigid, inflexible approach that is contrary to the principles of effective governance, risk management, and compliance. Adhering strictly to an initial plan, even when new evidence suggests it is flawed or incomplete, would undermine the very purpose of the assessment. The OCEG framework emphasizes an agile and responsive GRC capability that can adapt to a changing environment and new information.

1. OCEG GRC Capability Model 3.0 ("The Red Book"). The entire model is designed as an iterative loop (Learn -> Align -> Perform -> Review), indicating that findings from one stage inform and potentially alter subsequent stages. The "Review" component, which includes assessments, is designed to provide feedback to improve performance. This inherently requires the flexibility to act on new information, which may involve changing plans. The principle of Responsiveness is a core design objective, meaning the GRC capability must "react in a timely and appropriate manner to changes in the internal and external environment." An inflexible assessment plan would violate this principle. (OCEG, GRC Capability Model 3.0, 2015, Section 2.2, "Design and Operating Objectives").

2. Sobel, P. J. (2017). Auditor's Risk Management Guide: Integrating Auditing and ERM. While an IIA publication, its principles are foundational to the assurance activities described in the OCEG model. The guide emphasizes that audit (a form of assessment) planning is an iterative process. "The risk assessment is not a one-time event... As the audit progresses, the auditor may identify new risks or determine that the initial assessment of risks was incorrect. In such cases, the audit plan and program should be modified accordingly." (Sobel, P. J., 2017, Chapter 5: Performing the Engagement).

3. Massachusetts Institute of Technology (MIT) OpenCourseWare. 15.571, The Law of Corporate Finance and Financial Markets, Fall 2005. Course materials on internal controls and the role of auditors (as assessors) consistently describe audit planning as a dynamic process. Lecture notes and associated readings explain that auditors must exercise professional skepticism and adjust their audit plan based on evidence gathered. For instance, if initial sample testing reveals a high rate of exceptions, the audit plan must be changed to expand the sample size or perform alternative procedures. This adaptability is a hallmark of professional due care.

The statement is an oversimplification of the GRC escalation process. While escalation is necessary when actions and controls are not implemented, immediately escalating every instance to the board is incorrect and inefficient. GRC frameworks, such as the OCEG GRC Capability Model, advocate for a structured, risk-based, and tiered escalation path. Issues are typically first escalated to the responsible process or business unit owner, then to senior management, and only to the board if the issue is of high strategic importance, poses a significant risk, or if management has failed to address it after previous escalations.

The "True" option is incorrect because it prescribes a one-size-fits-all action that bypasses established management structures and the principle of proportionality. This approach would overwhelm the board with operational details, undermine management's authority, and create "alarm fatigue," diminishing the board's ability to focus on genuinely critical strategic risks. The proper GRC process involves defined escalation criteria and paths, not an automatic and immediate report to the highest governance body for every control failure.

1. OCEG, "GRC Capability Model," Version 3.5 (2021). Section 4.3.3, "Communicate Monitoring Results," states that monitoring results should be communicated to "appropriate personnel to enable them to take timely and effective action." This refers to management and process owners responsible for remediation, not an immediate escalation to the board.

2. OCEG, "GRC Capability Model," Version 3.5 (2021). Section 3.4.4, "Proactive & Event-Driven Processes," discusses the need to "establish clear escalation paths and ownership for investigation and response." The existence of defined "paths" (plural) contradicts the idea of a single, immediate escalation point (the board) for all such events.

3. Simmons, S. S. (2017). Corporate Governance and the Board: What Works Best. John Wiley & Sons. While not an OCEG-specific document, this type of academic text on corporate governance clarifies the board's role. Chapter 5, "The Board's Role in Risk Management," emphasizes that the board's function is oversight, not direct management. The board oversees the risk management framework but relies on management to execute it. Escalation to the board is for systemic failures or strategic risks, not for every operational control deficiency.

The statement incorrectly merges activities from two distinct phases of the assessment process. Assessment Planning is the initial phase focused on defining the scope, objectives, timing, and resources for the assessment. This planning is typically informed by existing or high-level risk assessments to prioritize areas of focus. However, the detailed testing of controls and the execution of a complete risk assessment are activities that occur during the execution or fieldwork phase, which follows the planning phase. The plan dictates what will be tested; the testing itself is not part of the planning.

The statement would be "True" if it suggested that planning uses the results of risk assessments to determine the scope of detailed testing. However, it incorrectly states that conducting a complete risk assessment and detailed testing are part of the planning phase itself. This misrepresents the logical and universally accepted sequence of assurance and audit activities.

1. OCEG, "GRC Capability Model 3.5," (The Red Book), 2021.

Section 4.4, Element: ASSURE. This section outlines the process for providing assurance. It explicitly separates the design of the assurance plan from its execution. The text describes the process as: "1. Design assurance plan... 2. Conduct assurance activities... 3. Communicate assurance results." This clearly shows that planning ("Design assurance plan") is a separate and preceding step to the actual execution of tests ("Conduct assurance activities"). The question incorrectly combines step 1 and step 2.