1. OCEG. (2015). GRC Capability Model (The Red Book) (Version 3.0).
Section 4.3.2.1, Directive Controls (p. 71): This section explains that directive controls are designed to "encourage desirable events to occur." It explicitly lists "rewards and incentives" as a primary example of a directive control, which directly supports the use of financial mechanisms like bonuses and profit-sharing to guide behavior.
2. Rittenberg, L. E., & Quirin, J. J. (2018). Aligning the Three Lines of Defense with the COSO 2013 and GRC. Institute of Internal Auditors Research Foundation.
Chapter 4, "Incentives and Performance Management": This chapter discusses how performance management systems, including compensation and bonus structures (economic incentives), are critical for reinforcing desired behaviors and aligning actions with the organization's risk management and governance objectives.
3. Steinberg, R. M. (2011). Governance, Risk Management, and Compliance: It Can't Happen to Us--Avoiding Corporate Disaster While Driving Success. Wiley.
Chapter 10, "People and Organizational Structure": This chapter details the importance of aligning employee incentives with corporate strategy. It describes how compensation plans, including bonuses and profit-sharing, are fundamental tools for motivating employees to act in the company's best interest, thereby serving as a key GRC control.