The Integrated Assurance and Control Model (IACM), as conceptualized within the OCEG framework, addresses unfavorable events (risks) arising from obstacles by implementing controls. The primary purpose of these controls is to modify risk. This modification is achieved by designing and operating activities that reduce the probability (likelihood) that a negative event will occur and/or lessen the severity of its consequences (impact or harm) if it does occur. This proactive management of risk is fundamental to reliably achieving organizational objectives.

A. By focusing on opportunities: While the GRC framework addresses both threats (obstacles) and opportunities, this option is incorrect because the question specifically asks about unfavorable events, which are the domain of risk and threat management, not opportunity pursuit.

C. By implementing a flat organizational structure: The OCEG framework is agnostic about specific organizational structures. It focuses on principles, capabilities, and processes, not mandating a particular organizational design like a flat hierarchy.

D. By conducting regular employee satisfaction surveys: This is a specific example of a monitoring activity or a control indicator. It is too narrow and represents only one possible tool, not the fundamental mechanism by which the entire integrated model addresses all unfavorable events.

---

1. OCEG GRC Capability Model 3.0 ("The Red Book").

Section 3.3, PERFORM Component, Page 25: This section explicitly defines controls as "measures that modify risk." It further clarifies that a key risk response is to "modify the risk (e.g., by implementing controls to reduce likelihood or impact)." This directly supports the correct answer (B) by defining the core function of controls in managing unfavorable events.

Section 2.1, What is GRC?, Page 11: Defines GRC as the capability to "reliably achieve objectives while addressing uncertainty and acting with integrity." Addressing uncertainty involves managing both downside risk (unfavorable events from obstacles) and upside risk (opportunities). The mechanism for managing downside risk is to reduce its potential for harm.