The OCEG GRC Capability Model defines the Fourth Line of Accountability as the governing body (e.g., the Board of Directors) and executive management. This line holds ultimate accountability and responsibility for the entire organization's performance, including its governance, risk management, and compliance (GRC) posture. They provide oversight, set the "tone at the top," and ensure that the GRC framework is effectively designed and implemented to achieve organizational objectives while addressing uncertainty and acting with integrity.

A. The Procurement Department is part of the First Line, which consists of operational management that owns and manages risk in day-to-day business activities.

B. The HR department is also part of the First Line, responsible for managing risks and controls related to human capital and employee conduct.

C. The Compliance Department is a core component of the Second Line, which provides specialized expertise, oversight, and monitoring for risk and compliance matters.

1. OCEG. (2021). GRC Capability Model, Version 3.5. Section 2.3, "Organize and Oversee," particularly the discussion on roles and responsibilities and the illustrative diagrams of the Lines of Accountability, which place the governing body and management at the highest level of oversight and accountability.

2. Steinberg, R. M. (2020). Governance, Risk Management, and Compliance: Unlocking Organizational Performance and Value. Wiley. Chapter 4, "GRC Roles and Responsibilities," discusses the accountability structure, aligning with the OCEG model where executive leadership and the board form the ultimate line of accountability.