It is important to use professional judgment when conducting a GRC assessment, rather than rigidly following all review procedures in the GRC Assessment Tools. While these tools provide valuable guidelines and frameworks, each organization and situation is unique. Professional judgment allows for flexibility and adaptation of the procedures to fit the specific context andnuances of the assessment, ensuring more relevant and effective outcomes.References:

ISO 19011:2018 - Guidelines for auditing management systems

IIA Standards for the Professional Practice of Internal Auditing

Achieving principled performance means reliably achieving objectives, addressing uncertainty, and acting with integrity. This concept integrates the management of performance, risk, and compliance to ensure that an organization not only meets its goals but does so ethically and sustainably. It involves creating a culture of accountability, transparency, and ethical behavior while systematically managing risks and ensuring compliance with relevant regulations and standards. Principled performance is about achieving success while maintaining high standards of integrity and responsibility.References:

OCEG (Open Compliance and Ethics Group) Red Book GRC Capability Model

ISO 37001:2016 - Anti-bribery management systems

Including the personnel who perform the work being assessed in the planning process is important because they possess valuable insights and knowledge about the processes and controls in place. Their involvement helps to ensure that the assessment is accurately scoped and relevant parameters are set. They can provide context and clarify operational details, contributing to a more effective and targeted assessment. Moreover, their engagement can foster a cooperativeenvironment and facilitate smoother assessment execution.References:

ISO 19011:2018 - Guidelines for auditing management systems

COSO Internal Control – Integrated Framework

When inspecting information, the Content Criteria provides a guide to evaluating the design of the control. Content Criteria help ensure that the controls are appropriately designed to achieve their intended purpose. Evaluating the design involves assessing whether the control's structure, procedures, and policies are adequate to mitigate identified risks and meet regulatory and organizational requirements.References:

ISO 19011:2018 - Guidelines for auditing management systems

COSO Internal Control – Integrated Framework

When writing a complete recommendation, it is important to include specific suggestions or mandatory requirements to comply with in order to fix the problem. This ensures that the recommendation is actionable and provides clear guidance on what needs to be done to address the issue. General comments may not provide enough detail or direction for effective implementation. Clear, detailed recommendations help organizations understand the necessary steps to mitigate risks and improve controls.References:

ISO 19011:2018 - Guidelines for auditing management systems

COSO Internal Control – Integrated Framework

Assessments should be selected based on how objectives connect and prioritize the risk universe and assessment universe. This approach ensures that the assessments are aligned with the organization's strategic goals and that the most significant risks are addressed. It involves understanding the organization's risk landscape and prioritizing assessments that focus on theareas of highest impact and relevance to achieving objectives.References:

ISO 31000:2018 - Risk management – Guidelines

COSO Enterprise Risk Management – Integrating with Strategy and Performance

The dimensions of TOTAL Performance are Effectiveness, Resiliency, and Agility. Effectiveness refers to achieving the desired outcomes. Resiliency is the ability to recover from setbacks and continue operations. Agility is the capacity to adapt quickly to changes and new opportunities. These three dimensions collectively ensure that an organization can perform well under various conditions and sustain its success over time.References:

ISO 9001:2015 - Quality management systems – Requirements

COSO Enterprise Risk Management – Integrating with Strategy and Performance