The correct action aligns with the GRC principle of integrated risk management. Simply proceeding (A) ignores a clear risk, while outright rejection (B) is disproportionate and not collaborative. Option D creates an unenforceable arrangement. The best practice is to formally identify and document the risk, then engage the proper channel (Legal) to remediate it through contract negotiation, ensuring controls are binding and effective.

This response demonstrates an understanding that governance and culture apply to everyone uniformly. Option A erodes the control environment, option B is adversarial and escalates unnecessarily, and option C creates a double standard that damages morale and control consistency. The correct answer reinforces the ‘tone at the top’ and the principle that ethical conduct is a non-negotiable organizational requirement, not a performance-based metric.

The core elements of an effective reporting mechanism are trust and accessibility. Anonymity/confidentiality and anti-retaliation protections are fundamental to creating psychological safety for reporters. Multiple channels (phone, web, etc.) ensure accessibility. While investigation and follow-up are important, options A, C, and D contain elements that would deter reporting: lack of human interaction, removal of anonymity, or overly narrow/aggressive guarantees that may not be practical or lawful.

Monitor & Review is about continuous feedback and improvement. It ensures the GRC capability is not a static set of documents but a dynamic system. It involves assessing performance, testing controls, reviewing incidents, and adapting to new risks, laws, and business objectives. While it may involve reviewing audit results (C) or policy violations (D), its primary purpose is the holistic assessment and improvement of the GRC system itself, not just executing specific tasks.

A core tenet of GRC is integration—breaking down silos to get a connected view of risk, performance, and compliance. A tool that operates in isolation (even with great features) perpetuates the very silos GRC aims to dismantle. Therefore, the ability to integrate and create a cohesive capability (C) offers greater long-term value by improving efficiency, reducing duplication, and enabling better decision-making, even at a higher initial cost.

The ‘Respond’ phase is about taking organized, purposeful action to address requirements and opportunities. Option A is premature and may lead to rework. Option B is passive and risky. Option D, while sometimes prudent for a short period, can lead to a last-minute scramble. The correct answer (C) demonstrates proactive program management: translating assessment into a managed action plan with clear accountability, ensuring the organization is prepared well ahead of the deadline.

A perfect record in the face of widespread employee concerns about pressure to bypass controls is a classic red flag for a breakdown in reporting and communication. It suggests that the ‘tone at the top’ or local management pressure is creating a culture where employees fear reporting near-misses or minor incidents (or are incentivized not to), rendering the monitoring system blind to real risks. The issue is not necessarily the controls themselves (B) but the system for communicating and reporting problems around them.

This distinction is fundamental for clear governance. A policy is a high-level statement of management intent (the ‘what’ and ‘why’). A procedure is an operational document that details the ‘how,’ ‘when,’ and ‘by whom.’ Both can be mandatory. Policies are internal, though they may be influenced by external factors. They apply to all relevant personnel, not just executives.

This approach embodies the GRC principle of aligning activities with stakeholder needs. It starts by engaging the stakeholder (the Committee) to define requirements. The output is integrated (pulling from multiple GRC domains), concise, and focused on providing insight for oversight, not just data dumping (A or D). While financial risks are important, the modern Audit Committee’s purview often extends to operational and compliance risks, so a holistic view (C) is more valuable than a narrow one (B).

The correct action aligns with the GRC principle of integrated risk management. Simply proceeding (A) ignores a clear risk, while outright rejection (B) is disproportionate and not collaborative. Option D creates an unenforceable arrangement. The best practice is to formally identify and document the risk, then engage the proper channel (Legal) to remediate it through contract negotiation, ensuring controls are binding and effective.0