According to1, OCEG GRC model is ''a framework for integrating governance, risk management, compliance and ethics/culture into a single capability''.It defines risk management as ''the capability that enables an organization to understand how uncertainty affects its ability to achieve objectives''2.