In the Integrated Action and Control Model (IACM), actions and controls are categorized into key domains to ensure a comprehensive and structured approach to addressing risks, opportunities, and compliance obligations. These categories span various aspects of an organization’s operations and resources.
Examples of IACM Action and Control Categories:
Policy:
Developing and enforcing organizational policies to establish boundaries and guide behavior.
Example: Anti-bribery and corruption policies.
People:
Ensuring roles, responsibilities, and behaviors align with objectives.
Example: Leadership development programs and training initiatives.
Process:
Streamlining and improving processes to achieve efficiency and control.
Example: Implementing a process for vendor risk management.
Physical:
Managing physical assets and environments to minimize risks.
Example: Installing security cameras and access control systems.
Informational:
Protecting the integrity, confidentiality, and availability of information.
Example: Data encryption and secure backups.
Technological:
Using technology to automate, monitor, and enhance controls.
Example: Firewalls and intrusion detection systems.
Financial:
Implementing financial controls to ensure proper budgeting, allocation, and tracking of resources.
Example: Expense monitoring systems.
Why Option B is Correct:
The IACM describes a comprehensive set of categories—policy, people, process, physical, informational, technological, and financial actions and controls—which address various dimensions of governance, risk, and compliance.
Why the Other Options Are Incorrect:
A. Policy, process change, punishment, incentives, and employee education: While some elements (e.g., policy and process) are valid, this list is incomplete and overly narrow.
C. Outsourcing, downsizing, and automation: These are strategic choices, not comprehensive action and control categories.
D. Random selection, trial and error, and intuition: These are unstructured and unreliable methods, not formal action or control categories.
References and Resources:
COSO ERM Framework – Highlights various control categories for risk and compliance management.
ISO 31000:2018 – Discusses a broad range of control types, including operational and technological controls.
NIST Cybersecurity Framework (CSF) – Identifies control categories such as policy, technology, and process.
