TheFifth Line, or theGoverning Authority (Board), holdsultimate accountabilityfor the governance, management, and assurance of performance, risk, and compliance.
* Role of the Governing Authority:
* Sets the tone at the top by defining the mission, vision, and strategic objectives.
* Ensures proper oversight and accountability across all lines.
* Approves and monitors the effectiveness of risk management, performance, and compliance initiatives.
* Why Other Options Are Incorrect:
* B: The Second Line implements performance, risk, and compliance programs but does not have ultimate accountability.
* C: The First Line executes operational activities but does not govern or manage assurance.
* D: The Third Line provides independent assurance but is not accountable for governance and management.
References:
* COSO ERM Framework: Highlights the Governing Authority's accountability for enterprise risk and compliance.
* OCEG GRC Capability Model: Describes the plenary accountability of the Fifth Line.

The concept of maturity in the GRC Capability Model is applied across all levels to:
Assess Preparedness:
Maturity levels indicate the organization's capability to effectively manage GRC processes.
Lower levels indicate ad hoc or chaotic processes, while higher levels reflect integration and optimization.
Support Continuous Improvement:
Organizations use maturity models to identify gaps and develop plans for improvement.
Continuous monitoring and progression through maturity levels ensure sustained growth and efficiency.
Broad Application:
Maturity is applied across the entire organization and its processes rather than focusing solely on specific individuals or programs.
Why Other Options are Incorrect:
A: Maturity applies to all levels, not just the highest.
C: Maturity is not used to evaluate individual performance; it is applied to processes and systems.
D: Budget allocation is not directly tied to maturity evaluation but may be influenced by its findings.
Reference:
CMMI and OCEG GRC Capability Model: Both outline maturity as a mechanism for evaluating and improving organizational processes.
ISO 9001: Reinforces the use of maturity levels to drive quality and continuous improvement.