The Policy category in the IACM encompasses formal statements, rules, and guidelines that articulate the organization's intentions and expectations.
Role of Policies:
Set boundaries and guidelines for behavior and decision-making.
Ensure consistency in actions and alignment with organizational goals.
Examples:
Code of conduct.
Data privacy and security policies.
Why Other Options Are Incorrect:
A: Information deals with data and communication, not formal statements.
B: People refer to human elements like roles and responsibilities.
C: Technology focuses on tools and systems.
References:
OCEG IACM Framework: Highlights the role of policies in formalizing organizational expectations.

Normsare socially reinforced expectations, customs, or unwritten rules that influence behavior within a group or organization.
* Definition:
* Norms dictate acceptable behavior and interactions within a group.
* Importance in Organizations:
* Norms shape the organizational culture and influence decision-making, collaboration, and communication.
* Examples of Norms:
* Greeting colleagues in the morning.
* Responding promptly to emails within a set timeframe.
References:
* Corporate Culture Studies: Discuss how norms develop and their impact on group behavior.
* COSO Framework: Links norms to cultural elements in governance and risk.

Ongoing and periodic review activities are designed toevaluate the performance of actions and controlsin terms of their effectiveness, efficiency, responsiveness, and resilience.
* Purpose of Reviews:
* Effectiveness: Ensures objectives are being met.
* Efficiency: Confirms optimal use of resources.
* Responsiveness: Measures the speed of adaptation to changes or issues.
* Resilience: Assesses the ability to recover from disruptions.
* Why Other Options Are Incorrect:
* A: Reviews complement external audits, not replace them.
* B: Cost reduction may be a result but is not the primary purpose.
* D: Documentation for legal defenses is a secondary benefit, not the main goal.
References:
* COSO ERM Framework: Highlights the role of reviews in assessing risk management and control performance.
* OCEG GRC Capability Model: Recommends regular reviews for continuous improvement.

Performance culture refers to the mindset and practices within an organization that focus on objectively evaluating and improving the effectiveness, efficiency, responsiveness, and resilience of key activities and outcomes.
Key Elements of Performance Culture:
Effectiveness: Ensuring that objectives are achieved in alignment with organizational goals.
Efficiency: Using resources in the best way possible to deliver desired outcomes.
Responsiveness: Adapting quickly to changes in the internal or external environment.
Resilience: Ensuring continuity and recovery in the face of challenges or disruptions.
Why Option B is Correct:
Performance culture encompasses practices that assess and improve critical activities and outcomes.
Option A (management culture) focuses on leadership and decision-making styles.
Option C (governance culture) deals with oversight and accountability, not operational performance.
Option D (assurance culture) relates to providing confidence in controls and compliance, which is narrower in scope.
Relevant Frameworks and Guidelines:
COSO ERM Framework: Recommends building a performance-driven culture to achieve risk management objectives.
ISO 9001 (Quality Management): Encourages organizations to establish performance-driven processes for continual improvement.
In summary, a performance culture ensures that the organization continuously evaluates and improves its activities and outcomes to achieve operational excellence and resilience.

Key external stakeholders include those who have significant influence over the organization's operations, strategy, and outcomes, such ascustomers, shareholders, creditors and lenders, government, and NGOs.
* External Stakeholder Roles:
* Customers: Drive revenue and product/service demand.
* Shareholders: Provide capital and influence strategic decisions.
* Creditors and Lenders: Affect financing and liquidity.
* Government and NGOs: Set regulatory frameworks and advocate for societal priorities.
* Why Other Options Are Incorrect:
* A: Distributors and resellers are part of supply chain stakeholders, not key external influencers.
* B: Employees and board members are internal stakeholders.
* C: Marketing agencies and auditors are third-party service providers, not primary external stakeholders.
References:
* Stakeholder Management Standards (ISO 26000): Discusses key stakeholder identification.
* COSO Framework: Emphasizes the importance of external stakeholder engagement in risk management and governance.