(In the context of the GRC Capability Model, what is meant by the term “organizational...

Within the GRC Capability Model (commonly aligned to OCEG’s GRC concepts), an organizational unit is a defined subdivision of the enterprise—such as a department, function, business line, program, product group, subsidiary, or region—created to achieve specific objectives and accountable for certain outcomes. This concept matters in GRC because governance, risk, and compliance responsibilities are executed and evidenced at the unit level: policies are implemented, controls operate, risks are owned, and performance is measured within identifiable parts of the organization. Defining organizational units enables consistent assignment of accountability, mapping of processes and controls to where work is performed, and aggregation of risk/compliance reporting for enterprise oversight (similar to how frameworks like COSO ERM and ISO 31000 expect risk ownership and reporting across organizational structures). The other options are narrower administrative views (finance record structure, facilities, or HR team grouping) and do not capture the broader governance/accountability construct intended by “organizational unit” in GRC capability modeling.