(What is the Integrated Action & Control Model (IACM) designed to provide?

The Integrated Action & Control Model (IACM) is intended to help organizations view GRC as an integrated system of actions and controls applied across governance, management, and assurance to achieve objectives, address uncertainty, and meet obligations. Option D matches this purpose: the model provides a comprehensive way to consider the full range of actions and controls that support performance, risk management, and compliance, and how these fit together across organizational levels. This is consistent with modern GRC thinking that emphasizes integration (avoiding siloed risk, compliance, security, and audit activities) and ensuring that controls are right-sized to the organization’s context and risk profile. Options A, B, and C misstate the intent: it is not primarily a profit-maximization financial model (A), not an outsourcing decision tool (B), and it does not promise “perfect compliance” or elimination of all risk (C)—which is neither realistic nor aligned with risk-based governance.