GRC programmes start configuring before anyone agrees who decides. The five governance foundations to name first, and how to tell they are missing.

Running a GRC implementation with a small team is often presented as disciplined cost management. Roles are combined, specialist capacity is kept fractional, and positions considered non-essential are left out. The assumption is that the implementation can still be delivered with a leaner structure. Sometimes it can. A smaller team is not inherently a weak team, and combining roles works well where scope is limited and the person taking on the extra ground has the relevant ex

The first in a series on what determines whether a GRC platform is still trusted two years after go-live, and why none of them appear on a delivery plan. In our experience, most GRC platform implementations are reported as successful. The closure pack records the milestones met, notes some variance on time or budget, thanks the delivery partner and moves on. That account is rarely dishonest. It is just describing the part of the work that was visible from where the reporting