Do not try to build it all at once. A binder nobody reads helps no one.
Most organizations do not build GRC capability all at once, and should not try. A full enterprise framework before the basics are in place usually yields a binder nobody reads, not a programme that changes behavior.
1. Start with a risk register, not a framework. List the risks that could hurt the business this year, whether operational, financial, regulatory or reputational, and rank them by likelihood and impact. This alone prompts useful conversations.
2. Give each risk an owner. A named person, not a department. "IT" is not an owner. The IT manager is.
3. Write down the controls you already have. Most organizations do more risk management than they realize: approval chains, segregation of duties, access reviews. Document what exists before designing what is missing.
4. Use one recognized framework as a reference, not a cage. COSO, ISO 31000 or a sector standard can guide the structure without dictating every detail. Adapt it to your size.
5. Report on a schedule, not only on request. A short quarterly risk report to leadership, even three pages, builds the habit of oversight that regulators and investors look for.
GRC maturity is measured in quarters, not weeks. The organizations that succeed treat it as how they operate, not a compliance exercise to get through an audit.