GRC & Compliance

A GRC platform holds risk registers, regulatory requirements, policies, remediation tasks and the evidence behind them in one place. The name covers three layers: governance sets roles and decision rights, risk management handles identification and assessment, and compliance maps requirements onto specific controls. The value sits in the links between them, because one control can then answer several requirements at once.

Beyond documentation the project covers the work that makes the system operate: an inventory of assets and processes, risk workshops with owners, assigned accountability and the controls that are missing. The consultant trains the people who will keep the registers and run reviews, then performs an internal audit to catch nonconformities before the certification body sees them. Part of the scope stays with the buyer, because evidence cannot be purchased.

You can face the certification audit only once the system has produced evidence: completed reviews, handled incidents and an internal audit. Writing the documentation moves quickly, and the calendar is set by waiting for those records. The rest depends on the size of the scope, the number of locations and how much time process owners genuinely get for interviews and rework. The certification audit runs in two stages, a documentation review and an on site assessment.

NIS2 obligations concern risk management measures and incident handling, not holding a particular certificate. ISO 27001 is often the most convenient route to evidencing those measures, since it supplies a ready structure and a trail of records, yet it stays a choice rather than a command. The detail follows from the directive and from the national provisions implementing it, and those provisions change, so verify the legal position on the day you sign.

In a company of a dozen or so people the system is usually run by one person combining it with another job, and the risk register stays short. Independence then becomes the constraint, because whoever wrote a procedure should not assess it during the internal audit, so that role is bought in or given to someone outside the area. In a large organisation documents multiply, yet agreeing process owners across departments proves harder.

Naming one decision maker who can settle the scope and referee disputes between departments saves the most time. Collect what already exists: a list of systems and data, suppliers with their contracts, previous policies and incident records, even incomplete ones. Block time in the calendars of process owners for interviews, because the pace depends on them. Agree the purpose of the project as well, since it decides the scope.

A gap analysis result exists to drive three decisions: what belongs inside the scope, what you fix in house and what you buy in. Rank the gaps by risk and by whether they block the audit, because some close with a justification in the statement of applicability while others need a control built. Give every item an owner and a date, otherwise the same list returns unchanged.

The simplest test is whether evidence appears on its own, without a rescue operation just before the audit. A working system shows in risk reviews held on schedule, in remediation tasks that carry an owner and a closing date, and in incidents recorded and closed through the procedure. Another good check is a customer questionnaire answered from existing documentation, with no hunt across the company.

Accountability for compliance stays with the organisation and its management, because regulations address the entity rather than its adviser. The consultancy answers to you for the quality of its work on contractual terms, so write down what happens when an audit raises nonconformities and who carries the cost of closing them. The certification body answers for its own assessment and has to remain independent.

With a small budget the biggest gain comes from narrowing the scope to the processes and systems that actually carry the service or the data under the requirement. Buy the gap analysis and the risk assessment, write the documentation in house from those findings, and order a review of it from the consultant. If no customer and no rule demands the certificate, the system can run without certification.