Governance, Risk & Compliance (GRC)

How an engagement works

Indicative durations. We confirm the plan and timeline in your proposal.

1. 1

   Gap assessment

   Review of governance, risk practices and management systems against the target standards.

   DeliverableGap report and implementation plan1 to 3 weeks
2. 2

   Framework design

   Governance charter, risk management methodology, policies and management system procedures.

   DeliverablePolicy and procedure set3 to 6 weeks
3. 3

   Risk & control assessment

   Risk workshops with each department, risk registers, and a control matrix for key processes.

   DeliverableRisk register and control matrix3 to 5 weeks
4. 4

   Implementation & training

   Procedures put into use, records started, and staff trained on their responsibilities.

   DeliverableWorking system with records and trained staff2 to 4 months
5. 5

   Internal audit & certification

   Internal audit, management review and support through the certification body’s Stage 1 and Stage 2 audits.

   DeliverableAudit-ready system and closed findings4 to 8 weeks