GRC Without Technical Enforcement Is Just Documentation.

It means the controls are monitored and the evidence is assembled as it is produced, rather than gathered before a review. Concretely: access changes captured when they happen, exceptions logged with an owner and an expiry, attestations collected on a schedule and compiled, and retention applied automatically rather than remembered. The test is whether producing twelve months of evidence is a retrieval exercise or a project.

A consultant typically delivers an assessment or a framework and leaves your team to implement and operate it. We build the programme and then run it, including the technical controls underneath. Both models are legitimate; they solve different problems. The one that fits depends on whether your constraint is knowing what to do or having the capacity to do it continuously.

Scope should follow size, but the obligations largely do not. A twelve-person adviser has the same recordkeeping duties as a two-hundred-person one, with a fraction of the staff to meet them. The practical answer for smaller firms is a deliberately narrow programme that is genuinely operated — not a broad one that exists mainly on paper. A narrow programme you can evidence is more defensible than a comprehensive one you cannot.

The controls and documentation can be in place in weeks. Evidence takes time by definition — demonstrating that a control operated over a period requires the period to elapse. Firms starting from nothing are usually in materially better shape within a quarter, and have a full evidentiary record after a year of operation.

Most firms do, and they are usually the least of the problem. The gap is almost always between what the policy commits to and what the environment enforces — a policy promising quarterly access reviews with no record of one having occurred is worse than having no policy, because it creates an examinable obligation the firm has documented itself failing. We start by reconciling the two.