A good GRC system can make risk management more efficient, connected and informative. It cannot rescue an unclear framework, poor data or weak accountability. These twelve rules cover the full journey from business case to lasting adoption.
Four phases, twelve practical rules
The original paper structures the selection and implementation journey around preparation, selection, implementation and utilisation. The sequence matters: a platform should be chosen to support the risk framework, not allowed to dictate it.
1. Preparation: get the framework right first
1. Be realistic
A GRC platform is an enabling tool, not a substitute for effective risk management. Clarify what decisions, workflows and controls it is meant to support.
2. Stabilise and simplify the risk framework
Review risk taxonomy, assessment methods, controls, responsibilities and reporting before selecting software. Avoid reproducing the shortcomings of legacy spreadsheets in a more expensive platform.
3. Build a strong business case
Define the use cases, user population across the three lines, ownership, administration, integrations and expected benefits. A single shared source of risk information is an aspiration that needs governance and organisational agreement.
2. Selection: choose for actual needs
4. Be clear about requirements
Prioritise the processes that matter: RCSAs, incidents, KRIs, reporting and relevant resilience or compliance workflows. Evaluate essential functionality, vendor support and future adaptability, not merely an impressive demonstration.
5. Seek independent experience
Speak with practitioners and a range of customers, not only the vendor’s nominated references. Include representative end users in assessment and selection.
6. Run trials and scrutinise the statement of work
Test realistic scenarios with users and representative data. Understand configuration, integration, migration, training, support and change costs before committing.
3. Implementation: manage it as business change
7. Use professional project management
Secure executive sponsorship, adequate specialist resources, clear governance and a dedicated project manager. Treat implementation as a significant change programme, not simply software installation.
8. Start small and demonstrate success
Pilot core functionality with a limited number of engaged teams. Learn, refine and build confidence before wider rollout.
9. Make configuration and migration decisions carefully
Configure around the organisation and its risk framework, including entities, processes, taxonomy and scoring. Cleanse historical data before migration; do not automatically transfer unreliable legacy records.
4. Utilisation: adoption is the real test
10. Protect user acceptance testing
Test thoroughly with actual users, record defects and resolve configuration problems. Compressing testing to meet a launch date creates avoidable operational risk.
11. Train in manageable stages
Train core users early and wider populations progressively, using practical workflows rather than overwhelming people with information they will forget before using it.
12. Limit customisation and plan for maintenance
Excessive customisation can make upgrades costly or impractical. Build super-user capability, reduce key-person dependency and maintain training through platform changes.
What changes in the era of AI-enabled GRC?
JADEtc Academy commentary, October 2026 — not part of the original 2021 publication.
AI-enabled features may assist with drafting risk assessments, categorising incidents, identifying trends, generating management information and searching policies or control libraries. These capabilities can improve efficiency, but they make the original principles more important, not less.
- Validate outputs: test completeness, accuracy, explainability and evidence before relying on AI-generated risk information.
- Govern the data: understand provenance, permissions, confidentiality and whether underlying taxonomy and control records are reliable.
- Retain accountability: establish human review, challenge, correction and audit trails for material decisions.
- Test the supplier and integration: examine AI dependencies, model changes, security, resilience and third-party arrangements.
- Measure actual value: assess whether the system improves risk decisions and control effectiveness rather than merely accelerating documentation.
About the original publication
Original title: Selecting and Implementing a GRC System: Golden Rules and Pitfalls
Authors: Dr Jimi Hinchliffe and Dr Ariane Chapelle
Original publisher: Chapelle Consulting
Original publication: May 2021
This Academy article is an adapted summary, with full acknowledgement of the original joint authorship and publisher. It does not reproduce the original publication’s branding or design. Readers should consult the original paper for the full discussion and examples.
Explore more AI, Technology & GRC Insights · Contact JADEtc Academy