Build an obligations register that changes the work
Connect each applicable requirement to a responsible owner, a practical control and evidence that it operates.
Read guideGRC in context
Business owners & SMEs
Build proportionate controls around the work you actually do.
Begin with your actual activities.
Begin with your legal entities, business model, customers, people, suppliers and important services. Identify applicable duties before choosing frameworks. A small team still needs clear ownership; the same person may hold several roles, with conflicts and review responsibilities recorded.
Scope of this starter pack
A proportionate starting route for business owners and SMEs. Duties depend on legal form, activities, sector and jurisdiction; listed-company and public-sector frameworks are not universal SME requirements.
Your priorities
- Identify the activities and obligations that matter to this business, with a named decision-maker.
- Address the risks most likely to interrupt delivery, payment or access to essential information.
- Turn one recurring weakness into an owned action with evidence needed for closure.
Questions to start with
- Which service or commitment would be hardest to maintain if one person or supplier became unavailable?
- Which important requirement has no clearly accountable owner?
- What evidence shows that your most relied-on control worked in a recent case?
- Which exception or overdue action needs a decision rather than another extension?
Bring to the first review
- A short activity and applicability map with uncertainty visible.
- The most consequential risk records and their current control evidence.
- One policy or approval procedure checked against a recent example.
- A current action list showing decisions needed and evidence required for closure.
Make the first meeting useful
- Map the legal entities, services, key people and critical suppliers on one page.
- Follow one important obligation and one major risk through to their actual operating evidence.
- Choose the next actions, owners and completion evidence, recording any unanswered scope question.
Relevant resources
Follow the evidence into the work.
Build a risk register that supports decisions
Connect each risk to an objective, accountable owner, control evidence and a decision that someone can act on.
Read guideGive every policy an owner and a review path
Turn a folder of policies into a manageable register of decisions, responsibilities, training and evidence.
Read guidePractise disruption before it becomes a crisis
Use a focused scenario to test decisions, dependencies and recovery assumptions, then track the lessons to completion.
Read guideLeave the review with a useful record.
Identify the owner, the evidence you have, the gaps and the next decision. Keep the applicable source and scope beside any conclusion.