GRC Maturity: The Five Stages Explained

Most GRC programmes don't fail from a lack of effort, they fail from not knowing which stage they're actually in and trying to skip ahead. Here's the honest version of the five stages.

Stage 1: Ad hoc

Compliance runs on individual effort and institutional memory. Evidence lives in whoever's inbox handled it last. There's no single view of what controls exist, let alone whether they're working. This is the most common starting point, not a failure, just the default state before anyone's invested in a system.

Stage 2: Documented

Policies exist. Spreadsheets track controls and owners. The problem is that documentation and reality drift apart within weeks, because nothing forces the spreadsheet to reflect what's actually happening. Programmes get stuck here longer than any other stage, because it feels like progress.

Stage 3: Managed

Control ownership is clear. Evidence is requested and collected on a cadence, even if manually. Gaps get tracked to closure instead of disappearing into a backlog. Reporting to leadership happens, even if it's assembled by hand each time. This is where most audit-ready companies sit going into their first certification.

Stage 4: Automated

Evidence collection integrates with the systems that generate it, instead of relying on someone remembering to export a report. Control health is visible in near-real time. Multiple frameworks share one control set instead of running as parallel, duplicated programmes. Human review still gates every decision, automation removes the manual collection burden, not the judgment.

Stage 5: Continuous assurance

The programme operates as infrastructure. Control health, risk, remediation, and audit readiness are always current, not refreshed before a deadline. An audit is a formality that confirms what the team already knew, not a discovery process. Very few organizations operate here consistently, and it's less about tooling than about compliance being treated as an ongoing operating discipline rather than a project with a finish line.

Where most companies actually are

If you're reading this because a customer or auditor just asked a question you couldn't answer confidently, you're probably between stage 1 and 2. That's normal, and the jump from documented to managed, giving control owners real ownership and building an evidence cadence, is usually the highest-leverage move available, well before automation is worth investing in.

← Back to Resources