# 9. How long does enterprise GRC implementation take, and what should the project plan include?

The reviewed evidence does not establish a reliable universal implementation duration. Ask for a dependency-based plan with explicit assumptions: KPMG’s guidance addresses readiness, business-process fit, data migration, testing and post-production support rather than presenting implementation as configuration alone. [Implementation guidance](https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2024/implement-grc-technology-right-way.pdf). ([kpmg.com](https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2024/implement-grc-technology-right-way.pdf))

Below is an **illustrative 20-week planning exercise**, not a delivery benchmark. It assumes one agreed workflow, a bounded migration population, two defined integrations and available buyer decision-makers; it excludes procurement and security-review lead time.

| Illustrative period | Work package | Gate before proceeding |
|---|---|---|
| Weeks 1–3 | Scope, ownership, data profiling and design decisions | Sponsor accepts first-release scope |
| Weeks 4–6 | Data model, access model and migration mapping | Process and data owners approve design |
| Weeks 7–12 | Configuration, integrations and trial loads | End-to-end scenarios work in test |
| Weeks 13–16 | Reconciliation, permission tests and user acceptance | Material defects resolved or formally accepted |
| Weeks 17–20 | Training, cutover rehearsal, launch and stabilisation | Operational owners accept service handover |

Replace these periods with estimates from your actual work packages. Ask which activities can run in parallel and which wait for buyer decisions, supplier access or third-party systems.

Define go-live as an operating milestone: owners can complete work, failures are detected, reports reconcile and support responsibilities are accepted. A populated production database is not the acceptance criterion proposed here.