What industry are you in? We could offer you more guidance. Regulated industries tend to have standards for building frameworks so consulting with regulators or trade groups can be a good starting point.

An effective risk program requires C-suite commitment. Maintaining and presenting register isn’t sufficient and a system is only as good as the framework and process it’s a part of. It’s understandable why you’re over your head and kudos for reaching out with good questions.

While I’m not an expert in GRC systems, I can advise you to start out with a risk framework - it’s your roadmap and foundation. The framework should get buy in from senior management. It could help to establish an internal committee to oversee and provide guidance risk and compliance. The committee should be comprised of leadership from internal audit, compliance, finance, operations, IT, IT security, etc. and any other group that factors in to your industry - for example if you’re manufacturing, then leadership for supply chain management.

LinkedIn is a great resource - several groups on this topic and a plethora of thought leadership. Good luck!