Is GRC scalable to midsized and smaller institutions?

That's a question we usually answer with a clear yes. Stumbling across a blog post on that topic by David Scheier (see here) I wondered what our community thinks about this? Do you agree with Davids notion that GRC is a concept rather than a solution that's beneficial for any institution regardless of size? Or do you feel it is only working for really big companies?

I'd appreciate to get your votes and thoughts on this!

So again: Is GRC scalable to midsized and smaller institutions?