Creating Your Company's GRC Taxonomy (or Everyone's GRC Configuration Challenge)

I have questions related to defining the best configuration for Profiles types, etc.  I believe I understand the basic concepts (create Profile types, define Profile filters, associate Policy statements, controls generate, etc. )

What is challenging is the up front work on defining the configuration to implement for this framework. It seems like there are common threads everywhere on this topic but I have not seen where anyone has actually shared their defined approach.   As I am sure everyone else hopes, whatever we lay out for our company we want it to be a solid approach. 

Does it make sense to set up Profile types around Locations and Departments when these can (and do) change (often - usually as a result of a reorg of some kind)?   Does it make more sense to map Profile types around requirement groupings (provisioning, scanning, vendor mgt, etc)?  While controls in these areas may come and go, they stay rather static?  It is entirely possible I am not understanding the concepts very well.

I was a little surprised there is not more in this community about this important configuration work up front, before even starting setting up profiles. Everyone is creating a very similar wheel!  I have seen comments that this why there are consultants and I would sure welcome a good one!  However, since I lack one, my ask is simply:  How did you approach defining your framework?  I would love to hear from those of you who have used the GRC application for awhile now and could benefit from knowing what you did right and what you might do differently.  Thanks in advance for your valuable input!