Where do you start a competency framework when there is nothing in place?

This is the question we are asked most often. A company has job titles, a training matrix in a spreadsheet, and no framework underneath either of them. Everyone agrees something is needed. Nobody agrees where to begin. Two approaches come up. The first starts from the job: list the roles, write the competencies each role needs, then work out how to assess them. The second starts from the risk: find the tasks that hurt someone or stop production when they go wrong, and build competencies around those first. The second is faster to justify and covers less. Which did you use, and would you do the same again?