# What should the enterprise GRC requirements scorecard contain?

**Use non-negotiable gates first, weighted scoring second.** A high feature score should not offset a failed mandatory security, residency or access requirement.

### Which gates should precede scoring?

Require the selection team to approve:

- Security, residency, retention and access arrangements for the proposed deployment.
- A first critical workflow that works in the proposed, commercially available configuration.
- Permissions and separation of responsibilities appropriate to the programme.
- A feasible migration and historical-record access plan.
- A demonstrated export and transition approach.
- Named implementation and operating owners.
- AI controls, where AI functionality is in scope.

### How should weights vary by buyer?

These are **proposed starting weights**, not empirically validated benchmarks. Each column totals 100%.

| Evaluation criterion | CRO-led bank | SOX/internal-audit-led | CISO-led programme |
|---|---:|---:|---:|
| Risk model, hierarchy and reporting | 20% | 10% | 10% |
| Specialist controls and assurance workflow | 15% | 25% | 15% |
| Evidence and integration behaviour | 10% | 15% | 25% |
| Migration, history and exit | 15% | 10% | 10% |
| Contributor usability and administration | 15% | 15% | 15% |
| Security and AI assurance beyond mandatory gates | 10% | 10% | 10% |
| Three-year cost and delivery confidence | 15% | 15% | 15% |

Score observed performance from 0–5 against agreed anchors. Keep **not demonstrated** separate from **cannot meet**. Do not present a final numerical ranking while material weighted criteria remain untested.

For each score, retain:

`requirement → business owner → scenario → observed result → configuration dependency → implementation cost → acceptance owner`

### Which demonstration scenarios expose meaningful differences?

| Scenario | What a useful pass should demonstrate |
|---|---|
| **Overdue remediation** | Correct ownership, escalation, revised due dates and visible history |
| **Disputed risk score** | Original assessment, challenge, rationale and authorised approval remain traceable |
| **Shared control failure** | Appropriate impact on each linked risk or obligation without indiscriminate propagation |
| **Failed integration** | Failure detection, stale-data visibility, reconciliation and recovery |
| **Restricted evidence** | Unauthorised users cannot retrieve the item through search, reporting, AI or export |
| **Administrator change** | Buyer staff can make and test a supported change using the agreed release process |
| **Bulk export** | Records, relationships and required evidence can be reconstructed outside the platform |
| **AI uncertainty** | Missing evidence is acknowledged rather than converted into a confident conclusion |