# 1. What is an enterprise GRC platform, and do we need one rather than specialist compliance software?

An enterprise GRC platform connects risk, compliance and assurance work across functions; a specialist application may be sufficient when the requirement is narrower. IBM describes OpenPages as a modular platform spanning risk, compliance and audit, while ServiceNow positions IRM across IT, cyber and business operations. Those descriptions establish intended scope, not equivalent capability or suitability for your organisation. [IBM OpenPages](https://www.ibm.com/products/openpages) · [ServiceNow IRM](https://www.servicenow.com/products/integrated-risk-management.html). ([ibm.com](https://www.ibm.com/products/openpages))

**Our recommendation: choose the operating model before the product category.** Ask whether the organisation needs to share merely evidence files, or also ownership, risk assessments, control definitions, exceptions and reporting decisions.

| Your first requirement | Evaluation starting point |
|---|---|
| Collect security evidence against defined requirements | Test an evidence-led workflow before buying enterprise breadth |
| Manage SOX testing and financial-control deficiencies | Start with controls, testing and assurance workflows |
| Aggregate operational risks across business units | Start with entity structure, risk methodology and reporting |
| Manage supplier relationships throughout their lifecycle | Start with third-party inventory, due diligence, monitoring and exit |
| Coordinate several of these activities | Test a shared data model alongside specialist functional depth |

Keep three options open: one enterprise platform, connected specialist systems, or improvement of the existing estate. In a connected architecture, explicitly nominate the authoritative system for each object: supplier, control, finding, ticket and evidence file.

**Decision test:** if the team cannot explain which records should be shared and which decisions must remain separate, pause the shortlist and resolve those questions first.