# 23. Should we renew, repair or replace our existing GRC platform?

Compare all three options against the same first-workflow requirements and transition costs. KPMG’s guidance includes fit-gap assessment and optimisation of existing GRC technology, supporting evaluation of improvement rather than assuming replacement is the only route. [Implementation and optimisation guidance](https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2024/implement-grc-technology-right-way.pdf). ([kpmg.com](https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2024/implement-grc-technology-right-way.pdf))

Our recommended diagnosis separates four questions:

| Diagnosis | Evidence to seek |
|---|---|
| Process problem | Owners, approval rules or risk methodology remain disputed |
| Configuration problem | The purchased capability exists, but the implemented workflow is unsuitable |
| Capacity problem | Changes and support requests wait because nobody is funded to handle them |
| Product or commercial problem | A mandatory requirement cannot be met acceptably, or the ownership model is unacceptable |

Price a bounded repair alongside replacement. Include data remediation, configuration cleanup, training and a funded operating owner in the repair option; include migration, dual-running, retraining and retained archives in replacement.

Work backwards from the **contractual notice deadline**, not just the renewal date. Add procurement, security review, migration rehearsal, approvals and contingency. If the available runway is insufficient, evaluate a negotiated extension without presenting it as a substitute for fixing the underlying problem.

Before approving replacement, require a concrete answer to: **“Which current failure will the new platform solve, and why will we not reproduce it?”**