# 27. What should we do before contacting GRC vendors?

Prepare a decision pack that makes scope, migration uncertainty and operating capacity visible. Our recommended starting point is one complete workflow, one representative dataset and one accountable sponsor—not an enterprise-wide feature wish list.

Use the following as working document specifications; they do not depend on purchasing software or booking a sales call.

| Working artefact | Minimum useful output |
|---|---|
| **Minimum Viable GRC Scope Builder** | First workflow, participants, decisions, exclusions and launch acceptance |
| **GRC Platform Requirements and Weighted Evaluation Scorecard** | Mandatory gates, editable weights and evidence requirements |
| **Spreadsheet-to-GRC Migration Readiness Checklist** | Record inventory, sample defects, history requirements and accountable owners |
| **GRC Demonstration Script and Acceptance Criteria** | Common normal and exception scenarios for all candidates |
| **Three-Year GRC Total Cost of Ownership Calculator** | Comparable USD inputs, internal labour, sensitivities and unresolved costs |
| **After-the-Consultants GRC Operating Plan** | Named ownership, recurring duties, capacity and handover tests |
| **GRC Renewal and Exit Runway Planner** | Notice dates, decision gates, export tests and transition dependencies |

Then ask each vendor to identify:

- What works in the proposed configuration.
- What requires additional licences, services or custom development.
- Which assumptions must be validated before a fixed commitment.
- What the buyer must provide.
- What remains unproven.

**Final approval question:** can the organisation explain how it will migrate, operate, fund and eventually leave this deployment? If not, the evaluation is not yet complete—even if the demonstration was excellent.