# How can buyers test whether a candidate or implementation team can do the work?

**Use work samples matched to the responsibility, rather than relying on a broad GRC title.** These are proposed evaluation exercises using synthetic or redacted material.

| Role | Practical exercise | What a convincing response should show |
|---|---|---|
| **GRC platform owner** | Prioritise a backlog containing an access defect, new regulatory mapping, overdue integration fix and dashboard request | Clear trade-offs, decision rights and release acceptance criteria |
| **Business analyst** | Convert a disputed-risk-score scenario into requirements | Actors, state changes, evidence, permissions, exceptions and testable outcomes |
| **Administrator / configurator** | Change an approval route without exposing restricted evidence | Supported configuration, impact analysis, test steps and rollback plan |
| **Integration engineer** | Diagnose duplicate or missing evidence after a failed synchronisation | Reconciliation, failure handling, monitoring and an accountable support route |
| **Controls / audit specialist** | Explain when an existing evidence item can be reused | Scope, period, provenance, access and review requirements |
| **AI evaluation owner** | Assess plausible but unsupported control mappings | Reference answers, error categories, escalation and repeatable regression tests |

EY’s advertised implementation-manager role asks for ServiceNow certifications, implementation experience and integration capability. That supports checking credentials where relevant—but our recommendation is to require demonstrated delivery judgement as well as certification. ([careers.ey.com](https://careers.ey.com/ey/job/New-York-Risk-Consulting-Risk-Technology-GRCIRM-Platforms-Manager-NY-10001-8604/1407621533/?utm_source=openai))