# How much should buyers budget for GRC implementation and ownership?

**This research does not validate a universal implementation multiplier.** The supplied assumption of 0.5–2 times first-year subscription cost should remain a scenario input, not a published market benchmark.

A **May 2026 Forrester study commissioned by ServiceNow** modelled approximately **$1.1m in three-year present-value supplier fees** and **$1.1m in implementation, ongoing management and training costs**. The latter is not implementation alone; neither figure is a market median or a supplier quotation. ([tei.forrester.com](https://tei.forrester.com/go/ServiceNow/IRM/))

The study is useful for identifying cost categories. It is not evidence that a particular bank, health plan or public company should spend that amount.

### What does a transparent three-year GRC TCO illustration look like?

**Source for every figure below: desk scenario dated 28 October 2026. These are assumed inputs and arithmetic, not observed prices, savings estimates or supplier quotations.**

| Cost category | Explicit assumption | Three-year amount |
|---|---|---:|
| Software subscription | $150,000 annually × 3 years | **$450,000** |
| External implementation | Assumed fixed project charge | **$150,000** |
| Internal setup work | 800 hours × $75 loaded hourly cost | **$60,000** |
| Continuing administration | 60 hours monthly × 36 months × $75 | **$162,000** |
| Legacy dual-running | Assumed transition expenditure | **$30,000** |
| **Total** | No subscription increases; no separately charged extras | **$852,000** |

Two sensitivities expose different risks:

- **5% annual subscription increases** would raise three-year software expenditure to **$472,875**, adding **$22,875** to the base scenario.
- **An additional 40 administration hours each month**, at the same assumed labour rate, would add **$108,000** over three years.

These are deterministic calculations, not predictions. They illustrate why administrative workload can matter more than a modest subscription discount.

For a real-world labour signal, a **Bankers Trust Company** advertisement posted **3 September 2026** offered **$88,000–$104,500 annual salary** for a Senior Enterprise Risk System Administrator responsible for the bank’s GRC solution. That is one advertised role—not a national salary benchmark, a required staffing ratio or a fully loaded employment cost. ([jobtarget.com](https://www.jobtarget.com/jobs/jt-t6fj4nviy3/sr-enterprise-risk-system-administrator-des-moines-iowa?utm_source=openai))

### What must be included before a quote is commercially comparable?

Use this checklist as the minimum input to a **GRC total cost of ownership calculator**:

- [ ] Applications and use cases included in the first release.
- [ ] Administrators, practitioners, occasional contributors and external-user rights.
- [ ] Production, testing and sandbox environments.
- [ ] Migration record counts, attachments, relationships and historical audit trails.
- [ ] Connectors, API rights, integration engineering and maintenance ownership.
- [ ] Regulatory content, analytics, AI allowances and usage overages.
- [ ] Internal process design, cleansing, testing and training effort.
- [ ] Continuing administration, support and configuration-change capacity.
- [ ] Renewal mechanics, expansion prices and dual-running assumptions.
- [ ] Export testing and separately modelled exit assistance.

**Unknown costs must remain unresolved inputs, not zeroes.** Request a bottom-up statement of work before relying on any implementation-to-subscription ratio.