# What market does this report actually cover?

For this research desk, the core purchase is a platform supporting connected risk, control, compliance, evidence, audit or remediation workflows at a regulated US organisation. The intended readers principally work in organisations with approximately **500–10,000+ employees**; this is an editorial targeting definition, not a measured market boundary.

The report distinguishes three purchasing categories:

| Category | Treatment in this report | Procurement question |
|---|---|---|
| Enterprise GRC, integrated risk, audit and controls software | Core platform market | Can the system support the first workflow and the intended operating model? |
| Security compliance, trust management, regulatory intelligence and specialist third-party risk | Relevant adjacent markets | Is this a substitute, an additional component or a source of overlapping expenditure? |
| Implementation, migration, integration and managed operations | Separate ownership-cost category | Who will deliver, maintain and eventually transfer the configuration and data? |

This scope deliberately avoids treating every product described as “GRC” as an equivalent substitute. It also avoids adding overlapping modules together to manufacture a larger addressable market.

**Evidence labels used throughout:**

- **Publisher estimate:** a market research company’s model, including historical estimates.
- **Company-reported:** a supplier or investor disclosure, not an independent capability assessment.
- **Observed pricing panel:** a procurement intermediary’s published sample, not the whole market.
- **Listed price:** an advertised component or package price, not a negotiated deployment quotation.
- **Desk calculation or illustration:** arithmetic with its inputs and assumptions exposed.
- **Undisclosed:** not stated in the announcement reviewed; it does not mean zero.