# What should happen before the next shortlist decision?

Ask each supplier for the same four artefacts:

1. A first-release workflow and explicit exclusions.
2. A field-level migration and historical-retention schedule.
3. A costed operating-responsibility matrix.
4. An acceptance pack covering failed integrations, restricted evidence, disputed scores and complete export.

**Reply prompt:** What does your current migration proposal exclude that your audit or compliance team still needs to retrieve?

*Research limitation: no supplier in this digest has passed a desk-run production evaluation. Public terms and announcements should guide due diligence, not substitute for it.*

---

# Draft 3 — Quarterly outlook

**Subject:** Q1 2027 GRC outlook: fund the operating model before expanding autonomy

**Preheader:** A scenario-based plan for platform selection, renewal and implementation in January–March.

**Prepared:** 28 October 2026 | **Outlook period:** 1 January–31 March 2027