# Gate 4: Do the commercial terms buy the outcome we tested?

**Compare a common three-year operating scenario in USD, then align the contract and implementation statement of work with the evidence.** Keep supplier cash expenditure and internal staff capacity visible separately.

### What belongs in the GRC total cost of ownership model?

| Cost category | Questions to resolve |
|---|---|
| Software | Which modules, entities, administrator roles and occasional contributors are included? What changes the licence cost? |
| Integrations and AI | Are connectors, API consumption, transactions, AI usage and supporting products included? |
| Delivery | Who owns process design, cleansing, mapping, configuration, migration, testing and training? |
| Internal effort | How much time must process owners, security, architecture, procurement, testers and administrators contribute? |
| Continuing operation | What is required for administration, content updates, integration maintenance, support, releases and regression testing? |
| Transition and retained tools | What remains licensed during migration or afterwards? What does a searchable historical archive cost? |
| Commercial changes | How do renewal increases, expansion, minimum commitments and additional environments affect each year? |

One concrete reason to inspect integration entitlements: ServiceNow’s September 2026 documentation distinguishes entitlement to use spokes from transaction consumption and states that additional subscriptions or fees may be required. Do not translate a connector’s availability into an assumption of unlimited included use. ([servicenow.com](https://www.servicenow.com/docs/r/integrate-applications/integration-hub/subscription-usage.html))

Use this model:

**Three-year ownership cost = implementation and transition + software and usage + internal delivery effort + ongoing operation + retained systems.**

Calculate it over the same start date and scope for every option. Show low, base and high cases using explicit assumptions. **Unknown costs stay unresolved, not zero.** Put exit expenditure in a separate scenario unless exit is actually planned within the comparison period.

### What should the pre-signature checklist contain?

- [ ] Reconcile the quote with tested modules, roles, environments and integrations.
- [ ] Identify every buyer dependency, supplier assumption and exclusion in the delivery scope.
- [ ] Agree measurable acceptance criteria, defect treatment and change-control procedures.
- [ ] Name accountable delivery resources and confirm their availability.
- [ ] Define security responsibilities, subcontractor access, support escalation and incident handling with the relevant specialists.
- [ ] Specify export formats, access windows, transition assistance, fees, data return and deletion arrangements.
- [ ] Check ownership and access to configuration documentation, migration scripts and custom components.
- [ ] Have procurement and counsel reconcile the order form, subscription terms, implementation agreement and applicable data agreements.

### What if renewal is driving the deadline?

Create separate dates for notice, renewal, data-access expiry, decision approval and target cutover. Work backwards using the actual dependency schedule and contingency, rather than a generic implementation-duration estimate.

For banks, the interagency guide specifically identifies contract terms, termination costs, transition resources and data retention or destruction as matters to assess when ending a relationship. ([occ.gov](https://www.occ.gov/news-issuances/news-releases/2024/pub-third-party-risk-management-guide-for-community-banks.pdf))

If the transition is not feasible before expiry, evaluate a limited extension or other continuity arrangement. Do not terminate the incumbent merely because the replacement subscription has been signed.

**Output:** approved TCO workbook, contractual clarification log and deliverable-based implementation scope.

**Proceed when:** finance, procurement, the sponsor and delivery owners understand both the priced work and the unresolved exposure.

**Hold when:** the business case requires retiring tools that have not passed replacement tests, or assumes unbudgeted internal capacity.