# Domain 5: Can you afford the commitment and preserve your options?

The US banking agencies’ community-bank guide covers planning, supplier selection, contracts, monitoring and termination. It is voluntary supervisory guidance for its stated audience, not a universal GRC purchasing law or a compliance safe harbour. Its lifecycle approach informs the following buyer questions. ([occ.gov](https://www.occ.gov/news-issuances/news-releases/2024/pub-third-party-risk-management-guide-for-community-banks.pdf))

### 13. Is there a credible three-year ownership model and funding route?

- **A — 0:** We do not have a cost model or identified funding owner.
- **B — 1:** The budget covers headline software pricing only.
- **C — 2:** A USD model includes software, implementation, migration, integrations, internal delivery work, ongoing administration, training, support and overlap with retained systems; unknowns are visible and an approval route is named.
- **D — 3:** Finance has reviewed scope and volume assumptions, downside scenarios and the affordability ceiling; discovery and evaluation funding are authorised, with a defined route for the final commitment.

**Evidence to retain:** a three-year GRC total cost of ownership worksheet, assumption register and funding decision.

**Mandatory gate:** score at least 2. A supplier estimate is an input, not approval of the complete business case.

### 14. Have procurement and legal defined the commercial questions?

- **A — 0:** We plan to review terms after choosing the preferred supplier.
- **B — 1:** Procurement is involved, but quote comparison focuses on subscription price.
- **C — 2:** The comparison schedule covers user categories, modules, entities, environments, APIs, connectors, content, support, implementation deliverables, acceptance, renewal and change requests.
- **D — 3:** Procurement and legal have approved negotiation positions, evidence requests and escalation routes; the team knows who owns unresolved technical, commercial and contractual assumptions.

**Evidence to retain:** commercial clarification schedule, draft statement-of-work requirements and approval matrix.

**Concrete reason to check:** LogicGate’s published API getting-started page states that API access requires an add-on purchase. Confirm the terms of the actual offer rather than generalising that documentation into a market-wide pricing rule. ([logicgate.ai](https://www.logicgate.ai/developer/risk-cloud-api-getting-started/))

### 15. Have you checked renewal, portability and exit before committing?

- **A — 0:** Renewal dates, source-data access or future export requirements are unknown.
- **B — 1:** Key dates are known, but export completeness and transition effort are untested.
- **C — 2:** The plan records notice dates, source access, required export contents, archive needs, transition responsibilities and the future supplier’s proposed exit obligations.
- **D — 3:** A representative current-source export or archive retrieval has been checked for records, attachments, relationships and history; future supplier portability tests and an exit-cost scenario are ready for evaluation.

**Evidence to retain:** renewal/notice calendar, export manifest, test results and exit assumptions.

**First-time buyer?** Test extraction from your current spreadsheets and repositories, and define the new platform’s future export requirements. You do not need an incumbent software contract to score well.

---