# Sources

1. **KPMG — Implement GRC Technology the Right Way**, 2024. GRC process preparation, migration, testing and support. `https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2024/implement-grc-technology-right-way.pdf`
2. **NIST SP 1301 — Creating and Using Organisational Profiles**, 26 February 2024. Current/target outcomes and prioritisation. `https://csrc.nist.gov/pubs/sp/1301/final`
3. **The IIA — Statements of Position**, including the Three Lines statement published 8 July 2026. Accountability, coordination and independence safeguards. `https://www.theiia.org/en/resources/statements-of-position`
4. **The IIA — Three Lines Model: Assurance and Advice in Support of Effective Governance**, 2026. Full statement. `https://www.theiia.org/globalassets/site/resources/statements-of-position/tlm_assurance_advice_support_effective_gov_en.pdf`
5. **IBM OpenPages 9.1.x — Supported Migration Items.** Configuration, instance data and relationship migration distinctions. `https://www.ibm.com/docs/en/openpages/9.1.x?topic=environments-supported-migration-items`
6. **NIST — Cybersecurity Framework 2.0**, 26 February 2024. Governance, identity and access-control outcomes. `https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf`
7. **LogicGate — Risk Cloud API Troubleshooting Guide.** Authentication and authorisation failure examples. `https://www.logicgate.ai/developer/api-troubleshooting-guide/`
8. **NIST AI 600-1 — Generative Artificial Intelligence Profile**, July 2024. Evaluation, source verification and limits on capability claims. `https://doi.org/10.6028/NIST.AI.600-1`
9. **NIST SP 1308 — Cybersecurity, Enterprise Risk Management, and Workforce Management Quick-Start Guide**, final 23 March 2026. Risk-informed workforce planning. `https://csrc.nist.gov/pubs/sp/1308/final`
10. **ServiceNow — Certified Implementation Specialist, Risk and Compliance Exam Blueprint**, updated January 2026. Configuration, implementation and maintenance competencies. `https://learning.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0011655`
11. **Microsoft Learn — Use the Go-Live Checklist to Make Sure Your Solution Is Ready.** Dynamics 365 guidance used only for transferable implementation practices. `https://learn.microsoft.com/en-gb/dynamics365/guidance/implementation-guide/prepare-go-live-checklist`
12. **Federal Reserve, FDIC and OCC — Third-Party Risk Management: A Guide for Community Banks**, May 2024. Planning, due diligence, contracting, monitoring and termination. `https://www.occ.gov/news-issuances/news-releases/2024/pub-third-party-risk-management-guide-for-community-banks.pdf`
13. **LogicGate — Risk Cloud API: Getting Started**, page labelled updated 20 January 2023. Published API-access add-on statement; actual offer terms require confirmation. `https://www.logicgate.ai/developer/risk-cloud-api-getting-started/`