# What belongs in an enterprise GRC regulatory-change requirements checklist?

**The following is a recommended buyer specification, not an assertion that every item is legally mandated.** Use it to compare retaining, repairing or replacing the current platform.

| Requirement | Minimum acceptance evidence | Failure to reject |
|---|---|---|
| Authority and version | Original source, provision identifier, publication date, retrieved date and supersession relationship | A framework label without a source or version |
| Legal status | Separate values for applicable, future, proposed, guidance, professional standard, suspended and superseded | A proposal automatically generating mandatory overdue actions |
| Applicability | Entity, activity, data, geography, threshold, exemption rationale and approving owner | One sector-wide applicability switch |
| Date handling | Effective, compliance, coverage-period and submission dates stored separately | One due date used for every milestone |
| Change impact | Before/after comparison linked to affected policies, controls, assessments and open work | A content update overwriting approved mappings |
| Evidence provenance | Source system, collection time, period covered, reviewer and access classification | Successful collection presented as proof of control effectiveness |
| Exceptions | Rationale, approver, conditions, review date and closure evidence | Permanent exceptions without re-evaluation |
| Assurance separation | Distinct management assertions, auditor tests and conclusions | Shared editing that obscures who reached the conclusion |
| Portability | Bulk export of records, relationships, attachments, versions and approval history | A spreadsheet export that loses the audit trail |

### Which scenarios should go into the GRC demonstration script?

Use synthetic data and require the same scenario from every shortlisted supplier:

1. **Changed law:** replace a Colorado requirement while preserving the earlier applicability decision.
2. **Different dates:** configure California’s audit coverage period separately from the report deadline.
3. **Suspended milestone:** pause CMMC Phase II without removing applicable contract obligations.
4. **Restricted evidence:** prevent a general control owner from accessing sensitive healthcare evidence reused by authorised assurance staff.
5. **Failed integration:** show that stale asset or identity evidence triggers review rather than leaving an unexplained green status.
6. **Audit exclusion:** document why one topical requirement does not apply to an engagement.
7. **Exit:** export the entire scenario, including approvals and attachments, into a usable package.

Score what is demonstrated as standard capability, supported configuration, custom development or not demonstrated. Ask the buyer’s intended administrator—not just the supplier’s consultant—to perform one routine change.