# 3. What are the weighted enterprise GRC evaluation criteria?

**Use these weights as the default for a phased enterprise deployment.** The anchors describe the proposed solution and operating plan, not a supplier’s reputation.

The table supplies **1, 3 and 5 anchors** for every criterion. The following section explains zero scores, intermediate scores and evidence caps.

| ID and criterion | Weight | 1 — Weak | 3 — Acceptable for the agreed scope | 5 — Strong |
|---|---:|---|---|---|
| **C1. Operating-model and workflow fit** | **15%** | Generic registers; ownership and approval decisions remain outside the system | Named owners, approvals, exceptions and essential risk/control/action relationships work | Buyer reproduces end-to-end workflows, disputed decisions and entity-level roll-ups without unapproved workarounds |
| **C2. Specialist depth and assurance separation** | **8%** | A general workflow is presented as a substitute for essential audit, controls, IT-risk or third-party-risk work | The chosen specialist use case works, including required reviewer and management separation | Specialist users complete realistic testing, challenge, review and closure scenarios with defensible evidence |
| **C3. Migration, history and data quality** | **12%** | “Upload a CSV” with no field, relationship or historical-retention design | Approved mapping, cleansing ownership and representative reconciliation; history/archive treatment is explicit | Repeatable migration rehearsal reconciles records, attachments, relationships and retained provenance, with rollback and exception handling |
| **C4. Implementation plan and delivery capacity** | **12%** | Generic schedule, unnamed team and unspecified buyer effort | Named delivery roles, resource assumptions, dependencies, acceptance milestones and change control | Delivery commitments and buyer capacity are corroborated; critical dependencies and cutover are rehearsed; comparable references are checked |
| **C5. Integrations and evidence reliability** | **10%** | Connector logos or one successful data transfer | Required objects, directions, identity, mappings and error ownership are demonstrated | Buyer verifies failure detection, retry, duplicate prevention, reconciliation and recovery at representative load |
| **C6. Security, privacy and resilience** | **10%** | Badge-led assurance; unclear access, recovery or processing arrangements | Approved architecture and supplier review; scoped access tests and recovery evidence meet buyer requirements | Permission boundaries, privileged actions and recovery arrangements withstand buyer-defined adverse scenarios; residual risks are explicit |
| **C7. Business-user adoption** | **8%** | Specialists navigate everything; contributors need continual assistance | Representative occasional users complete assigned tasks within buyer-set limits | Unassisted users handle reassignment, rejection and escalation; measured friction and support needs fit the operating plan |
| **C8. Administration and changeability** | **5%** | Routine changes depend on external specialists without a costed service model | Buyer administrators make agreed routine changes using documentation and controlled environments | Administrators repeat changes, regression checks, deployment and rollback; support and upgrade responsibilities are clear |
| **C9. Reporting and decision traceability** | **5%** | Attractive dashboards with unclear definitions or off-system reconciliation | Required reports reconcile to underlying records, owners and evidence | Buyer reproduces historical reporting, exclusions and calculation logic and traces decisions without unexplained manual adjustments |
| **C10. Three-year TCO and commercial terms** | **10%** | Subscription-only comparison, unpriced dependencies or unclear expansion costs | Comparable USD cost model fits the approved ceiling; material inclusions, assumptions and terms are agreed | Base cost fits the preferred budget, downside exposure is acceptable, and growth, renewal and change-cost mechanisms are defined |
| **C11. Exit and supplier continuity** | **3%** | “Your data is yours” without usable extraction or transition arrangements | Representative export is usable; retention, assistance, access and charges are agreed | Buyer reconstructs selected records outside the platform; transition and disruption contingencies have owners, resources and tested steps |
| **C12. AI feature assurance, if in scope** | **2%** | Fluent output without traceable evidence, permission testing or accountable approval | Approved use cases have source checks, permission controls, human review and disablement | Buyer-held-out tests demonstrate acceptable quality and review effort, including conflicting evidence and adversarial-document cases |
| **Total** | **100%** | | | |

### Who should own each score?

Assign one accountable evaluator per criterion, supported by the relevant specialists:

- **C1:** CRO or first-workflow process owner.
- **C2:** audit, compliance, security or third-party-risk leader for the selected specialist use case.
- **C3–C4:** programme lead, supported by data owners and delivery assurance.
- **C5–C6:** enterprise architect and CISO respectively.
- **C7:** business-user representative, not only the implementation team.
- **C8:** the person expected to administer the production platform.
- **C9:** reporting owner, with audit challenge where appropriate.
- **C10:** finance and procurement.
- **C11:** procurement, records management and architecture.
- **C12:** AI-risk owner with the intended business users.

Record disagreements. Do not average away a security or assurance objection by counting more favourable votes from other functions.