# How should you evaluate an enterprise GRC platform?

**Evaluate the proposed operating solution—not the software catalogue.** Use mandatory gates to exclude unacceptable risks, then score twelve weighted criteria covering workflow fit, migration, implementation, integrations, security, adoption, administration, reporting, ownership cost and exit.

This scorecard gives **60 of its 100 points** to migration, delivery, integrations, adoption, administration, three-year cost and exit. That allocation is deliberate: the desk’s recommendation is to prioritise what the organisation can implement and operate over optional breadth.

The unit being evaluated is:

> **Specified software edition and deployment + implementation partner + first-release scope + buyer resources + commercial terms.**

A different partner, implementation scope or hosting arrangement is a different proposal and should receive a separate assessment.

The lifecycle approach has a regulatory foundation. US banking agencies’ third-party guidance covers planning, selection, contracting, ongoing monitoring and termination—not selection alone. It also makes clear that using a third party does not remove a banking organisation’s responsibility for its activities. ([federalreserve.gov](https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm?trk=public_post_comment-text&utm_source=openai))

**Methodology notice:** The weights, scoring anchors, evidence caps, test scenarios and decision thresholds below are this desk’s proposed evaluation method. They are not regulatory requirements, industry benchmarks or statistically validated predictors of implementation success. No supplier has been tested or ranked in this document.

### What should the final decision pack contain?

Produce five outputs rather than a single league table:

1. **Mandatory-gate register:** pass, hold or fail, with accountable sign-off.
2. **Evidence-adjusted score:** a weighted result out of 100.
3. **Evidence coverage:** how much of the evaluation has adequate supporting proof.
4. **Three-year ownership model:** comparable USD costs, assumptions and unresolved exposures.
5. **Contract and implementation conditions:** what must be resolved, delivered or retested.

A high score must never compensate for a failed permission boundary, an unaffordable commitment or an essential workflow that does not work.