Sources

The sources below support factual statements. The proposed plans, templates and financial scenario are this desk’s analytical work. Supplier documentation should be reconfirmed against the edition, deployment and contract being purchased.

Implementation and operating model

1. KPMG — Implement GRC technology the right way: https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2024/implement-grc-technology-right-way.pdf
2. KPMG — Pathway to technology alignment: https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2024/pathway-technology-alignment.pdf
3. The IIA — 2026 Statements of Position and publication dates: https://www.theiia.org/en/resources/statements-of-position
4. The IIA — Three Lines Model: Assurance and Advice in Support of Effective Governance: https://www.theiia.org/globalassets/site/resources/statements-of-position/tlm_assurance_advice_support_effective_gov_en.pdf
5. The IIA — podcast and transcript on the refreshed model: https://www.theiia.org/en/content/podcast/getting-started-with/2026/ep-0040/
6. First Horizon — Senior GRC Administrator posting, 9 April 2026; indexed posting used as role evidence, not a staffing benchmark: https://recruiting.ultipro.com/FIR1007FTN/JobBoard/c005ef3e-175a-49c4-ba29-9f431f673944/OpportunityDetail?opportunityId=3d3259bf-0bb5-474b-8eb4-639fe8f63a6b
7. LogicGate — implementation packages and services scope: https://www.logicgate.ai/services-description/
8. ServiceNow — Risk and Compliance implementation-specialist blueprint: https://learning.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0011655
9. ServiceNow — Risk Speed Learning and linked video tutorials: https://www.servicenow.com/community/grc-articles/risk-speed-learning-hands-on-how-to-video-tutorials-to-configure/ta-p/3462795
10. Learning Tree — ServiceNow GRC/IRM implementation training and published price: https://www.learningtree.com/courses/servicenow-grc-irm-implementation-training/

US regulatory and framework references

11. NIST — CSF 2.0 Organisational Profiles and template: https://www.nist.gov/cyberframework/profiles
12. OCC — Third-Party Relationships: A Guide for Community Banks, 3 May 2024: https://www.occ.gov/news-issuances/bulletins/2024/bulletin-2024-11.html
13. OCC/Federal Register — 2023 Interagency Guidance on Third-Party Relationships: https://www.occ.gov/news-issuances/federal-register/2023/88fr37920.pdf
14. FTC — Safeguards Rule business guidance: https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
15. HHS — HIPAA and cloud computing guidance: https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html
16. HHS — Summary of the HIPAA Security Rule: https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
17. SEC — Staff Statement on Management’s Report on Internal Control Over Financial Reporting: https://www.sec.gov/info/accountants/stafficreporting.htm
18. NYDFS — Cybersecurity Resource Center: https://www.dfs.ny.gov/cybersecurity
19. NYDFS — implementation timeline for covered entities: https://www.dfs.ny.gov/industry_guidance/cybersecurity/implementation_timeline_covered_entities
20. NIST — Generative AI Profile, NIST AI 600-1: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf

Product, pricing, procurement and migration evidence

21. IBM — OpenPages pricing and deployment caveats: https://www.ibm.com/products/openpages/pricing
22. IBM — OpenPages 9.1 FastMap overview; indexed documentation used where direct retrieval was restricted: https://www.ibm.com/docs/en/openpages/9.1.x?topic=fastmap-overview
23. IBM — OpenPages 9.1 Data Export and permission warning; indexed documentation used where direct retrieval was restricted: https://www.ibm.com/docs/en/openpages/9.1.x?topic=ci-exporting-openpages-data-be-used-by-other-applications
24. ServiceNow — Australia release common controls in Risk Management: https://www.servicenow.com/docs/r/governance-risk-compliance/grc-risk-management-workspace/shared-common-controls-in-risk-management.html
25. Archer — IT Security Risk Management Integration Guide: https://help.archerirm.cloud/archersolutions/en-us/Content/ArcherSolutions/itsrm_integration_guide.htm
26. Workiva — 2026 Files API export options: https://developers.workiva.com/2026-01-01/files.html
27. LogicGate — published pricing structure: https://www.logicgate.ai/platform/pricing/
28. Optro — AuditBoard rebrand announcement, 9 March 2026: https://optro.ai/blog/meet-optro-auditboard-unveils-new-identity-as-ai-transforms-grc
29. EPB — public procurement listing, including 2026 Audit, Risk and Compliance Solution/GRC requirement: https://business.epb.com/competitive-sealed-bids-request-for-proposals/
30. Accenture — joint ServiceNow migration and managed-services announcement, 29 June 2026: https://newsroom.accenture.com/news/2026/servicenow-and-accenture-launch-ai-powered-services-to-accelerate-the-shift-from-legacy-risk-platforms-to-agentic-ai