Who must be involved, and who should you contact?

Name the future operating team before shortlisting. Separate ownership of business decisions from platform administration and independent assurance.

The IIA’s refreshed Three Lines Model distinguishes management’s responsibility for operating processes and controls, second-line support and challenge, and internal audit’s independent assurance role. Its updated statements were published on 8 July 2026. A shared platform should preserve those distinctions rather than erase them. (theiia.org)

What responsibilities should the buyer assign?

The following is a proposed responsibility map, not a mandatory organisational structure.

Do not make internal audit the default owner of management’s risk decisions simply because audit initiated the purchase. Agree any advisory role and safeguards explicitly. (theiia.org)

Which supplier-side people should you request?

Ask the account executive to bring the people responsible for delivery and operation—not only the demonstrator:

• A solution architect who can explain the proposed object model and access design.
• The proposed delivery lead, including subcontracting arrangements.
• A migration specialist who can address attachments, history and reconciliation.
• An integration engineer who can demonstrate failure handling.
• A commercial specialist authorised to clarify licence categories and expansion terms.
• A support or customer-success representative who can explain the post-launch boundary.
• Customer references with a comparable first workflow and operating model.

For references, request a conversation with an administrator or programme owner, not only the executive sponsor. Ask what they maintain themselves, what still requires services, and which original assumptions changed.

How much internal capacity should you reserve?

Build a task-based estimate. Do not infer staffing from employee count alone.

As a reality check, a First Horizon Senior GRC Administrator posting dated 9 April 2026 describes responsibilities spanning configuration governance, data integrity, release control, integration validation and production stability. That is evidence of the breadth of one advertised role—not proof that every buyer needs the same headcount. (recruiting.ultipro.com)

The cost illustration later in this guide uses this synthetic 2,800-hour selection and delivery allocation:

Replace every allocation with named people, available hours and a manager-approved commitment. If those commitments cannot be secured, reduce scope or change the delivery model before signing.