| Buyer | Start with | Decision output |
|---|---|---|
| CRO or executive sponsor | 1–3, 12, 14 | Buy/repair/defer decision, first-release scope and defensible risk reporting. |
| GRC programme lead | 4–7, 10–11 | Migration backlog, implementation assumptions and operating plan. |
| CISO or enterprise architect | 7–8, 15–17 | Integration tests, evidence controls, AI boundaries and portability proof. |
| Head of Compliance | 2, 9, 11, 13 | Accountability model, contributor workflow and obligation-change process. |
| Head of Internal Audit | 3, 8–9, 15 | Evidence quality, independent conclusions and AI review criteria. |
| Procurement and finance | 5, 12, 17 | Comparable scope, three-year USD cost model and exit provisions. |