Assign the responsibilities before deciding how many people to hire. The following is a proposed operating model for selection and implementation planning, not an observed industry staffing ratio.
| Stage | Responsibility that needs an owner | Deliverable to require |
|---|---|---|
| Before shortlist | Business-process and risk ownership | Agreed first workflow, decision rights, taxonomy and acceptance objectives |
| Before contract | Platform ownership and architecture | Operating model, access design, integration ownership and three-year resource plan |
| Before migration | Data stewardship and business analysis | Source inventory, mappings, exception backlog and reconciliation criteria |
| Before go-live | Configuration, testing and adoption | Tested workflows, user guidance, support routes and accepted migration results |
| After go-live | Administration and engineering support | Release calendar, monitored integrations, backlog and recovery procedures |
| Throughout | Independent review and accountable risk decisions | Appropriate separation between operation, approval and assurance |
For buyers asking how to move from spreadsheets to GRC software, the first staffing decision should be who can resolve ambiguous records and ownership—not simply who can import a file.
For buyers asking how much GRC implementation costs, insist that the statement of work identifies what the customer must provide. A migration price is not a complete resource plan if cleansing, reconciliation, testing and business approvals remain unallocated.
For buyers comparing ServiceNow IRM, Archer and IBM OpenPages, use the same role-based test: can the proposed internal team operate the configured workflows and integrations? This research does not establish that one platform requires fewer staff than another.