For this research desk, the core purchase is a platform supporting connected risk, control, compliance, evidence, audit or remediation workflows at a regulated US organisation. The intended readers principally work in organisations with approximately 500–10,000+ employees; this is an editorial targeting definition, not a measured market boundary.
The report distinguishes three purchasing categories:
| Category | Treatment in this report | Procurement question |
|---|---|---|
| Enterprise GRC, integrated risk, audit and controls software | Core platform market | Can the system support the first workflow and the intended operating model? |
| Security compliance, trust management, regulatory intelligence and specialist third-party risk | Relevant adjacent markets | Is this a substitute, an additional component or a source of overlapping expenditure? |
| Implementation, migration, integration and managed operations | Separate ownership-cost category | Who will deliver, maintain and eventually transfer the configuration and data? |
This scope deliberately avoids treating every product described as “GRC” as an equivalent substitute. It also avoids adding overlapping modules together to manufacture a larger addressable market.
Evidence labels used throughout:
- Publisher estimate: a market research company’s model, including historical estimates.
- Company-reported: a supplier or investor disclosure, not an independent capability assessment.
- Observed pricing panel: a procurement intermediary’s published sample, not the whole market.
- Listed price: an advertised component or package price, not a negotiated deployment quotation.
- Desk calculation or illustration: arithmetic with its inputs and assumptions exposed.
- Undisclosed: not stated in the announcement reviewed; it does not mean zero.