Use domain scores to route the work; do not let the overall total obscure a weak domain. Each domain has a maximum of nine points.
| Domain | Calculation | If this is your weakest area, produce… | Suggested accountable role |
|---|---|---|---|
| Mandate and operating model | Q1 + Q2 + Q3 | Scope charter, decision rights and responsibility matrix | Sponsor and programme lead |
| Data and migration | Q4 + Q5 + Q6 | Data dictionary, profiling results and history/evidence migration plan | Data owner and programme lead |
| Security, integrations and AI | Q7 + Q8 + Q9 | Access tests, interface specifications and AI decision record | CISO and enterprise architect |
| Delivery and operation | Q10 + Q11 + Q12 | Resource plan, operating model and user acceptance pack | Programme lead and service owner |
| Cost, contracts and exit | Q13 + Q14 + Q15 | Normalised three-year model, commercial questions and portability plan | Finance, procurement and legal |
Our recommended priority order: failed gates first; then zero-point answers; then the lowest-scoring domain. If two domains tie, prioritise the one blocking the earliest real decision or creating the most consequential unresolved exposure.
What should the three-year GRC cost worksheet include?
Use the following as this desk’s modelling structure, not a market-price benchmark:
Three-year ownership cost = one-off delivery costs + recurring external costs over 36 months + internal delivery and operating labour over the same period.
Include:
- Software and applicable modules, user categories and usage allowances.
- Implementation, configuration, cleansing and migration.
- Integrations, API access, environments and testing.
- Training, change management, administration and support.
- Retained tools and any incremental dual-running costs.
- Renewal changes and expansion assumptions as explicit scenarios.
Separate cash expenditure from allocated internal labour, and avoid counting the same work twice. Show unknown charges as unresolved—not zero. Model exit separately unless an exit is actually planned within the three-year period.