Controlspan / Field notes   Enterprise GRC intelligenceResearch edition · October 2026 · US market
HomeWorking tools
The Controlspan working papers

Take the evidence
into the room.

Practical worksheets for migration, scope, demonstrations and ownership cost. Your existing tools, with local exports and visible assumptions.

Migration crosswalk →First-release scope →Readiness X-Ray →Tool / Build / Expert →Requirements →Platform directory →Demo tests →Three-year cost →Save a preview →
A-1Migration specification

An identifier can migrate cleanly while its ownership does not.

Know what carries across, what needs rebuilding and who will own it afterwards. Select a source field to open the decision it still needs.

Tickmark legend

Match in sampleThis mapping reconciled in the stated sample, nothing more.
Review decisionA named person must decide. Nothing merges automatically.
UnmappedNo source relationship. It stays visibly empty.
Check your own rows
Control-library migration crosswalk
Illustrative control-library migration — synthetic records
Synthetic
Synthetic crosswalk mapping four current control-library fields to required destination behaviour. Select a source field to see its destination and the open decision.
Record contextscopeCurrent estateControls_2024.xlsx · SharePointRequired destinationtarget system behaviour
ITGC
Entity 1
Control numberStable, unique identifier retainedMatch in sample
ITGC
Entity 1
Accountable roleNo role assignment existsUnmapped
ITGC
Entity 2
Evidence record + permissionsRestricted to IAM reviewers and internal auditReview decision
ITGC
Entity 3
Version historyNo source relationship to carryUnmapped
Match in sampleReview decisionUnmapped
2 of 4 fields unmapped · no aggregate score
B-1Scope template

Which workflow has to work first?

Agree the first workflow, accountable role and deadline before you price the future state. This is about resolving scope, not selling consolidation.

Workflow: not chosen Scope hierarchy for the synthetic institution: three legal entities, business units, risks, and 480 controls LEVEL 1Legal entity · 3 LEVEL 2Business unit LEVEL 3Risk LEVEL 4Control · 480 records Synthetic US regional FI · 1,200 staff

Scope is set at the control level. A "consolidation" programme that skips this step usually prices the wrong thing.

Current estate

First workflow
Systems retained in release one

First-release scope

Draft · local
A role, not a person's name or email.
Not in first release
    C-1Source inventory · GRC Migration Readiness X-Ray

    A populated owner column is not the same as an owned control library.

    Inspect ownership, identifiers, evidence relationships and history before you commit to a migration price.

    Reading this working paper

    No finding in this check
    Review note attached to the row it concerns
    Not assessed yet

    Demo mode: deterministic local rules, no model calls. Pasted text is parsed in your browser and never stored.

    Source: synthetic sample, 6 of 480 records
    Source rows with migration findings attached to each row
    Control IDOwner fieldEvidence linkHistoryReview notes · migration consequence
    D-1Decision guide · Tool vs Build vs Expert

    Automate the mapping proposal. Keep accountability with a named owner.

    Choose help for the task, not a shortcut around accountability. A purchased GRC platform is a separate system-of-record decision and can sit alongside any route.

    Responsibility matrix: GRC tasks against instant AI tool, build in-house and hire an expert
    GRC taskInstant AI toolBuild in-houseHire an expert
    Draft first-release requirementsFits
    Drafts from redacted notes for a named reviewer    		Conditional
    Only if the team maintains the template    		Conditional
    When stakeholders disagree on scope
    Propose field mappingsFits
    Proposal only; every mapping reviewed    		Fits
    Maintained mapping table with history    		Conditional
    Many-to-one taxonomy conflicts
    Maintain connectors and bounded workflowsNot this route
    Can't own runtime behaviour    		Fits
    Needs access control, testing, maintenance and exit design    		Conditional
    Bespoke dependencies, with knowledge transfer
    Resolve cross-entity taxonomy and migrationNot this route
    Summaries only    		Conditional
    With GRC ownership and capacity    		Fits
    Scope, acceptance conditions and conflict disclosure
    Establish regulatory applicabilityNot this route
    Cannot establish applicability    		Not this routeQualified adviser
    Legal counsel, not a platform consultant
    What you still ownControl approval, the system of record, acceptance decisions, the accountable role for each control, and the decision to retire legacy sources.
    Route explanation · your capacity
    Deterministic points. Task fit, not probability of success.
    Demo

    The task

    Internal capacity

    Complexity

    E-1Target requirements · Minimum Viable GRC Scope Builder

    Replace "flexible workflow" with a change your own administrator must make.

    Turn stakeholder preferences into observable acceptance conditions. Weights must total exactly 100% and are never silently rebalanced. A failed mandatory gate can't be offset by a high feature score.

    REQ-014 · tracked changesSynthetic

    Deleted: Platform must offer flexible workflow.Inserted: A buyer administrator changes the overdue-remediation escalation from 30 to 14 days for Entity 2 only, without supplier intervention or a code release.

    Accountable role
    GRC platform administrator
    Acceptance method
    Live demo on synthetic records. The change appears in the audit log with approver, timestamp and prior value.
    Phase
    Release one
    Comment [CS1]Observable behaviour, testable in a demonstration. A feature noun is not a requirement.
    Weighted evaluation scorecard with editable weights and two synthetic options
    RequirementPhaseWeight %Option A (0–5)Option B (0–5)
    Mandatory gates · pass or fail, never weighted
    Restricted evidence stays restricted in search and AI summariesGate—
    Evidence stored in a US region we specifyGate—
    Weight total: 100%
    F-1Target-system shortlist · Platform directory

    Compare the workflow you need, not the category each supplier occupies.

    Record evidence gaps before you ask for introductions. Listed alphabetically, with no paid ordering.

    Categories are desk research hypotheses. No supplier documentation has been inspected for this preview, so every evidence field reads Not assessed. Being listed doesn't mean capabilities are equivalent.

    Requirements comparison · up to three providers
    G-1Reconciliation protocol · Demonstration Script and Acceptance Criteria

    Ask every shortlisted platform to handle the same failed integration.

    Use the same records, exceptions and evaluator sheet for every supplier. Results start as Not assessed. "Not demonstrated" means it wasn't shown in the session, not that it's unsupported.

    H-1Three-year operating schedule · Total Cost of Ownership Calculator

    The subscription is one line. Operating the platform is the rest.

    Compare software, services, internal labour and unresolved commercial items. Only confirmed lines are calculated, and unknown costs stay Unknown, never $0.

    Illustrative · USD

    Annual cost by band · confirmed lines

    SoftwareServicesBuyer labourUnknown, not sized

    Three-year cost schedule by line item with annual USD amounts
    Quoted or estimated itemAssumptionsStatusYear 1Year 2Year 33-year
    Total of confirmed lines
    J-1Optional · local delivery preview

    Turn unanswered mappings into a plan.

    Every worksheet already downloads without an email. Want a summary of the bundle to keep? We'll save a delivery preview in this browser. Nothing is sent.

    • C-1Migration Readiness Checklist and remediation backlog
    • E-1Requirements and Weighted Evaluation Scorecard
    • H-1Three-year operating cost model

    Save a bundle preview

    Browser storage isn't a secure document vault, and saved items expire after 30 days.

    Find the evidence.

    Search across 188 research pages and 12 sections.

    Evaluation method

    Each worksheet follows one grammar: Record context · Current estate · Required destination. An unmapped relationship stays visibly unfilled and is never folded into a reassuring aggregate score. A many-to-one mapping needs a named review decision instead of an automatic merge.

    This preview runs in demo mode. It uses deterministic local rules and seeded synthetic content, with no model calls. The production approach is extraction, then evidence classification, then tailored interpretation, then human confirmation.

    Distinct states are kept apart: Not assessed, Not demonstrated, Not applicable and Failed test. Lime "Match in sample" means one mapping reconciled in the stated sample, nothing more.

    Market figures referenced elsewhere by the desk are supplied planning estimates, not independently verified benchmarks. They are deliberately kept out of this page's persuasion.

    Rubric version: demo-2026.10 · Synthetic fixture: US regional financial institution, 1,200 employees, 3 legal entities, 480 control records.

    Privacy and local data

    This page has no backend, CRM or email service. Saved scopes, shortlists and delivery previews stay in this browser's storage under cs_ keys, as versioned records that expire after 30 days.

    Pasted CSV text is parsed in memory and never saved. Marketing consent and supplier-sharing consent are separate, optional and unticked by default. In demo mode, no data is ever transmitted to a supplier.

    Consent handling is designed to fit UK GDPR expectations and the US privacy context. It is not a guarantee of legal compliance and needs legal review before production use.

    Accessibility

    The page targets WCAG 2.2 AA. It has a skip link, logical headings, visible focus, semantic tables, labelled errors, live announcements for revealed content, and 44px or larger touch targets. It supports keyboard operation of the crosswalk, tabs and comparisons, and respects reduced-motion preferences.

    On light surfaces, sulphur is used only as a fill behind violet lettering, never as text. Status is always shown by label and shape as well as colour.

    Corrections

    Research pages carry a revision date and an applicability note. Corrections are logged with the date, what changed and why. A public corrections contact will be published once a production domain is configured. No contact address is shown in this preview.

    Requirements comparison