Free editable templates

ERM and GRC RFP Templates in Excel and Word

Build your enterprise risk management or GRC software RFP with an editable requirements workbook and a matching Word template. Choose the capabilities that matter, add your organization’s context, and give vendors a consistent way to respond.

250+ requirements organized by capability
Guidance explaining why each requirement matters
Simple vendor responses and demonstration scenarios
Editable Excel and Word files

Get the free templates Browse the requirements

Start with the sections you need. You do not need to use every tab or requirement.

What you receive

Two editable documents to build your RFP

Template preview

Requirements and vendor response workbook

Select requirements by module and category, mark priorities, and use the “Why it matters” guidance to decide what to retain. Vendors answer with one response choice and one comments field. Includes vendor information, attestations and six optional demonstration scenarios.

Excel format · .xlsx

Crop of the requirements workbook showing category, requirement, why it matters, priority, vendor response and vendor comments.
Category	Requirement	Why it matters	Priority	Vendor response	Vendor comments
Configuration	PLT-001a Allow customer administrators to change supported field labels, reference lists and screen content without writing code.	Routine changes should be manageable by the people running the program.	Mandatory	Select one response	Vendor explains here
Configuration	PLT-001b Allow customer administrators to maintain assessment guidance within the application.	In-app guidance helps participants apply the organization’s framework consistently.	Desirable	Select one response	Vendor explains here
Configuration	PLT-007 Allow customer administrators to add supported custom fields to program records.	Local information needs should fit within the maintained application.	Mandatory	Select one response	Vendor explains here

Grey text is buyer guidance. Remove it before you issue the workbook.
Amber cells are where you set Mandatory, Desirable or Exclude.
Blue cells are completed by the vendor.

Template preview

RFP overview and instructions template

Add your name and logo, describe your project and scope, and set the timetable, submission instructions, pricing assumptions and evaluation approach. Highlighted placeholders show where to insert your information.

Word format · .docx

Request for Proposal

[INSERT ORGANIZATION LOGO]

[ORGANIZATION NAME]

Enterprise Risk Management and GRC Platform

RFP [RFP REFERENCE] · Version [RFP VERSION] · Issued [ISSUE DATE]

Item

Details

Questions deadline

[QUESTIONS DEADLINE INCLUDING TIME AND TIME ZONE]

Proposal deadline

[PROPOSAL DEADLINE INCLUDING TIME AND TIME ZONE]

Submission route

[SUBMISSION EMAIL OR PORTAL URL]

Procurement contact

[CONTACT NAME AND TITLE]

Highlighted text marks organization and procurement placeholders. Replace them, then remove the buyer-only preparation page before you share the document with vendors.

Define what matters

Start with organized requirements and practical explanations, then keep what fits your program.

Prepare your RFP

Add your context and procurement instructions using the matching Word template.

Compare responses

Ask vendors the same focused questions and validate important claims through selected demonstrations.

How to use the files

Prepare a package vendors can answer consistently

1
Choose your scope
Review the modules and categories. Keep the areas relevant to your project.
2
Select your requirements
Use the guidance to mark each requirement Mandatory, Desirable or Exclude. Filter and remove excluded rows before issue.
3
Prepare and issue
Add your organization’s context in Word, complete the workbook instructions and remove buyer-only guidance. Send every vendor the same package.
4
Evaluate and validate
Compare responses and comments, then use a small number of relevant demonstrations to test important workflows.

Vendor response choices

The three “Meets” choices describe delivery approaches, not an automatic ranking. Partial current coverage stays “Partially meets”. Record your own evaluation scores separately. The workbook does not calculate them.

Meets as standard: The full requirement is met by existing functionality in the offer, using routine setup.
Meets with configuration: The full requirement is met using supported configuration tools. Vendors state who configures it and any services needed.
Meets via add-on/integration: The full requirement is met using an available extra module, third-party product or integration included in the offer.
Partially meets: Current functionality meets only part of the requirement or needs a material workaround.
Planned / development: No current solution meets the requirement, but the vendor proposes future product delivery or custom development.
Does not meet: The requirement is not met and no future delivery is proposed.

The workbook also includes six optional demonstration scenarios: Organizational setup, A risk workshop, Corporate risk review, Framework adoption and change, Strategy review, Audit follow-up. Use a small number that match your scope. They are scenario briefs inside the workbook, not a separate script and not a requirement to demonstrate every row.

Before you choose

Questions worth asking before you choose a platform

These questions help you compare any vendor. They describe capabilities to evaluate. They are not a statement of what every product, including Essentials, currently includes.

Can your own administrators adapt the system?

Ask who can change supported labels, organizational structures and screen layouts, and what requires vendor services.

Can local teams work effectively within corporate oversight?

Explore access boundaries, local and consolidated views, and related risks with different owners and assessments.

Can people participate without becoming full-time system users?

Test voting from phones and computers, real-time results and the licence requirements for occasional participants.

Are diagrams connected to the records you maintain?

Ask how bow ties and strategy logic models connect to owners, controls, measures and follow-up work.

Does risk and compliance information support business objectives?

Retain objective links even if full strategy planning is outside the initial scope.

Can compliance reflect your jurisdictions and frameworks?

Check regulatory and IT coverage, custom frameworks, browsable libraries and the scope of change-monitoring services.

Requirements catalogue

Explore the requirements by capability

Browse the requirements and their “Why it matters” explanations below. The downloadable workbook adds priority dropdowns, vendor response fields and instructions for preparing your issue copy. The 256 requirements are a catalogue to select from. They do not include the workbook’s attestations or demonstration scenarios.

Browse by module

256 requirements across 10 tabs. Choose what to keep. You do not need to issue every requirement.

256 requirements

10 modules. Expand a module to read its requirements.

Shared capabilities for any ERM or GRC procurement.

Configuration

PLT-001aAllow customer administrators to change supported field labels, reference lists and screen content without writing code.
Why it matters. Routine changes should be manageable by the people running the program.
PLT-001bAllow customer administrators to maintain assessment guidance within the application.
Why it matters. In-app guidance helps participants apply the organization’s framework consistently.
PLT-007Allow customer administrators to add supported custom fields to program records.
Why it matters. Local information needs should fit within the maintained application.
PLT-008Allow customer administrators to simplify record screens by showing or hiding supported sections, fields and diagrams.
Why it matters. A focused layout can show relevant controls and assessment information while omitting diagrams or detail that users do not need.
PLT-009Allow different record types to use different configured layouts.
Why it matters. A project risk, corporate risk and compliance record may need different information.
PLT-029Allow customer administrators to define and assign alternative layouts for the same record type by use case or user group.
Why it matters. Different participants can work with the same underlying risk record through a layout suited to their responsibilities.
PLT-030Allow customer administrators to order screen sections and fields to guide users through the intended assessment or update sequence.
Why it matters. The screen can follow the risk manager’s preferred process and reduce missed steps or unnecessary navigation.
PLT-028Allow customer administrators to configure supported review steps, responsibilities and notifications without writing code.
Why it matters. Program owners need to adapt routine workflows without recurring development projects.

Organization and access

PLT-002aOrganize records by the business units, entities or projects responsible for them.
Why it matters. A clear organizational structure establishes local accountability.
PLT-002bRestrict viewing and editing of records to authorized users.
Why it matters. Confidentiality and responsibility must be reflected in access permissions.
PLT-002cAllow customer administrators to maintain the organizational structure and reassign records as responsibilities change.
Why it matters. Reorganizations should not require repeated vendor-led rebuilds.
PLT-003Provide entity, functional, geographic and project reporting views without requiring a single hierarchy, while preserving record ownership and access restrictions.
Why it matters. Organizations need several views of the same business without losing local accountability.
PLT-010Apply multiple tags or classifications to a record independently of its organizational ownership.
Why it matters. Cross-cutting themes should be reportable without changing who is accountable.
PLT-011Provide distinct permissions for program administration, record maintenance and read-only review.
Why it matters. Different participants need different levels of control over program information.

Participation

PLT-004Provide a focused experience for occasional users to complete assigned tasks, such as action updates, indicator submissions or risk voting, with appropriate access.
Why it matters. Simple participation supports adoption beyond the central risk or compliance team.
PLT-012Show each user the tasks assigned to them and their due dates.
Why it matters. A clear work list makes occasional participation easier to manage.
PLT-013Allow participants to complete supported tasks on a phone or tablet.
Why it matters. Workshop participants and operational staff may not be working at a desktop.
PLT-014Provide in-context instructions for completing assessments and updates.
Why it matters. Clear guidance reduces training effort and inconsistent responses.

Actions and collaboration

PLT-015Maintain actions with an accountable owner, due date and status.
Why it matters. Consistent action tracking makes follow-up visible across the program.
PLT-016Link actions to the records that explain why the work is needed.
Why it matters. Owners and reviewers need to understand the purpose of corrective work.
PLT-017Send reminders for assigned actions and highlight overdue work.
Why it matters. Routine follow-up should not depend entirely on manual chasing.
PLT-018Allow action owners to record progress updates and supporting information.
Why it matters. Reviewers need evidence of progress as well as a status label.
PLT-019Support review of completed actions before final closure.
Why it matters. A completion claim may need verification by someone other than the action owner.
PLT-020Attach documents or reference links to program records.
Why it matters. Supporting information should be accessible in the context where it is used.

Connected records

PLT-026Allow users to navigate between related records across the modules included in the proposed solution.
Why it matters. Connected workflows help users understand business context without rebuilding it in separate tools.
PLT-027Reuse a maintained record in multiple supported relationships rather than requiring a separate copy for each relationship.
Why it matters. Shared controls and objectives can remain consistent while genuinely distinct local risk instances retain their own assessments.

Reporting

PLT-005aAllow authorized users to drill from management summaries into underlying records and their linked actions, controls or measures.
Why it matters. Leaders need to understand the information behind a reported result.
PLT-005bExport record data in documented formats for analysis and management reporting.
Why it matters. Usable exports reduce manual re-entry and support further analysis.
PLT-005cExport report visuals in documented formats suitable for management and board papers.
Why it matters. Reusable visuals reduce recurring report-preparation work.
PLT-021Allow authorized users to configure dashboards from available report components.
Why it matters. Different audiences need different summaries without repeated development requests.
PLT-022Filter reports by organizational view, owner, category and other available attributes.
Why it matters. Local teams and central leaders should be able to focus on the information relevant to them.
PLT-023Save reusable report views for recurring management reviews.
Why it matters. Repeatable views reduce preparation time and inconsistent selection of records.
PLT-024Retain a record history identifying changes, dates and responsible users.
Why it matters. Reviewers need to understand how program information has changed over time.
PLT-025Present historical status or assessment trends for selected records.
Why it matters. Trends distinguish persistent issues from isolated changes.

AI governance

PLT-006aAllow the customer to choose whether to enable AI features.
Why it matters. The organization should control when AI is used with its information.
PLT-006bDisclose AI providers, data flows, processing locations, retention and use of customer data for model training.
Why it matters. Clear data-handling information supports an informed decision about enabling AI.
PLT-006cRequire users to review AI suggestions and allow them to edit, accept or reject suggestions before adoption as program records.
Why it matters. Human review protects the quality and accountability of adopted information.

Enterprise risk management, including basic objective alignment and control management.

Objective alignment

ERM-001Link risks to business objectives and make those relationships visible from both the risk and the objective.
Why it matters. Objective links help leaders consider risks affecting their goals and risks created by pursuing them.

Risk inventory

ERM-006Maintain a risk register with each risk’s description, owner, category and status.
Why it matters. A usable register establishes a consistent basis for assessment and follow-up.
ERM-007Organize risks within a configurable category hierarchy.
Why it matters. A common taxonomy supports comparison across business areas.
ERM-008Create local risk instances from reusable risk templates.
Why it matters. Teams can start from useful content while assessing their own circumstances.
ERM-009Maintain reusable risk-template content through customer administration.
Why it matters. The organization should be able to improve its starting content as its program develops.
ERM-038Maintain a business-process register with a process description and accountable owner.
Why it matters. A maintained process inventory provides a consistent business context for operational risk and audit work.
ERM-039Link risks to the business processes they may affect.
Why it matters. Process links help owners identify relevant exposures without maintaining a separate, disconnected risk register.
ERM-040Launch risk assessments for the risks linked to a selected business process.
Why it matters. Process-based assessments focus participants on how work is performed and where controls may need improvement.
ERM-041Maintain a business-asset register with each asset’s description, type and accountable owner.
Why it matters. A common asset inventory gives risk and audit teams consistent context for facilities, systems and other business assets.
ERM-042Link risks to the business assets they may affect.
Why it matters. Asset links make it easier to identify the exposures affecting a particular facility, system or other asset.
ERM-043Launch risk assessments for the risks linked to a selected business asset.
Why it matters. Asset-based assessments focus attention on the exposures relevant to an asset’s operation and protection.

Assessment methodology

ERM-002aSupport a 5×5 likelihood-and-impact risk assessment model.
Why it matters. A consistent assessment model supports comparison and review across the organization.
ERM-002bAllow customer administrators to adapt assessment-axis terminology and level descriptions.
Why it matters. Assessment language should reflect the organization’s framework.
ERM-002cAllow customer administrators to enable or hide inherent and target risk assessments.
Why it matters. The starting process can stay simple while retaining room for program development.
ERM-010Record likelihood, impact and assessment rationale for each enabled risk-assessment stage.
Why it matters. A rating is easier to challenge and update when its reasoning is recorded.
ERM-011Retain previous risk assessments for comparison with the current assessment.
Why it matters. Assessment history helps explain changing exposure and management decisions.
ERM-012Record risk-appetite statements relevant to the organization or a risk category.
Why it matters. Appetite provides context for deciding whether exposure is acceptable.
ERM-013Compare assessed exposure with defined risk tolerances and highlight exceptions.
Why it matters. Leaders need a clear way to focus on exposure that warrants a response.

Assessment cycle

ERM-014Assign risk-review owners and review dates.
Why it matters. Regular review helps keep the register current after initial implementation.
ERM-015Launch a risk-assessment exercise for selected risks and participants.
Why it matters. A coordinated exercise is easier to manage than unrelated requests for updates.
ERM-016Guide participants through the information required for their assigned risk assessment.
Why it matters. Structured participation improves completeness and consistency.
ERM-017Track assessment completion and remind participants about outstanding responses.
Why it matters. Coordinators need visibility of progress without maintaining a separate tracker.
ERM-018Record review comments and approval of completed risk assessments.
Why it matters. Review decisions should remain visible alongside the assessment they support.

Risk analysis

ERM-003aRepresent a risk’s causes, event, consequences and preventive or mitigating controls in a bow-tie diagram.
Why it matters. A shared visual model helps teams understand how a risk can arise and be managed.
ERM-003bConnect bow-tie elements to maintained records so users can inspect related ownership, actions and control information.
Why it matters. Connected diagrams support ongoing work without maintaining separate drawings and records.
ERM-019Use AI to suggest risks from business objectives or other supplied organizational context for user review.
Why it matters. Contextual suggestions can help teams identify exposures they may otherwise overlook.

Risk workshops

ERM-004aRun risk-voting exercises in the platform using selected participants and assessment criteria.
Why it matters. Structured participation draws out perspectives beyond the central risk team.
ERM-004bTabulate votes in real time for facilitator review, retaining results against the risks assessed.
Why it matters. Live results support discussion and agreement during a workshop without manually combining separate surveys.
ERM-004cAllow participants to submit risk votes from a phone or computer without a dedicated voting device.
Why it matters. Participants can use devices they already have, supporting both in-person and remote workshops.
ERM-004dAllow invited participants to vote without requiring a full platform-user licence.
Why it matters. Broad participation should not require full-user licences for people who only contribute to occasional assessments.

Risk relationships

ERM-005Link related local and corporate risk instances while preserving each instance’s owner, assessment and response.
Why it matters. The same risk theme can have different consequences and responsibilities at different levels.
ERM-020Select risks for corporate reporting using explicit criteria or classifications.
Why it matters. A corporate profile should reflect significance rather than simply include every local risk.
ERM-021Record why a risk requires escalation or corporate attention.
Why it matters. Clear rationale helps distinguish a material concern from routine local management.
ERM-022Provide a corporate risk view with access to the relevant underlying local risk information.
Why it matters. Central oversight needs enough context to understand local exposure and responsibility.

Controls and treatment

ERM-023Maintain a control library recording each control’s description, owner and type.
Why it matters. A common control record reduces inconsistent descriptions and unclear accountability.
ERM-024Link one control to multiple risks and one risk to multiple controls.
Why it matters. Real controls often address several exposures and should not require duplicate maintenance.
ERM-025Record assessments of individual control effectiveness.
Why it matters. Reviewers need to know whether the measures relied upon are working.
ERM-026Record the overall effectiveness of controls relevant to a risk.
Why it matters. The combined control position informs the assessment of remaining exposure.
ERM-027Distinguish controls currently operating from planned risk-treatment actions.
Why it matters. An intended improvement should not be mistaken for protection already in place.
ERM-028Link risk-treatment actions to the risk and intended improvement.
Why it matters. Treatment decisions need a clear connection to the exposure they address.

Risk indicators

ERM-029Define risk indicators with an owner, unit of measure and update frequency.
Why it matters. Consistent definitions make indicator results usable and comparable.
ERM-030Link indicators to the risks or controls they help monitor.
Why it matters. Measures are more useful when their risk-management purpose is clear.
ERM-031Set target, warning and tolerance levels for risk indicators.
Why it matters. Thresholds help translate a measurement into a management decision.
ERM-032Request indicator updates from the responsible contributors.
Why it matters. A repeatable collection process reduces stale data and manual chasing.
ERM-033Highlight indicator results that breach defined thresholds.
Why it matters. Exceptions should be visible before they are lost in a large reporting pack.
ERM-034Show indicator trends alongside the relevant risk information.
Why it matters. Trends can reveal deteriorating conditions before a risk rating changes.

Risk reporting

ERM-035Provide heat maps for enabled risk-assessment stages with access to the underlying risks.
Why it matters. Visual summaries should connect directly to the records requiring attention.
ERM-036Identify material risk-rating changes between review periods.
Why it matters. Management needs to understand what has changed since its previous review.
ERM-037Report overdue risk reviews and outstanding risk-treatment actions.
Why it matters. A current register depends on timely assessment and follow-through.

Obligations, controls, evidence, policy records and framework maintenance.

Business context

CMP-001aLink compliance obligations to business objectives and allow users to navigate those relationships.
Why it matters. Objective links help leaders understand the business purpose of compliance activity.
CMP-001bLink compliance obligations to associated non-compliance risks and allow users to navigate those relationships.
Why it matters. Risk context helps prioritize compliance attention and responses.
CMP-032Manage regulatory obligations for multiple countries and jurisdictions within the same platform.
Why it matters. Country-specific requirements can be managed locally while central teams retain a consolidated view.
CMP-033Manage IT and information-security compliance frameworks in the same platform as regulatory obligations.
Why it matters. A common platform helps regulatory and IT teams coordinate ownership, controls and assurance work.
CMP-034Allow customer administrators to create and maintain compliance frameworks for any jurisdiction without relying on a predefined library.
Why it matters. The program can include local, sector-specific or internal requirements even when ready-made content is unavailable.

Obligation register

CMP-006Organize obligations within frameworks and nested requirement sections.
Why it matters. A clear structure helps users navigate complex frameworks without losing source context.
CMP-007Record the source reference and local interpretation of an obligation.
Why it matters. Teams need to distinguish the original requirement from how they apply it.
CMP-008Assign an accountable owner and review date to each obligation.
Why it matters. Compliance responsibility should remain clear between periodic reviews.
CMP-009Record whether an obligation applies and the rationale for that decision.
Why it matters. Documented applicability prevents unexplained exclusions and unnecessary work.
CMP-010Track obligation status and identified compliance gaps.
Why it matters. A framework register should show what needs attention as well as what exists.
CMP-011Classify obligations across frameworks using common themes.
Why it matters. Shared themes help identify overlapping requirements and coordinated responses.

Controls and evidence

CMP-002aSupport many-to-many relationships between controls and obligations, and between controls and risks.
Why it matters. Shared controls reduce duplicate work across frameworks and risk assessments.
CMP-002bMaintain each control’s ownership and supporting evidence in a connected record accessible from its related obligations and risks.
Why it matters. A maintained control record gives reviewers a consistent source of supporting information.
CMP-012Record control review and approval decisions.
Why it matters. A control description alone does not show whether it has been accepted for use.
CMP-013Schedule recurring reviews of control effectiveness.
Why it matters. Control assurance needs to continue after initial design and approval.
CMP-014Identify controls that are required for particular compliance obligations.
Why it matters. Reviewers need to understand which protections are essential to meeting a requirement.
CMP-015Schedule recurring evidence tasks with an owner and due date.
Why it matters. Repeated assurance activity should not require rebuilding the task list each period.
CMP-016Send reminders and show overdue evidence tasks.
Why it matters. Missing evidence should be visible while there is still time to address it.
CMP-017Collect files, links or explanatory notes as evidence of control operation.
Why it matters. Different controls produce different forms of proof.
CMP-018Record evidence-review outcomes such as pass, fail or inconclusive.
Why it matters. Completion of a task does not necessarily demonstrate effective control operation.
CMP-019Retain evidence with its submission date and assessment period.
Why it matters. Reviewers need to know which period a piece of evidence supports.
CMP-020Link failed or inconclusive evidence reviews to corrective actions.
Why it matters. Assurance gaps should lead to accountable follow-up.
CMP-021Show historical control and evidence status by review period.
Why it matters. A historical view helps establish whether assurance has been sustained over time.

Policy records

CMP-022Maintain a policy register with an owner, review date and status.
Why it matters. Policies require ongoing accountability and maintenance.
CMP-023Store or link the policy document from its register record.
Why it matters. Users need a reliable route from program information to the relevant policy.
CMP-024Record policy review and approval status.
Why it matters. Reviewers should be able to distinguish approved policy from work in progress.
CMP-025Link policies to the obligations and controls they support.
Why it matters. The organization should be able to explain how policy supports its compliance approach.

Framework libraries

CMP-003aAllow users to browse and search a library of available frameworks and select applicable obligations for adoption.
Why it matters. Browsable content helps teams find relevant frameworks and accelerate setup without importing irrelevant obligations.
CMP-003bRetain source and version information for obligations adopted from a library.
Why it matters. Traceability helps users understand which source informed their local requirements.
CMP-003cRequire users to select organizational ownership and access when adopting library obligations.
Why it matters. Content should enter the program with deliberate accountability and access settings.
CMP-005aMonitor supported regulatory and framework sources for changes and notify designated users when adopted obligations may need review.
Why it matters. Timely prompts help teams assess changing requirements before their local compliance content becomes outdated.
CMP-005bShow source and change details so reviewers can assess the effect on local obligations, controls and actions.
Why it matters. Reviewers need enough context to decide what should change locally.
CMP-026Identify available framework-library and change-monitoring coverage, content providers and any separate licensing terms.
Why it matters. Buyers need to know which jurisdictions and frameworks are covered, how updates are supplied and what costs extra.
CMP-027Allow reviewers to decide how a source change should affect locally maintained obligations.
Why it matters. Changed source content should be assessed in the organization’s context before local practice is altered.
CMP-028Record the review decision and follow-up for an obligation change.
Why it matters. A notification is only useful if the resulting decision and work can be followed through.

AI assistance

CMP-004aUse AI to suggest risks from a supplied framework for user review.
Why it matters. Suggestions can accelerate the initial risk assessment of framework requirements.
CMP-004bUse AI to suggest controls from a supplied framework for user review.
Why it matters. Suggestions can accelerate control design while retaining human judgement.

Compliance reporting

CMP-029Report compliance status by framework, organizational unit and owner.
Why it matters. Different leaders need a focused view of their responsibilities and gaps.
CMP-030Provide a calendar of upcoming obligation, control and evidence reviews.
Why it matters. A forward view helps teams plan assurance work and avoid missed commitments.
CMP-031Report open compliance gaps and their corrective actions.
Why it matters. Management needs to see whether identified gaps are being resolved.

Optional: deeper strategy planning and execution. Basic objective links remain in ERM and Compliance.

Strategy planning

STR-001aRepresent objectives, planned activities and intended outcomes in an interactive logic model.
Why it matters. A shared model makes the reasoning behind a strategy visible.
STR-001bConnect logic-model elements to maintained measures, risks or actions so users can inspect the supporting information.
Why it matters. Connected information helps teams test assumptions and follow through as conditions change.
STR-004Represent the organization’s vision, mission and strategic pillars in the planning structure.
Why it matters. A shared structure connects operational work to the wider direction of the organization.
STR-005Link supporting objectives to higher-level objectives.
Why it matters. Cascading objectives help teams explain how their work contributes to the overall plan.
STR-006Assign objective owners and planning periods.
Why it matters. Strategy needs accountable ownership and a clear time horizon.

Initiative delivery

STR-007Link initiatives to the objectives they support.
Why it matters. Leaders need to understand which work is intended to deliver each objective.
STR-008Define initiative milestones with owners and planned dates.
Why it matters. Milestones make delivery responsibilities and timing visible.
STR-009Show initiative schedules and milestones in a timeline or Gantt view.
Why it matters. A visual schedule helps teams recognize timing conflicts and slippage.
STR-010Record initiative progress updates and delivery commentary.
Why it matters. A useful review needs an explanation of progress as well as a completion percentage.
STR-011Link initiative risks and follow-up actions to the initiative.
Why it matters. Delivery concerns should remain connected to the work they may affect.

Performance tracking

STR-002aShow objective progress alongside linked measures and initiatives.
Why it matters. Leaders need to see progress in the context of the work intended to deliver it.
STR-002bAssign owners and review dates to the measures and initiatives supporting objectives.
Why it matters. Clear responsibility and review timing help sustain attention after a plan is approved.
STR-002cRequest progress updates from the users responsible for measures and initiatives.
Why it matters. A repeatable update process reduces manual chasing and stale information.
STR-012Record baselines, targets and actual results for objective measures.
Why it matters. Progress should be assessed against an explicit starting point and intended result.
STR-013Show measure trends over successive reporting periods.
Why it matters. Trends help distinguish sustained improvement from a single favourable result.
STR-014Highlight objectives or initiatives that need management attention.
Why it matters. Review meetings should focus on decisions and obstacles rather than every item equally.

Decision support

STR-003Present objective progress with related risk and compliance information, or provide direct navigation between those views.
Why it matters. Performance alone may conceal growing exposure or a compliance constraint.
STR-015Provide strategy views by organizational unit and responsible owner.
Why it matters. Teams need relevant local views within the wider strategic plan.
STR-016Record follow-up actions arising from an objective or strategy review.
Why it matters. A review should lead to assigned work that can be followed to completion.

Optional: audit planning, engagements, findings and corrective follow-up.

Audit planning

AUD-002Maintain an audit universe of entities, processes or other auditable areas.
Why it matters. A defined universe supports systematic coverage decisions.
AUD-003Link auditable areas to relevant risks, controls and obligations.
Why it matters. Assurance planning should use the same context as the wider risk and compliance program.
AUD-004Prioritize audit work using documented risk and materiality considerations.
Why it matters. Limited assurance resources should be directed toward the most significant needs.
AUD-005Maintain audit plans showing planned engagements, timing and status.
Why it matters. A visible plan supports coordination and oversight of assurance work.
AUD-006Assign audit resources to planned engagements.
Why it matters. Plans need to reflect the people available to perform the work.

Engagement execution

AUD-007Record each engagement’s scope, objectives and assessment criteria.
Why it matters. Clear boundaries help stakeholders understand what an audit will and will not cover.
AUD-008Create engagement work programs from reusable procedure templates.
Why it matters. Reusable procedures support consistency while allowing engagement-specific tailoring.
AUD-009Assign audit procedures to responsible team members.
Why it matters. Clear task ownership helps teams coordinate fieldwork.
AUD-010Maintain working papers and supporting evidence within the engagement.
Why it matters. Reviewers need traceable support for audit conclusions.
AUD-011Record test results against the relevant procedure and control.
Why it matters. A conclusion should be connected to the work and evidence that support it.
AUD-012Record review and sign-off of audit work.
Why it matters. Supervisory review supports the quality of assurance conclusions.
AUD-013Restrict access to confidential engagement information.
Why it matters. Audit work can contain sensitive findings and evidence.

Audit findings

AUD-001aLink audit findings to the relevant engagement and affected risks or controls.
Why it matters. Connected findings show where assurance work affects the wider program.
AUD-014Record a finding’s severity, cause, effect and recommendation.
Why it matters. Findings need enough context for management to understand and address them.
AUD-015Produce an engagement summary of findings and agreed responses.
Why it matters. Stakeholders need a coherent account of the audit’s conclusions and required follow-up.

Remediation

AUD-001bAssign corrective actions with owners and due dates to audit findings.
Why it matters. Named responsibility and deadlines turn findings into accountable follow-up.
AUD-001cRecord management responses to audit findings.
Why it matters. Reviewers need to understand management’s position and intended response.
AUD-001dTrack remediation through review and closure.
Why it matters. Assurance teams need visibility of unresolved work and its eventual resolution.
AUD-016Record verification evidence before closing an audit finding.
Why it matters. An action marked complete may still need assurance that the issue has been resolved.
AUD-017Report overdue and unresolved findings by severity and owner.
Why it matters. Outstanding significant issues should remain visible to oversight bodies.

Audit reporting

AUD-018Report progress against the audit plan and coverage of the audit universe.
Why it matters. Oversight bodies need to understand delivery progress and remaining assurance gaps.

Optional: incident intake, investigation, corrective work and learning.

Incident intake

INC-001Maintain incident records with an event description, type and reporting source.
Why it matters. Consistent intake makes incidents easier to investigate and compare.
INC-002Configure incident forms for different event types.
Why it matters. Different events need different information without burdening every reporter with every field.
INC-003Record when an incident occurred and when it was identified.
Why it matters. The difference between occurrence and discovery can matter to the investigation.
INC-004Record incident severity and actual or potential impact.
Why it matters. A shared impact assessment helps prioritize response effort.
INC-005Identify supported reporting routes and the account or licence needed for each route.
Why it matters. Buyers need to understand who can report an incident and any participation barriers.

Investigation

INC-006Assign an incident owner and track investigation status.
Why it matters. Investigations need clear accountability from intake through resolution.
INC-007Record investigation findings and contributing causes.
Why it matters. Understanding causes supports improvements beyond the immediate response.
INC-008Attach investigation evidence to the incident record.
Why it matters. Conclusions should be supported by accessible information.
INC-009Restrict sensitive incident information to authorized participants.
Why it matters. Confidential investigations require appropriate access boundaries.

Follow-up and learning

INC-010Link incidents to related risks and controls.
Why it matters. Actual events can reveal weaknesses in the existing risk and control assessment.
INC-011Assign corrective actions arising from an incident.
Why it matters. Investigation findings need to lead to practical improvement.
INC-012Record review and closure of the incident.
Why it matters. A clear close-out decision helps establish that the response is complete.
INC-013Record lessons learned and any resulting risk or control review.
Why it matters. Incident information should improve the wider program over time.

Incident reporting

INC-014Report incident trends by event type, organizational unit and period.
Why it matters. Patterns can reveal recurring weaknesses that individual case reviews miss.
INC-015Report open incidents and overdue investigative or corrective work.
Why it matters. Managers need to see where responses are stalled.

Optional: supplier due diligence and ongoing oversight. Retain only the depth needed for your program.

Supplier inventory

TPR-001Maintain a supplier register with services provided, business owner and relationship status.
Why it matters. A reliable inventory is the starting point for proportionate third-party oversight.
TPR-002Link suppliers to the business units or services that depend on them.
Why it matters. Dependency context helps explain the effect of a supplier problem.
TPR-003Classify suppliers by criticality or risk tier.
Why it matters. Assessment effort should reflect the significance of the relationship.

Due diligence

TPR-004Configure supplier due-diligence questionnaires.
Why it matters. Different supplier types and risk tiers may need different questions.
TPR-005Collect questionnaire responses from internal reviewers and external suppliers.
Why it matters. Effective assessment often requires information from both parties.
TPR-006Track questionnaire completion and outstanding responses.
Why it matters. Assessment coordinators need to know what information is still missing.
TPR-007Collect supporting documents with a supplier assessment.
Why it matters. Reviewers need evidence behind important assertions.
TPR-008Consolidate questionnaire results using documented scoring rules.
Why it matters. Transparent scoring supports consistent assessment and challenge.
TPR-009Record the review decision and any conditions attached to supplier acceptance.
Why it matters. A score alone does not explain the organization’s decision or required safeguards.

Ongoing oversight

TPR-010Schedule periodic supplier reviews according to the supplier’s risk tier.
Why it matters. Ongoing review should be proportionate to the relationship’s significance.
TPR-011Record supplier performance assessments over time.
Why it matters. A trend gives more useful context than the latest rating alone.
TPR-012Link supplier-related risks to the organization’s risk-management records.
Why it matters. Third-party exposure should be visible within the wider risk position.
TPR-013Assign and track actions to address supplier assessment findings.
Why it matters. Due diligence is more useful when identified weaknesses lead to follow-up.
TPR-014Retain previous supplier assessments and review decisions.
Why it matters. History helps explain changes in risk and the basis of earlier decisions.

Relationship records

TPR-015Store or link key supplier documents and contracts from the supplier record.
Why it matters. Oversight teams need the relevant information in one accessible context.
TPR-016Track key contract dates and renewal review deadlines.
Why it matters. Advance visibility supports timely review before commitments renew.
TPR-017Identify significant dependencies shared across suppliers, services or business units.
Why it matters. Concentration can create exposure that is not visible in separate supplier assessments.
TPR-018Record continuity or exit arrangements for critical supplier relationships.
Why it matters. Critical services need a considered response if a supplier becomes unavailable.

Service security, resilience, data exchange and technical suitability.

Identity and access

SEC-001Support single sign-on through a documented identity-provider integration.
Why it matters. Central authentication reduces separate credentials and supports established access controls.
SEC-002Enforce multi-factor authentication through the application or agreed identity provider.
Why it matters. Strong authentication reduces the risk of unauthorized access.
SEC-003Disable user access promptly when access is withdrawn.
Why it matters. Leavers and changed responsibilities should not retain unnecessary access.
SEC-004Provide configurable session or inactivity controls.
Why it matters. Session controls help align the service with the organization’s security policies.
SEC-005Log administrative access and significant security events.
Why it matters. Investigation and oversight require a usable record of relevant activity.

Data protection

SEC-006Encrypt customer data in transit and at rest, including backups.
Why it matters. Confidential program information needs protection throughout its handling.
SEC-007Separate customer data within the service’s tenancy model.
Why it matters. Buyers need confidence that other customers cannot access their information.
SEC-008Disclose production, backup and relevant third-party processing locations.
Why it matters. Location decisions need to account for the full proposed service.
SEC-009Identify subprocessors and how customers are informed of material changes.
Why it matters. Buyers need visibility of other parties involved in handling their data.
SEC-010Restrict and record vendor support access to customer data.
Why it matters. Support access should be controlled and accountable.
SEC-011Provide documented data-retention and deletion arrangements, including backup retention.
Why it matters. Buyers need to understand how long information remains after deletion or exit.

Security assurance

SEC-012Provide current independent security-assurance evidence, such as an applicable SOC 2 report or equivalent.
Why it matters. Buyers need evidence of controls beyond marketing statements.
SEC-013Describe vulnerability management and remediation targets.
Why it matters. Security assurance depends on how weaknesses are found and resolved.
SEC-014Provide a summary of independent penetration testing and remediation follow-up.
Why it matters. Testing evidence helps assess the service’s exposure to practical attack methods.
SEC-015Describe security review and testing within the software-change process.
Why it matters. Ongoing product changes should not undermine security controls.

Service resilience

SEC-016State the service-availability commitment and treatment of planned maintenance.
Why it matters. Buyers need a clear basis for assessing expected service continuity.
SEC-017Maintain backups and test restoration of customer data.
Why it matters. A backup is useful only if information can be restored successfully.
SEC-018State recovery-time and recovery-point objectives for the proposed service.
Why it matters. Buyers need to judge whether recovery arrangements match business needs.
SEC-019Maintain and test a disaster-recovery plan.
Why it matters. Recovery arrangements should be exercised before a major disruption.
SEC-020Describe incident response and customer-notification commitments for security events.
Why it matters. Buyers need to know how relevant incidents will be handled and communicated.

Data exchange and exit

SEC-021Export customer record data with identifiers, relationships and relevant history in documented formats.
Why it matters. Meaningful portability requires more than a flat list of current records.
SEC-022Provide a documented route to retrieve supporting attachments and their record references.
Why it matters. An exit plan should preserve the evidence as well as the register data.
SEC-023Identify supported import methods and who performs each import.
Why it matters. Buyers need to understand the effort and services required for ongoing data loading.
SEC-024Describe available integration interfaces, authentication and operating limits.
Why it matters. Integration feasibility depends on the actual interface and its constraints.

Usability and scale

SEC-025Identify supported browsers, devices and any client software requirements.
Why it matters. Users need to know whether the service fits their working environment.
SEC-026Describe accessibility support and provide available conformance evidence.
Why it matters. Users with different access needs should be able to participate effectively.
SEC-027State capacity and performance assumptions for the proposed number of users and records.
Why it matters. Buyers need confidence that the quoted service suits their expected scale.

Setup, migration, adoption and ongoing support for the selected scope.

Planning and setup

IMP-001Provide a fit-and-gap review against the buyer’s agreed framework and selected requirements.
Why it matters. Early agreement on fit reduces surprises during setup.
IMP-002Provide an implementation plan with stages, responsibilities and buyer resource needs.
Why it matters. Successful delivery depends on both parties understanding their work.
IMP-003Offer starting configurations that the buyer can adapt to its program.
Why it matters. Useful starting content accelerates setup without locking the buyer into a fixed framework.
IMP-004Support a phased rollout by team, process or module.
Why it matters. Phased adoption allows learning and improvement before wider deployment.
IMP-005Distinguish technical setup milestones from business adoption milestones.
Why it matters. A configured system is only one part of a working risk or compliance program.

Migration and acceptance

IMP-006Agree data mapping and cleansing responsibilities before migration.
Why it matters. Clear preparation responsibilities improve data quality and avoid rework.
IMP-007Provide a trial migration for review before final loading.
Why it matters. A trial helps identify mapping and quality issues while they are easier to correct.
IMP-008Reconcile migrated records and important relationships against the agreed source data.
Why it matters. Record counts alone do not establish that the migrated program is usable.
IMP-009Support user acceptance testing against agreed workflows and acceptance criteria.
Why it matters. Buyers need to verify practical use before wider rollout.
IMP-010Agree a cutover plan and initial support arrangements.
Why it matters. Clear transition steps reduce disruption at the start of live use.

Training and handover

IMP-011Train customer administrators to maintain supported configuration independently.
Why it matters. The buyer should be able to manage routine change after implementation.
IMP-012Provide role-based training for program leads and participating users.
Why it matters. Different roles need different levels of detail and practice.
IMP-013Provide reusable guidance or training materials for future users.
Why it matters. Staff changes should not require the program to restart its training effort.
IMP-014Hand over the agreed configuration and administration responsibilities.
Why it matters. Clear handover helps sustain the solution after the implementation team leaves.

Ongoing support

IMP-015State support channels, operating hours and response targets.
Why it matters. Buyers need to understand the help available during their working day.
IMP-016Describe the process for escalating unresolved support issues.
Why it matters. Significant problems need a clear route to further attention.
IMP-017Notify customers of relevant releases and changes affecting their configured workflows.
Why it matters. Program owners need time to prepare users for meaningful changes.
IMP-018Explain how customers can test significant configuration or release changes.
Why it matters. Controlled testing reduces disruption to established workflows.

Comparable pricing and delivery assumptions for the buyer’s selected scope.

Pricing and inclusions

COM-001Provide an itemized quotation for the buyer’s stated scope and contract period.
Why it matters. Comparable scope is necessary for a meaningful cost comparison.
COM-002Identify included modules and dependencies between the proposed components.
Why it matters. A capability may depend on a component not obvious in the headline price.
COM-003Explain user categories, licence quantities and permissions included in each category.
Why it matters. Participation costs depend on what each type of user can actually do.
COM-004Itemize implementation charges and the activities included.
Why it matters. One-off service costs and assumptions can materially affect the initial investment.
COM-005Identify recurring charges for content, integrations, storage or other third-party services.
Why it matters. Buyers need visibility of costs beyond the core subscription.
COM-006Explain AI usage limits and any additional AI charges.
Why it matters. AI pricing can vary with use and should be considered in the overall cost.
COM-007State which training and support services are included and which are charged separately.
Why it matters. Operational adoption and support need to be included in the cost comparison.

Growth and contract assumptions

COM-008State pricing for additional users, modules and organizational scope.
Why it matters. Growth should not create unexpected cost jumps.
COM-009State renewal terms and the basis for future price changes.
Why it matters. Multi-year planning needs visibility beyond the initial contract period.
COM-010Provide rates for services outside the quoted scope.
Why it matters. Buyers need to assess the cost of likely future assistance.
COM-011Identify exit, export and transition-assistance charges.
Why it matters. Leaving the service should be included in the total-cost assessment.
COM-012State the quotation’s currency, validity, billing schedule and tax assumptions.
Why it matters. Common commercial assumptions make competing offers easier to compare.

Buying tips

Keep the evaluation focused

Select relevant requirements

Use the catalogue as a starting point. Keep what fits the project, adapt the wording and remove the rest before you issue the RFP.

Involve occasional users

Ask how people who are not full-time system users will vote, review and complete assigned work, and what licence that requires.

Watch administrators configure

Ask customer administrators to perform real configuration tasks during a demonstration, rather than accepting a description of what is possible.

Separate current capability from future delivery

A planned release is not the same as a capability available in the proposed solution today. Ask vendors to identify the difference.

Compare effort with subscription cost

Look at implementation, migration, configuration and ongoing administration alongside the subscription price.

For a longer look at how to run the process, read the guide to writing an ERM or GRC software RFP and the ERM software buyer’s guide.

Frequently asked questions

What is an ERM or GRC RFP?

An enterprise risk management or GRC request for proposal explains the capabilities an organization wants from risk, compliance or related software and gives vendors a consistent way to respond. These templates are a starting catalogue and an instructions document you adapt. They are not a finished specification.

What do I receive?

An editable Excel requirements and vendor response workbook, plus a Word template for your RFP overview and instructions. The workbook includes buyer guidance, vendor information, attestations and six optional demonstration scenarios.

Can I use these templates for an ERM-only project?

Yes. Start with Platform and ERM, and review Security and data, Implementation and Commercial for your scope. Remove other modules you do not need. Basic links to business objectives remain relevant even if you omit deeper strategy planning.

Do I need to include every requirement?

No. Use the requirements as a starting catalogue. Keep the ones that matter, adapt the wording and add specific needs. Mark unwanted rows Exclude while preparing the workbook, then remove them from the copy you issue to vendors.

Can I use my own name and logo?

Yes. The Word template includes editable placeholders for your organization, logo, project details and procurement instructions. Both files identify buyer-only guidance to remove before sharing them with vendors.

Is the compliance section limited to IT security frameworks?

No. It includes requirements for regulatory and IT compliance, country-specific and custom frameworks, controls, evidence, libraries and regulatory-change review. Ask each vendor to explain the jurisdictions, content and monitoring services it supports.

Do these templates calculate vendor scores?

No. The workbook collects consistent responses and comments. The Word template provides an evaluation structure and weights for you to adapt. Record your evaluation scores separately and validate important claims through evidence and demonstrations.

Do I need to provide an email address?

You can browse the requirements on this page without providing your details. A work email, name, and company are required to download the editable Excel and Word files.

Does the template describe everything available in Essentials?

No. It is a catalogue of capabilities to evaluate against your needs, not a product specification. Inclusion of a requirement does not mean Tracker Networks or another vendor offers that capability. Ask vendors to identify current coverage, limitations and any proposed future delivery.

This template provides general guidance and is not a substitute for legal advice or your organization’s procurement policies. It may not address every requirement relevant to your organization. Review and adapt it to your circumstances, and independently verify vendor responses before selecting a solution.

The requirements describe capabilities to evaluate based on common organizational needs. Their inclusion does not represent a statement or commitment that Tracker Networks or any other vendor offers those capabilities.

Build your ERM or GRC RFP

Start with editable requirements, practical buyer guidance and a matching Word template. Keep what matters and make the package your own.

Get the free templates

Essentials products

Customer ratings are for Essentials, not this template

G2 Winter 2026 badges below refer to Essential ERM. They do not rate these RFP templates. A product demo is optional and does not replace the files.

Watch a product demo