A city wants Policy and Compliance, Risk, Audit, Vendor Risk, and BCM all live in ninety days for every department. What should the implementer recommend for phase one?
Select an answer to reveal the explanation.
Short Explanation
Big-bang for five products across every department is a carnival, not a plan. Pick one clear use case—one rulebook, one business slice—prove it, then grow. Phased scope beats a ninety-day miracle tour.
Full Explanation
Implementation planning should bound the first use case—for example one regulation and one business area—before expanding apps and departments. A city demanding Policy and Compliance, Risk, Audit, Vendor Risk, and BCM live in ninety days for every department is staging a carnival, not a plan. Phased scope lets entities, content, owners, and attestations be proven before multi-app expansion and protects scarce change-management bandwidth. Early wins on a narrow, material obligation build credibility for later waves. Activating every IRM-adjacent plugin and onboarding all departments on day one without prioritization multiplies data and training failure modes. Skipping entities and loading only executive dashboards until after go-live produces empty charts with no governed population. Replacing IRM with a CIS-SIR playbook rollout for the same window answers incident response, not the requested GRC suite outcomes. Exam caveat: planning items reward bounded phase-one use cases over big-bang multi-product citywide launches. Operational check for the city: write a phase-one charter naming one obligation, one department or service line, required IRM apps only, success metrics for scoped tests, and an explicit backlog for later apps—then refuse ninety-day “everything” scope in steering committee.