Getting Oriented — Who’s In the Room?

• Who from your team will participate in this project and what are their primary decision areas (title and top responsibility)?
• How soon does leadership expect a remediation plan after an exam comment—what’s the target milestone? Options: Immediately (weeks), Quarter, By next exam cycle (6–12 months), No fixed deadline
• Which regulator(s) raised the scoring/aggregation issue and have they provided written acceptance criteria or examples? Options: OCC/FRB, State insurance regulator, NYDFS, FDIC, Other, No specific criteria provided
• On a scale from 1–5, how urgent is demonstrating enterprise aggregation capability to avoid escalation (1 = low, 5 = critical)? Options: 1, 2, 3, 4, 5
• What’s the single thing you most want the platform to prove in the first 90 days?

If This Fails, What Will Break the Board’s Trust?

• When auditors or examiners ask for a consolidated heat map in 48 hours, what typically prevents you from delivering one today?
• Describe a recent situation where inconsistent scoring masked (or nearly masked) a concentration—what happened and what were the consequences?
• Which stakeholders would be most impacted if we cannot produce regulator‑acceptable evidence within your required timeline? Options: CRO, Head of ERM, Internal Audit, CIO, CEO/Board, Business Unit Heads
• How does this regulatory pressure make you feel about the ERM program’s credibility right now? Options: Confident we’ll fix it, Concerned but hopeful, Stressed/urgent, Frustrated with internal process
• What would a reputational or regulatory failure look like for your institution—financial exposure, enforcement action, board censure, or something else? Options: Financial loss, Formal enforcement action, Board reprimand, Operational disruption, Other

Where Does Your Risk Data Actually Fall Apart?

• Which single data source or process creates the biggest barrier to enterprise aggregation today? Options: Spreadsheets, Local databases, Point GRC tools, Manual survey process, No central source
• List the systems and files currently holding risk registers and assessments (include spreadsheets, platforms, ERM tools, ticketing systems).
• How many unique scoring models exist across your business units (ballpark)? Options: 1 (consistent), 2–3, 4–6, 7–10, More than 10, Unknown
• Which attributes are inconsistent across registers (choose all that apply)? Options: Likelihood scale, Impact scale, Taxonomy/labels, Inherent vs residual definitions, Control effectiveness scoring, Other
• Walk me through the current workflow from identifying a risk to producing a board slide—where are the manual handoffs or approvals?

Who Really Owns the Definition of Risk Here?

• If we had to settle the enterprise taxonomy today, who must have final sign‑off and why? Options: Internal Audit, CRO, Head of ERM, CIO, Risk Committee/Board, Legal/Compliance
• How often do business units negotiate or override taxonomy or scoring—what triggers those exceptions? Options: Never, Rarely, Occasionally, Often, Constantly
• Describe a recent taxonomy disagreement—what were the differing viewpoints and what broke the stalemate (if anything)?
• What governance artifacts would satisfy Internal Audit that taxonomy changes are controlled (e.g., change log, owner approvals, versioning)? Options: Change log, Formal sign‑off workflow, Periodical review calendar, Audit trail in tool, Other
• How adaptable do you need the taxonomy to be—stable for years, periodically updated, or highly dynamic? Options: Stable (years), Periodic (annual), Dynamic (quarterly or event‑driven)

What Would a Trusted, Board‑Ready Heat Map Actually Change?

• If you could hand the board a heat map you fully trusted, what three decisions would that enable differently at the next meeting?
• Which success signals matter most—time to produce (e.g., 48 hours), audit evidence completeness, drill‑down capability, or regulator acceptance? Options: 48‑hour production, Full audit trail/evidence, Drill‑down to business unit level, KRI integration/real‑time indicators, Regulator acceptance
• What level of granularity does the board expect (enterprise only, entity + enterprise, or down to process/owner level)? Options: Enterprise only, Entity + enterprise, Entity + process/owner level
• How should the heat map tie into loss events and KRIs to change the conversation from descriptive to predictive?
• What acceptance criteria would Internal Audit and regulators use to declare the heat map 'board‑ready'?

What Exactly Would We Need to Build to Satisfy You?

• Which solution components are non‑negotiable for you (pick all that apply)? Options: Taxonomy configuration, Unified scoring engine, Historical data migration, KRI dashboards, Integrations to core systems, Audit evidence export
• How much historical assessment data must be migrated for meaningful trend analysis? Options: None (start fresh), 1 year, 2–3 years, 4–6 years, Full historical archive
• Which upstream systems must integrate for KRIs or auto‑scoring (select all that apply)? Options: Loss reporting system, Incident management, Financial systems, HR/operational systems, Third‑party risk platform, None/Manual only
• What training and enablement will make risk owners actually use a new platform instead of reverting to spreadsheets? Options: Role‑based training, Hands‑on workshops, Embedded champions, SLA/ownership agreements, Ongoing coaching
• What would you consider the minimum viable acceptance criteria for a pilot or proof of value?

What Will Block Us Even If the Tech Works?

• Which internal obstacles worry you most—governance disputes, data quality, resourcing, or CIO/IT pushback? Options: Governance disputes, Poor data quality, Limited resources, CIO/IT constraints, Change fatigue, Other
• Have you attempted a similar consolidation before? If so, what killed it or stalled momentum?
• Who must be engaged during implementation to avoid last‑minute refusals (names, teams, and their decision authority)?
• How much time can ERM owners realistically commit during the configuration phase (hours per week per owner)? Options: <2 hours, 2–5 hours, 5–10 hours, 10+ hours
• What data quality issues do you anticipate (missing fields, inconsistent units, duplicate records, other)? Options: Missing fields, Inconsistent scales/units, Duplicate records, Outdated records, Other

Proving It Works — What Will You Need to See?

• What specific acceptance tests should we run before you sign off (examples: 48‑hour heat map, drill to business unit, audit export)? Options: 48‑hour heat map, Drill to BU level, Audit evidence export, Regulator scenario response, KRI live dashboard
• Who will own the checklist of acceptance criteria and who signs when tests pass?
• If a test fails, what remediation approach is acceptable—fix now, fix later with compensating evidence, or rollback? Options: Immediate fix, Fix later with evidence, Rollback and reassess, Other
• How will Internal Audit validate evidence from the platform—do they need direct access, extracts, or attestation reports? Options: Direct access, Scheduled extracts, Attestation reports, Ad hoc exports
• What timeline is acceptable for reaching full acceptance from pilot to enterprise‑wide roll‑out? Options: <3 months, 3–6 months, 6–12 months, 12+ months

Contract, Budget & The Tiny Things That Stop Big Projects

• Who controls budget approval and procurement—what is the approval cadence and thresholds?
• What commercial terms are deal‑breakers for you (e.g., SLAs, data residency, termination clauses)?
• What evidence or assurances will CIO/IT require to greenlight integrations (security review, SOC reports, API docs)? Options: SOC 2/ISO reports, Security architecture review, Pen test results, API documentation, Other
• If we can deliver an agreed pilot that satisfies acceptance criteria, what internal step after that most often delays contracting (legal review, procurement, budget cycle)? Options: Legal, Procurement, Budget cycle, Board approval, No typical delay
• Realistically, what date would you want the pilot to start and who needs to be ready on day one?

Commitment Check — Where Do You Want to Land?

• Based on this conversation, what would you consider a successful outcome at the end of our engagement?
• Which level of commitment are you prepared to make now (pilot only, pilot + roadmap, immediate enterprise contract)? Options: Pilot only, Pilot + roadmap, Immediate enterprise contract, Undecided
• What single assurance or deliverable would make you comfortable advancing to a pilot today?
• Are there any internal stakeholders we should speak with next to accelerate alignment? Please list names and roles.
• Is there anything we haven’t asked that would help you feel understood and confident we can solve this problem?

Start Here — A Fast Snapshot of Your Current State

• Who on your team is the primary decision owner for choosing an ERM platform? Options: Chief Risk Officer (CRO), Head of ERM, Internal Audit Lead, Chief Information Officer (CIO), Chief Compliance Officer, Other
• How many legal entities / business units need consolidated enterprise reporting today? Options: 1–3, 4–10, 11–25, 26–100, 100+
• Which existing tools or formats are currently used as your primary risk registers and heat maps? Options: Multiple Excel spreadsheets, Shared network drives (Excel/CSV), Point solutions (e.g., risk register tools), GRC suite (partial), PowerPoint only, Custom in-house app, Other
• Roughly how long does it take your team to produce a consolidated, board-ready enterprise heat map from initial request to delivery? Options: Under 24 hours, 24–48 hours, 3–7 days, 2+ weeks, We cannot produce one reliably
• Tell us one recent example (date and brief context) when you needed consolidated risk reporting and the process broke down.

If Your Risk Data Could Speak, Would It Tell the Truth?

• When you try to aggregate risk scores across units, how confident are you that the numbers are comparable? Options: Very confident, Somewhat confident, Doubtful, Not confident at all
• Describe a specific instance where inconsistent scoring masked a material concentration or risk signal.
• Which dimensions tend to be inconsistent across registers (pick all that apply)? Options: Likelihood definitions, Impact scales, Risk taxonomy labels, Control effectiveness scoring, KRI thresholds, Time horizons, Other
• How does it feel internally when regulators point out inconsistency—embarrassment, defensiveness, urgency, paralysis, or something else? Options: Urgency to act, Embarrassment/defensiveness, Confusion about next steps, Acceptance as 'business as usual', Other
• Who typically owns reconciliation work when two business units report conflicting scores for nominally the same risk? Options: Business unit risk owner, ERM team, Internal audit, CRO, No one (it stays unresolved)

Where Things Break When the Board Calls

• When the board requests a heat map in 48 hours, what is the single biggest bottleneck you face? Options: Collecting spreadsheets, Standardizing scoring, Validating data quality, Getting sign-offs, Producing board-formatted visuals, Other
• Walk me through the exact steps your team takes when that urgent board request arrives—who does what, and how long each step takes?
• How often in the past 12 months have you missed the board’s timeline for an enterprise heat map? Options: Never, 1–2 times, 3–5 times, More than 5 times
• Which stakeholders usually cause the most delay (select all that apply)? Options: Business unit risk owners, ERM team, IT/CIO, Internal audit, Legal/Compliance, External consultants, Other
• When deadlines slip, what are the downstream consequences you worry about most (regulatory findings, board distrust, missed concentrations, etc.)?

The Spreadsheet Web — Who’s Tied Together and Who’s Not

• How many distinct spreadsheet templates or register formats are in active use across the firm? Options: 1, 2–5, 6–10, 11–25, 25+
• Do different lines of business use different taxonomies or risk categories? Options: Yes — completely different taxonomies, Partially — same high‑level categories, different detail, No — consistent taxonomy, Not sure
• What specific fields or columns are most often missing or inconsistent when you try to merge registers?
• Which of these scoring approaches are currently used in your assessments (select all that apply)? Options: Numeric scales (1–5), Likert-style descriptors (Low/Med/High), Financial impact bands, Qualitative only, Custom formulas per BU, Other
• If you had to estimate, what percent of your enterprise risk inventory requires manual normalization before consolidation? Options: 0–10%, 11–25%, 26–50%, 51–75%, 76–100%

Data Lineage — Can You Trust the Numbers You’re Reporting?

• Which systems feed risk-related data today (loss events, controls, KRIs, incidents, financial exposures)? Options: Core banking/insurance systems, Data warehouse/EDW, GRC tools, Operational dashboards, Manual uploads/spreadsheets, Third-party vendors, Other
• How frequently are KRIs and source-system indicators refreshed for your current reporting? Options: Real-time, Daily, Weekly, Monthly, Ad hoc/manual
• Tell us about your top three data quality pain points (e.g., missing timestamps, mismatched identifiers, stale values).
• Which of these best describes your current integration posture? Options: API integrations available, Batch ETL to data lake, Manual CSV imports, No integrations — everything manual, Hybrid (some automated, some manual)
• How tolerant is leadership of data gaps when preparing regulator responses or board reports? Options: Intolerant — demand full traceability, Some tolerance with documented assumptions, Accepts best-effort summaries, No clear stance

Who Pulls the Strings — Governance, Roles, and Decision Gaps

• Who has final authority to change the enterprise risk taxonomy or scoring model? Options: CRO, Head of ERM, Risk Governance Committee/Board, CIO/IT, Internal Audit (advisory), No single owner
• Describe how a taxonomy change request travels from a business unit suggestion to enterprise approval.
• Which governance artifacts do you currently have (select all that apply)? Options: Formal taxonomy decision log, Change request process, Versioned scoring definitions, Approval committee charters, Audit trail for changes, None of the above
• How aligned are first-line risk owners with the ERM team on what ‘high’ or ‘critical’ actually means? Options: Very aligned, Mostly aligned, Some misalignment, Significant misalignment
• What would happen if a major taxonomy change were applied tomorrow without stakeholder signoff—operationally and politically?

If We Could Fix One Thing This Quarter, What Would Actually Change the Game?

• If one intervention could make you reliably produce a board-ready heat map within 48 hours, what would that intervention be? Options: Unified taxonomy and scoring, Automated data ingestion from key sources, Pre-built board reporting templates, Clear governance and approval workflows, Training and adoption program, Other
• What measurable success signals would convince the CRO and the board that the ERM platform fixed the core problem? Options: Board-ready report in 48 hours, Reduction in manual consolidation time by X%, Single reconciled enterprise risk register, Audit evidence trail available for all items, Regulator acceptance without remediation requests, Other
• What are the top three risks to delivering that intervention within 3–6 months (people, data, governance, budget)?
• Who must be involved from your side to make that change stick (names/roles), and who would actively block it?
• How ready is your organization to begin a configuration and migration effort within the next 60–90 days? Options: Ready — budget and owners in place, Ready if we get governance sign-off, Needs additional internal alignment, Not ready this quarter

Warm-up: Who’s in the Room (and Who Decides)?

• Who will be our primary day‑to‑day contact for configuration and cutover decisions? Options: CRO, Head of ERM, ERM Program Manager, CIO/IT Lead, Internal Audit Lead, Other
• Which person or group holds final authority for taxonomy decisions that affect enterprise aggregation? Options: Head of ERM, CRO, Audit Committee, CIO/Architecture Board, Regulatory Affairs, Shared governance
• What are the typical availability windows (days/times) for your ERM owners during the next 8 weeks? Options: Business hours (M–F), Evenings available, Intermittent (ad hoc), Only by appointment, Uncertain / needs coordination
• Tell us who else needs to be included in configuration decisions (names/roles) and how they prefer to be engaged.

If We Can’t Get the Data, Nothing Else Matters

• What gives you confidence right now that the risk and loss‑event data we need is actually accessible? Options: Clean single system with APIs, Multiple systems with API/ETL access, Primarily spreadsheets, Third‑party vendor data, Unsure / need discovery
• List the primary source systems or files that hold risk assessments, KRIs, and loss events (system name + owner).
• Do you have any pre‑existing data access restrictions or approvals (e.g., legal, InfoSec, vendor contracts) we should plan for? Options: Yes—legal/vendor, Yes—InfoSec approval, Yes—privacy/PII restrictions, No known restrictions, Unsure
• Can you provide a representative sample extract from each source system (or indicate if we need to request help)? Options: Full sample available, Subset available, Only aggregated reports, No samples available—need assistance
• If samples are available, how are they delivered today (CSV, API, database access, manual export)? Options: CSV/Excel export, API endpoint, Direct DB access, SFTP drop, Manual copy/paste

Where the Numbers Might Betray You

• Which of these data quality problems show up most often in your risk registers? Options: Missing values, Inconsistent scoring scales, Duplicate records, Stale/old assessments, Taxonomy mismatch, None of the above
• How frequently do data quality issues materially change an aggregated view (e.g., board heat map) when corrected? Options: Almost always, Often, Sometimes, Rarely, Never / unknown
• Describe any current reconciliation or data‑cleansing processes and who is responsible for them.
• What tolerance thresholds would you accept for missing or conflicting data during initial go‑live (e.g., % missing, allowed score variance)?
• Which tools or teams currently perform data validation (e.g., ETL team, GRC tool, BI team, manual reviewers)? Options: ETL/Data engineering, BI/Analytics, First‑line business owners, Internal audit, No formal validators

Can We Trace It Back to Source (Lineage and Auditability)?

• Can a board‑level risk score today be traced back to the originating assessment or transaction? Options: Yes—fully auditable, Partially—some links exist, No—cannot trace, Unsure
• Do you maintain a data dictionary or field catalog for risk/assessment fields? If yes, how current is it? Options: Comprehensive and current, Partial and outdated, Exists but not accessible, No data dictionary
• What unique identifiers or keys (e.g., assessment ID, business unit code) consistently link records across systems?
• Are audit trails required at the field level (who changed what and when) for regulator/audit evidence? Options: Yes—field level required, Yes—transaction level only, No, summary changes OK, Unsure
• Who will be responsible for resolving lineage or mapping conflicts during configuration? Options: ERM owner, Data owner, IT/Integration team, Joint governance group, Other

Access & Security: Are the Keys in the Right Hands?

• What security controls must be satisfied before we can access production or test data (SSO/SAML, IP allowlist, NDA, SOC2 evidence)? Options: SSO/SAML, IP allowlist/VPN, NDA/Data processing agreement, SOC2/ISO evidence, Other
• Is there an approved test environment we can use that mirrors production data (masked) for configuration and UAT? Options: Yes—masked test env, Yes—subset of production, No—only production, Unsure
• Who in InfoSec/IT will own provisioning and approval, and what is their typical SLA for access requests?
• Are there regulatory or privacy constraints (PII, cross‑border rules) that limit what data we may migrate or process? Options: PII present—must mask, Data residency constraints, Vendor processing limits, No known constraints, Unsure
• If encryption, masking, or tokenization is required, who will own that work and what tools are available?

Integration Reality Check: What Actually Hooks Up?

• Which integration patterns are feasible for each source (API, direct DB, SFTP, manual upload)? Options: API, Direct DB, SFTP/flat file, Manual Excel upload, Middleware/ETL
• Are there any vendor or legacy systems that historically resist automated integration and require special handling? Options: Yes—legacy system(s), Yes—third‑party vendor, No—systems are integration‑ready, Unsure
• What are the expected data refresh cadences for KRIs and assessments (real‑time, hourly, daily, weekly, monthly)? Options: Real‑time/streaming, Hourly, Daily, Weekly, Monthly, Ad hoc
• Which authentication methods do your APIs/supporting systems require (OAuth, Basic, Cert‑based, Windows Auth)? Options: OAuth2, API Key/Basic, Client certificate, Windows Auth/AD, Other
• What maintenance windows or blackouts should we avoid when scheduling integrations and migrations?

Migration & Historical Data: How Far Back Do We Need To Go?

• If the board asked for a multi‑year trend, can you produce the historical records needed for 3–5 years? Options: Yes—full history, Partial history available, Only recent 12 months, No historical records
• Which historical sources are most likely to require manual transformation or enrichment? Options: Spreadsheets, Legacy DBs, Archived reports, Third‑party exports, None
• What business rules should we apply to historical records (e.g., normalize scoring scales, map legacy taxonomies)?
• Who will sign off that historical data is acceptable for trend analysis and board reporting? Options: Head of ERM, CRO, Internal Audit, CIO/Data Owner, Joint signoff
• Are there retention policies or legal holds that prevent migration or deletion of older records? Options: Yes—retention policy, Yes—legal hold, No constraints, Unsure

Acceptance & Remediation: What Will Make This Ship?

• What does 'board‑ready' look like for you—what specific deliverables and timelines must be met (e.g., heat map in 48 hours)?
• Which specific acceptance tests must pass before configuration is considered complete (heat map accuracy, audit evidence, regulator scenario response)? Options: Board heat map accuracy, Field‑level audit trail, KRI feed accuracy, Regulatory scenario simulation, Performance/load tests
• Who will own user acceptance testing and remediation tracking, and what is their expected bandwidth? Options: Internal Audit, ERM Owners, IT/Integration, Dedicated UAT team, Other
• If tests fail, what is the governance for remediation (priority triage, SLA for fixes, escalation path)?
• Are there regulatory acceptance criteria (examiner expectations) we must explicitly demonstrate during deployment? Options: Yes—specific examiner criteria, Yes—general regulator standards, No explicit criteria, Unsure

People & Change: Who Will Make It Stick?

• What is your plan for onboarding and training first‑line risk owners after configuration? Options: Train‑the‑trainer, Role‑based workshops, Self‑service materials, Blended approach, No formal plan yet
• How many active users (estimate) will need access in the first 6 months, and which roles will they fill? Options: <25, 25–100, 100–500, >500
• What adoption risks worry you most (over‑engineered taxonomy, low first‑line uptake, competing priorities)? Options: Taxonomy complexity, Low business adoption, Insufficient resourcing, Executive buy‑in, Other
• Who will chair the governance cadence for taxonomy/version decisions post‑go‑live (role and expected meeting frequency)?
• What success metrics (beyond board‑ready heat maps) will you use to judge deployment impact in the first 90 days? Options: Time to produce heat map, Number of consolidated assessments, Reduction in manual reconciliations, User adoption rate, Regulatory feedback

Quick Check: Who's In The Room?

• Who will own the platform decision and contract signature? Options: Chief Risk Officer (CRO), Head of ERM, CIO/IT, Chief Audit Executive/Internal Audit, Procurement, Other - please specify
• Which stakeholders must be able to produce a board-ready heat map on short notice? (select all that apply) Options: CRO, Head of ERM, Internal Audit, Board Chair/Committee, Business Unit Heads, CIO/IT, Compliance/Legal, Other
• How urgent is regulatory remediation on a scale from 'informational' to 'must resolve before next exam'? Options: Informational — note only, Operational observation — recommended improvements, Material finding — remediation required before next exam, Cease-and-desist level / escalated to senior management
• When the board asked for a heat map in 48 hours, what actually happened—briefly describe the last time you tried to do this
• Who is the day-to-day owner responsible for assessments and taxonomy decisions? Options: Head of ERM, Enterprise Risk Manager, Business Unit Risk Lead, Internal Audit Liaison, Other - specify
• Which best describes your organization's appetite for centralizing taxonomy and scoring now? Options: Immediate and mandatory, Supportive but needs business buy-in, Cautious — prefer incremental pilots, Opposed — prefer decentralized control

Are You Comfortable Not Seeing the Whole Picture?

• If inconsistent scoring is hiding concentration risk, how confident are you that current reports surface those concentrations before a loss? Options: Very confident, Somewhat confident, Not confident at all, We don't know
• How often have scoring inconsistencies or aggregation failures led to a missed risk signal or delayed decision in the last 24 months? Give a specific example if possible.
• What emotions does the team feel when an exam finding highlights inconsistent risk registers? (select all that apply) Options: Anxious, Embarrassed, Driven to act, Overwhelmed, Indifferent, Defensive
• When you imagine failing to find a hidden concentration, what would be the most consequential outcome for your institution? Options: Regulatory sanctions/fines, Reputational damage with board/shareholders, Financial loss from undetected concentration, Operational disruption, Other — specify
• How long have you been accepting manual spreadsheet consolidation as 'good enough'? Options: Months, 1–2 years, 2–5 years, More than 5 years
• Describe any internal tensions you anticipate when attempting to enforce a single taxonomy across business units.

What's Really Breaking When You Try to Aggregate?

• Which do you believe is the primary root cause of aggregation failure: taxonomy, data quality, or process—and why? Options: Taxonomy mismatches, Poor/fragmented data quality, Manual workflows and human error, Lack of ownership/governance, Tooling limitations, Combination — explain in comments
• Where do scoring methodologies diverge most often across units—likelihood, impact scales, calculation formulas, or risk categories? Options: Likelihood definitions, Impact scales/thresholds, Scoring formulas/weighting, Risk category labels/taxonomy, All of the above
• Which source systems feed your risk registers today? (select all that apply) Options: Local spreadsheets, Shared network drives, GRC / risk tools, Incident management system, Claims or loan systems, Data warehouse/BI, SaaS point tools, Other
• How consistent is your field-level data (naming, units, frequency) across those sources? Options: Highly consistent, Mostly consistent with some exceptions, Inconsistent and requires mapping, Unknown
• What percent of your historical assessments would you estimate are usable without remediation for migration? Options: >75%, 50–75%, 25–50%, <25%, Unknown — need to evaluate
• Describe a recent example where a manual workflow or spreadsheet formula created an unexpected distortion in aggregated risk metrics.

How Much of This Is Cultural, and How Much Is Technical?

• Who currently gets to decide how a risk is scored or categorized in your organization—are decisions local, centralized, or shared? Options: Local business units decide, Central ERM defines and enforces, Hybrid — central taxonomy with local extensions, Governance committee decides
• If the platform required removing local custom scales to achieve enterprise aggregation, how would the business react? Options: Supportive, Reluctantly compliant, Resistant and political, Refuse — would need executive mandate
• What incentives or governance levers currently influence how business units complete assessments? Options: Performance metrics tied to risk outcomes, Budgeting/resource allocation, Regulatory reporting pressure, Internal audit recommendations, None/unclear
• How much time and senior sponsorship can you realistically expect to spend on taxonomy decisions over the next 90 days? Options: Daily engagement, Weekly working sessions, Monthly steering meetings, Ad hoc — low availability
• Who would have final sign-off on taxonomy and scoring rules for regulator acceptance? Options: CRO, Head of ERM, Internal Audit, Board Risk Committee, CIO/CTO, Cross-functional governance committee
• What has historically convinced teams to adopt centralized change—data, audit findings, incentives, or leadership edict? Provide an example.

Imagine a Board-Ready Heat Map in 48 Hours — What Changes?

• If you could reliably produce a regulator-acceptable, board-ready heat map in 48 hours, what would that free your team to do next?
• Which specific success signals would convince the board and examiners that assessments are now enterprise-ready? (choose up to 3) Options: Board-ready report in 48 hours, Unified scoring across entities, Audit trail for every assessment, KRI dashboards linked to systems, Regulator-signed acceptance criteria, Reduced manual hours for consolidation
• What audit evidence must be demonstrable (e.g., timestamped assessment history, user permissions, data lineage)? Please list essentials.
• How will you measure adoption success after deployment? Options: % Assessments completed on platform, Reduction in manual consolidation hours, Time to produce board report, User satisfaction/engagement, Number of governance exceptions
• Which regulator scenarios should we include in acceptance tests to feel comfortable (e.g., ORSA aggregation, OCC heightened scrutiny, NYDFS data traceability)? Options: ORSA-style aggregation, Consolidated enterprise concentration scenario, Audit evidence request scenario, Regulatory stress/event response scenario, Other — specify
• Describe the one visual or data element the board would immediately understand and value in that 48‑hour heat map.

What Would Implementation Look Like Day-to-Day?

• If we deployed a pilot tomorrow, which integrations would need to be in place for it to be meaningful? Options: SFTP/flat-file imports, APIs to source systems, Data warehouse / ETL, Claims/loans systems, Identity/access management, BI/reporting tools, Other
• Who on your team will be responsible for mapping and cleansing source fields during migration? Options: ERM data manager, IT/data engineering, Business unit data owners, External integrator/consultant, Combination — please specify
• What historical window is required for audit and trend analysis to satisfy regulators—12 months, 24 months, longer? Options: 12 months, 24 months, 36 months, As long as available / indefinite
• What data quality thresholds do you require before accepting imported assessment data (e.g., % complete, valid enums, no orphan records)?
• What training model works best for your risk owners—live workshops, train-the-trainer, recorded modules, or embedded in-app guidance? Options: Live instructor-led, Train-the-trainer, Recorded on-demand, Embedded in-app walkthroughs, Combination
• What practical constraints (budgets, headcount, scheduled audits) could slow a 90-day pilot?

If We Start Small, What Win Changes the Conversation?

• What is the smallest viable pilot scope that would prove enterprise aggregation is possible? Options: Single business unit + central ERM, Cross-entity aggregation for one risk domain (e.g., operational risk), End-to-end board report for a single risk family, Audit evidence walk-through for one past exam finding
• What short-term metrics would you use to declare the pilot a success? Options: Board-ready report produced within target time, Reduction in manual consolidation hours, % assessments completed via platform, Positive internal audit review, Regulatory acknowledgement
• What minimal executive commitment (time or approvals) is required to run that pilot? Options: Weekly steering meetings, Monthly executive check-in, Single executive sponsor with delegated authority, Formal governance approval
• Which internal objections are you most likely to face during a pilot—loss of local control, data exposure concerns, workload increase, or others? Options: Loss of local control, Data privacy/security concerns, Increased workload for BAU teams, Skepticism about value, Other — specify
• If the pilot fails to show value, what fallback or remediation would need to be in place to avoid reputational/regulatory damage?
• Who should be the single point of contact from your side to keep momentum and remove blockers? Options: CRO, Head of ERM, Project Manager (ERM), IT lead, Other — specify

Validation & Acceptance: How Will You Know It's Right?

• What would make an acceptance test fail in your view—missing audit trail, inconsistent scores, or something else? Options: Missing audit trail / history, Inconsistent or unmapped scores, Inaccurate data aggregation, Performance/latency issues, User access/permissions gaps, Other — specify
• Which of these acceptance checkpoints do you require before production cutover? (select all that apply) Options: Data reconciliation reports, Regulatory scenario walkthrough, Internal audit sign-off, User acceptance testing by business owners, Performance/stress testing, Training completion certificates
• Describe an example regulator evidence request you want us to include as a test case.
• Who will sign the acceptance form (single role) when the platform meets your criteria? Options: CRO, Head of ERM, Internal Audit, CIO, Governance Committee Chair
• After go-live, what cadence should we use to validate continuing compliance—monthly, quarterly, or event-driven? Options: Monthly spot checks, Quarterly governance review, Event-driven (after significant incidents or exams), Combination
• What remaining concerns would prevent you from giving final approval even if tests pass (e.g., budget, politics, competing projects)?