Centvra
Menu

Guide · GRC software buying

Why GRC Software Projects Can Take Months to Get Started

A successful demo can make a project feel ready to start when months of work still lie ahead.

Before you commit to a start date, work out what still needs to happen and who owns each step.

Key takeaway

You'll know the sequence of steps between the software demo phase and the project start, which events in the contracting phase are most likely to stall, and what to start early so they don't cause a delay.

From Demo to Project Start: Where Delays Can Arise

01 See the journey

Months can pass between the demo
and the first day of the project.

Choosing the software, approving the purchase, signing the contract and starting the project are separate steps, often owned by different people. The timeline below shows the usual order and where plans most often stall.

How to read the ranges: These are indicative Centvra planning ranges, not supplier commitments or industry benchmarks. Some steps overlap, so don't add them together.

Product evaluation and software demos

1–3 months

Gathering requirements, seeing initial demos and narrowing the shortlist. Early demos usually use sample data, so no confidentiality agreement is needed yet.

Non-Disclosure Agreement (NDA)

2–5 business days

Signed before either side shares requirements, security evidence or pricing in detail.

Supplier proposals

The route depends on your organisation's buying rules.

Proposal review

1–3 months

Shortlisted suppliers submit proposals, which are compared and approved without a full tender.

Formal request for proposal (RFP)

3–6 months

Covers written requirements, formal supplier responses, scoring and approval of the result.

IT and security checks

Review: 1–2 weeks

In a formal RFP, these are often part of the supplier's response. In a proposal review, they usually run alongside it. Either way, they need to finish before a supplier is chosen.

Key milestone

Preferred supplier selected

The decision is made, but the project can't start until the steps below are complete.

Common bottleneckSeveral weeks to months

Contract, scope and data protection reviews

The Master Services Agreement (MSA), Statement of Work (SOW) and, where personal data is involved, the Data Processing Agreement (DPA) can be reviewed together. Delays build up when changes go back and forth, the scope isn't settled or decisions need senior sign-off.

Using an outside implementation partner? If you hire the system integrator yourself, expect a second contract and SOW to review and sign.

Common bottleneck1–3 weeks

Order form and purchase approval

Late changes to licences, pricing or services can trigger another budget check or a fresh approval.

All required contracts signed

Including the partner's contract if you hired one separately.

Key milestone · After signingAllow around 4 weeks

Project team setup

Supplier onboarding, releasing the purchase order, assigning the team and preparing the kick-off.

Your organisation may have extra legal, procurement or approval steps that push the timeline further.

02 Know the documents

Each contract is a step
that can hold up the start.

Most of the bottleneck time goes into reviewing, changing and approving these documents. Knowing what each one covers helps you get the reviews moving early.

What each document is for, and who is often involved

Document
What it is for
Teams often involved
Non-Disclosure Agreement (NDA)
Keeps information shared during evaluation confidential.
Legal, Procurement
Master Services Agreement (MSA)
Sets the main legal and commercial terms between you and the supplier.
Legal, Procurement, Finance, senior approvers
Data Processing Agreement (DPA)
Sets out how the supplier handles personal data on your behalf, where data protection law requires it.
Privacy, Legal, Information Security
Statement of Work (SOW)
Describes the implementation work: what will be delivered, who does what, and how completed work is signed off.
Business sponsor, project lead, IT
System Integrator Agreement and SOW
Covers the implementation partner's work if you hire the partner yourself. Document names may vary.
Procurement, Legal, project lead
Order Form
Lists the products, licences, prices and subscription period you are buying.
Procurement, Finance

Teams and titles vary by organisation.

03 Plan the timing

Start the slow steps
before they hold you up.

Most delays come from slow steps that start too late. Getting them moving early keeps the start date on track.

01

Before the final demos

Let the teams who review security and privacy know what is coming, and tell shortlisted suppliers what evidence you'll need.

02

Before choosing a supplier

Ask for the standard contracts, identify terms you can't accept, and confirm who will do the implementation.

03

During contract reviews

Book regular review slots and keep one issues log with an owner and reply date for each open item.

04

Before signing

Confirm how the purchase order will be raised, who from your side will work on the project, and when the supplier and any partner are available.

04 Confirm the start

A signed contract does not always
mean work can begin.

Treat any proposed start date as provisional.

Your project can't start until these are in place

  • IT and security checks are cleared
  • All required contracts are signed, including the Order Form
  • The project sponsor and key team members are named and available from the start date
Ask the supplier whether their date is booked, conditional or an estimate only, and what happens to their team if your approval slips.

Planning reference: This guidance is for planning a software purchase. Which steps apply will depend on your organisation's own circumstances.

What Could Prevent Your Project from Starting on Time?

  • 01 Map who needs to approve the purchaseApprovals

    Teams often choose a supplier before knowing everyone who must approve the spend, the contract and the project start. Procurement, Legal, Privacy, Security, Finance and senior leaders may each need something different.

    Protect the start date

    List each approver, what they need and when. If ownership is unclear, requests can sit between teams while the start date slips.

  • 02 Expect several rounds of contract reviewReviews

    Contracts rarely go straight from first draft to signature. Each round of comments needs a supplier reply, an internal check and sometimes senior sign-off, while reviewers juggle other work.

    Protect the start date

    Plan for more than one round, book review time in advance and track each open item with an owner and a reply date.

  • 03 Settle how data will be handledData

    The data protection terms depend on what data the software will hold, where it is stored and who can access it. Requirements vary by country and by the type of data.

    Protect the start date

    Agree how data will flow in and out of the software before asking Privacy and Legal to approve the terms. Until that is clear, their approval is likely to stay open.

  • 04 Keep the contract and pricing documents consistentCommercial

    The main contract sets the overall terms, while the order form covers prices, licences and support. Differences on liability, renewal, termination or service levels often surface only during negotiation.

    Protect the start date

    Review the documents together and make sure anything the supplier promised during evaluation is written into one of them.

  • 05 Agree who delivers the implementationDelivery

    The software may be implemented by the supplier, by a partner the supplier hires, or by a partner you hire yourself. Hiring a partner directly adds a second contract and approval.

    Protect the start date

    Confirm the delivery arrangement before final approval, and make sure every task, from setup and data migration to testing and training, has one clear owner.

  • 06 Line up budget, purchasing and the project teamTeam setup

    Agreeing the contract doesn't automatically release the budget, raise the purchase order or secure the delivery team. Supplier and partner availability can also change while reviews drag on.

    Protect the start date

    Confirm what allows work to begin and whether the supplier's team stays booked if your approval is delayed.

Fit-based software matching

Find software that fits how your organisation operates

Tell us what the software must support, how your teams work and which delivery constraints matter. Centvra uses those inputs to build a focused supplier shortlist.

Start matchingFree to use · No paid ranking
Matching modelRequirements-led

Your operating brief

CapabilitiesWhat the software must support
Ways of workingWorkflow, ownership and scale
Delivery constraintsHosting, integration and support

Fit-based shortlist

Matched supplierFunctional fit
Matched supplierOperating fit
Matched supplierDelivery fit

Try it with your requirements

Describe your institution in plain language. Only three minutes, no signup to see your matches.

This example is ready to run or edit it to match your own situation.

Common questions

Which steps usually cause the biggest delays when buying GRC software?

If your organisation runs a formal tender, known as a request for proposal (RFP), that is often the longest stage before a supplier is chosen.

After a supplier is chosen:
· Contract negotiation is often the main legal hold-up.
· Agreeing the Statement of Work (SOW) is often the main delivery hold-up.

Which one delays you most depends on how many changes you request to the standard terms, how clear the scope is, whether reviewers are available and whether an outside implementation partner is involved.

Should we review contract terms before choosing a supplier?

Yes, but you don't need a full legal review of every shortlisted supplier. Focus on the terms that could rule a supplier out or hold up approval.

Terms worth checking early:
· Liability limits and exclusions
· Who pays if something goes wrong (indemnities)
· Ownership and use of your data
· Termination and exit terms
· Governing law
· Audit and assurance rights you are required to have

Why can contract negotiation take weeks or months?

You and the supplier may start from different contract templates and different positions on liability, data use, termination and governing law.

What slows it down: Each round of changes needs legal review, commercial input and approval from someone with the right authority.

It takes longer when reviewers are busy, no one clearly owns a decision, or the same points keep going back and forth.

How does using an implementation partner affect the contracts?

It depends on who hires the partner, also known as a system integrator.

Common arrangements:
· The supplier implements: You sign one set of contracts with the supplier.
· The supplier hires the partner: You may sign only the supplier's contract, but confirm the supplier stays accountable for delivery.
· You hire the partner: Expect a second contract and Statement of Work (SOW) to review, approve and sign.

Before confirming the start: Make sure responsibilities, sign-off criteria and availability line up across your team, the supplier and the partner.

When can we rely on the supplier's proposed start date?

Only once the IT and security checks are cleared, all required contracts are signed, and the project sponsor and key team members are named and available from the start date.

After signing: Allow around four weeks to set up the project team, then adjust for how the project will be delivered and who is available.

Ask the supplier: Is the date booked, conditional or an estimate only, and what happens to their team if your approval slips?