Menu

Prepare your GRC records for Workiva

A GRC migration is not only a list of fields. It is a set of decisions about which records operate now, which history stays retrievable, how relationships retain meaning, and how the team will know what arrived.

Download the editable workbook

Excel workbook with a fictional worked example and blank planning tabs.

Separate scope decisions from configuration

Business owners decide what must remain usable, what may be archived, what needs cleanup, who approves exceptions, and what success evidence matters.

Implementers configure the approved target structure, role model, mappings, and migration method.

Use the worked example to set the level of detail, then plan in the blank tabs

The fictional Northwind Holdings example covers inventory, semantic field and relationship mapping, preservation choices, reconciliation, and UAT. The companion blank sheets have shaded required scope/count inputs, validation alerts, dropdowns, print areas, and formulas that distinguish unresolved scope or counts, invalid counts, agreement, and exceptions.

Download the migration planner

Establish the source inventory

Name the record sets and the decisions they require.

Inventory can begin with exports, folders, current reports, and the people who use them. It should expose history, ownership, access, and quality questions early, before a target field list gives a false sense of readiness.

Control library

Capture: Active and retired controls; stable IDs; owners; evidence references

Decide: Operational scope, historical retrieval, and owner reassignment

Risks and relationships

Capture: Risk taxonomy, linked controls, assessments, and orphaned references

Decide: Relationship semantics and unresolved references

Tests, issues, and actions

Capture: Plans, outcomes, exceptions, issues, action plans, and closure records

Decide: What remains operational versus archival

Attachments and access

Capture: File classes, paths, retention, restrictions, and reviewer access

Decide: Transfer eligibility, custody, and approved access scope

Map meaning and relationships

A field can copy cleanly and still lose its meaning.

SourceBusiness meaningDecision
Control ID · AP-014Stable reference used by reviewers and historical evidenceKeep literal ID; check duplicates with retired records.
Related controls · AP-014; AP-018Risk-to-control associationConfirm chosen configuration can represent the agreed relationship; test it.
Closure evidence pathReference to source support, not automatically the attachment itselfChoose a retrieval route and access decision before transfer.

The workbook records source field, target business meaning, transformation rule, relationship/history decision, and decision state. It intentionally does not prescribe an endpoint, API, object, or import behavior.

Make preservation visible

“Not moving” needs a route, not a footnote.

  1. Migrate. The record set supports current operations and has an approved mapping and owner.
  2. Retain elsewhere. The history remains retrievable through a named archive or source route.
  3. Clean. Duplicate identifiers, departed owners, or incomplete references need a controlled resolution.
  4. Hold. Access, privacy, legal, or retention questions are unresolved. A hold is not a pass and does not authorize disposal.

Reconcile source to target

Count agreement is a starting point; exceptions need an owner.

Agree a named population, the applicable scope, and the point in time first. Enter non-negative whole-number expected and received counts for active controls, risks, open issues, tests with exceptions, and attachment-index entries approved for transfer. Matching values alone do not prove that every in-scope record arrived or that control, risk, owner, issue, and attachment relationships remained complete: inspect mappings, samples, and the UAT paths that counts cannot reveal.

Unresolved input
The named scope is blank or only spaces, or a required count is missing. The workbook does not call this a pass.
Invalid count
Text, negative values, and fractions are not valid counts; correct the input before comparing values.
Pass — values agree
A named scope and valid counts match. It is a reconciliation indicator, not proof of population or relationship completeness.
Exception — investigate
The mismatch should name a business explanation, owner, and next action.

Run practical UAT

Test the paths people will actually need.

Use agreed roles and representative historical records. A completed migration step is not evidence that a reviewer can trace a control, locate a closed issue, or see the correct attachment access.

ScenarioExerciseEvidence
Control and risk traceabilityOpen a mapped control, trace its linked risk, and verify the approved owner and stable source ID.The relationship, identity, and role access are observable.
Historical test to issueFind a prior test with an exception and follow its related issue or action plan.The reviewer can understand the conclusion and link chain.
Closed issue retrievalUse the agreed archive route to locate a closed issue and closure support.Historical retrieval works without pretending the record is operationally migrated.
Restricted attachment holdTry the agreed access test and inspect the exception record.No unintended access; source custody and decision owner are recorded.
Count mismatchCompare expected and received counts; investigate one deliberate mismatch.The exception stays visible, owned, and is not relabeled as a pass.

Bring the planner to a working session

Bring the completed inventory, open mapping choices, preservation holds, and a small set of records for UAT. Lockfield can help turn that evidence into an implementation plan.

Discuss your GRC migration

Public Workiva starting points

Workiva’s help center covers creating sample requests and reviewing sample evidence.