The key to controlling escalating costs when an organization is having new software implemented under contract is change management, which is the process of identifying, evaluating, approving, and implementing changes to the project scope, schedule, budget, or quality1. Change management can help to control escalating costs by:
* Establishing a clear and agreed-upon baseline for the project deliverables, requirements, and expectations, and ensuring that they are aligned with the contract terms and conditions2.
* Defining and enforcing a formal and consistent change control process, which includes the roles and responsibilities, the criteria and methods, and the documentation and communication of the changes3.
* Assessing and prioritizing the proposed changes, and determining their impact and feasibility, and their alignment with the project objectives and constraints4.
* Obtaining the approval and authorization of the relevant stakeholders, such as the project sponsor, the project manager, the contractor, or the customer, before implementing the changes5.
* Monitoring and measuring the performance and outcome of the changes, and ensuring that they are delivered within the agreed scope, schedule, budget, and quality6.
References =
* Change Management - CIO Wiki
* Project Scope Management - CIO Wiki
* Change Control - CIO Wiki
* Change Impact Analysis - CIO Wiki
* Change Approval - CIO Wiki
* Change Evaluation - CIO Wiki

A governance, risk, and compliance (GRC) solution is an integrated system that supports the management of governance, risk, and compliance activities across the enterprise. A GRC solution can provide benefits such as improved efficiency, consistency, transparency, and accountability. The best justification to invest in the development of a GRC solution is to facilitate risk-aware decision making by stakeholders. By providing a holistic view of the enterprise's risk profile, a GRC solution can enable stakeholders to make informed decisions that are aligned with the enterprise's objectives, risk appetite, and tolerance. A GRC solution can also help to monitor and report on the performance and outcomes of the risk management program, and provide feedback and assurance to the board of directors and senior management. The other options are not as compelling as the facilitation of risk-aware decision making, as they may not directly contribute to the achievement of the enterprise's objectives or the management of its risks. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 1, Section 1.1.2.1, pp. 12-13.

Section: Volume D