Governance scope
Cover the actual portfolio, legal entities and uses.
Match oversight intensity to impact and role.
A subsidiary's independently procured system may still create group risk. Avoid assuming central policy reaches every operation.
Record exclusions and the reason for them.