Guide: Prepping for your first audit with GRC as the 'source of truth'.

Just starting with ServiceNow GRC. My team wants to use it as the single source of truth for an upcoming SOC 2.

I'm skeptical. Heard it's a beast to set up. My main worry is cost creep—needing ten extra modules just to make the basic audit workflow function.

What's the bare minimum to actually run an audit from start to finish? I don't want fancy risk heat maps, just a clear path from control evidence to auditor review without manual spreadsheets.

Specifically:
- Which GRC applications are absolutely mandatory?
- What's the biggest time sink in prepping the instance?
- Any hidden costs like additional ITSM licenses for evidence collectors?