Hi there!
In my experience, governance is often considered a function of a legal department, so approaching a VP Legal, or an Ombudsman/Business Compliance Manager may be of value. They'd warm to a risk-reduction positioning, with the compelling factor of avoiding legal issues, government fines, etc.

Change Management; however, is likely driven by the functional groups, so their specific leadership (Supply Chain VP, Finance VP, etc) would be the place to start. They'd likely warm to an efficiency, cost-savings, employee productivity positioning, with the compelling factor being them getting their change in place and reaping the benefits ASAP.
I would recommend approaching the groups (functional v. legal) one at a time, starting with whichever your company feels the strongest affinity towards and positioning for. If that doesn't click, you can try the second avenue.

(I'm not quite sure what you meant by involving auditors - but would be happy to explore your question further!)

Devon

Hi, this is definitely in my wheel house. I sell to schools and school districts with a lot of red tape. We need to get their buy in and learn about their processes so we can offer the complete solution. Often times there are multiple layers that are involved in making the decision and asking questions around that will help confirm your assumptions.

There are a variety of ways to go about this and you could start with auditors who are directly impacted by your solution and gain their trust by asking them questions about their current processes. When you know what their problems are you can show them your solution with your product. The goal here is to really understand how the business operates so when you get a chance to meet with the ultimate decision maker such as a CIO/CFO/Business Owner, you can effectively and efficiency present your solutions totally tailored to their specific business, speaking their language which results in a compelling reason to do business with you. Win!

I like to empower the person I am meeting with to get me another meeting with the decision maker by using what I call a deal one-pager which is basically an executive summary the person I met with can pass on to the decision maker to then meet with me to discuss what I found when I met with the employee.

Let me know if you would like to see a copy of this or would like help with what I wrote above.