Start with client separation, not a giant master sheet
For an implementation agency or advisor, the first structural question is not which columns to add. It is how to prevent one client's systems, evidence and delivery records from becoming mixed with another client's operational context.
A portfolio view can show what needs attention across accounts, but the underlying system records should remain scoped to the correct client workspace.
Keep the inventory factual
An inventory becomes hard to maintain when it tries to contain every policy conclusion. Keep the core record factual and durable, then attach review decisions and evidence to it.
- System name and vendor or stack.
- Actual use case and user group.
- Operational owner.
- Recorded provider/deployer role where relevant to the team's workflow.
- Important factual triggers such as direct interaction with people or generated content.
- Next review date and material-change notes.
Portfolio metrics should point to work, not create a score
Useful portfolio signals are operational: open human-review actions, evidence count, overdue review dates and systems with stale context. These tell the team where work is needed without pretending to reduce governance into a single compliance percentage.