The Forrester Wave™: Governance, Risk, And Compliance Platforms, Q4 2023

Governance, Risk, And Compliance Platforms Vendor Product Comparisons 2023

Key features and pros and cons of top Governance, Risk, And Compliance Platforms products:

Diligent - Leaders

Pros:

Best-in-class audit capability
Comprehensive strategy tools that integrate risk and compliance into enterprise decision-making
Strong user experience and curated content
Proprietary risk intelligence data
Analytics robotics features that enable automated risk analysis
Unique board-ready reporting
Incorporates boards of directors into the GRC ecosystem

Cons:

Policy management solution has not yet migrated to the Diligent One platform
Reference customers were less satisfied with workflow functionality
Must balance ambitious roadmap delivery with unified platform migration while maintaining customer satisfaction

LogicGate - Leaders

Pros:

User experience is second to none - reference customers consistently gave highest rating
Strong in IT risk management with platform-native FAIR analysis
No-code builder canvas to visually create application workflows and automated processes
Simplified pricing model set primarily by application with unlimited standard and external user licenses
Policy management leverages OpenAI integration to generate policy content

Cons:

Reference customers noted ongoing limitations with integrations
Solutions for most GRC use cases are on par but not leading

MetricStream - Leaders

Pros:

Integrated data model and expansive risk management feature set
One of few vendors to provide native risk quantification and Monte Carlo analysis for enterprise and cyber risk
Strong in IT risk management
Use of AI/ML to boost productivity
Observations module for emerging risks supports enhanced first-line engagement
Multiple cross-domain risk intelligence data sources
Strong customer service commitment

Cons:

Reference customers cited issues with user experience and stability
Reference customers were unsatisfied with audit and policy management solutions
Must reinforce roadmap objectives with sustained commitment to user functionality

ServiceNow - Leaders

Pros:

Superior roadmap and innovation strategies targeting digital experience, risk process automation at scale, and AI-led operations
Platform strength in workflow, automation, and integrations
Strong risk monitoring and communication tools including automated metrics and intuitive dashboards
Extensive use of AI to enhance user experience and productivity
Strong partner ecosystem delivering capability, competency, and customer success
Maximum configuration and control to scale GRC programs

Cons:

Reference customers unsatisfied with implementation partners - especially on implementation speed, cost, complexity, and lack of partner domain expertise
Reference customers wished for more out-of-the-box implementation resources in the product

Archer - Strong Performers

Pros:

Leading risk evaluation tools through Archer Insight solution
Intuitive application builder to visually define workflows and automation tasks
Analytics and reporting features bolster ERM and IT risk management solutions
Advanced workflow features
Strong configurability
Good implementation support

Cons:

Still migrating customers to SaaS with customers noting trouble upgrading to newer SaaS versions
Weaker in native AI-driven functionality and user experience
Reference customers less satisfied with user interface and limitations with APIs
Innovation strategy focuses on subset of core product enhancements in near term

Camms - Strong Performers

Pros:

Feature-rich approach to ERM with dedicated strategy module integrated with risk modules
Strong in risk evaluation providing native Monte Carlo analysis
Mature approach to analyze control effectiveness
One of the most cost-effective solutions on the market
Platform configurability and dashboards
Substantial innovation strategy with forward-thinking 'futures groups'

Cons:

Policy module lacks policy creation tools and integrates with external document management systems, limiting differentiation
Reference customers thought report generation tools were too complex
Lacks broad market share

IBM - Strong Performers

Pros:

Advanced analytics, risk simulation, and automation capabilities with Watson/watsonx integration
Strong in risk identification, policy, audit, regulatory change management, and control monitoring
Embedded AI automates key workflow stages, provides suggestions, generates content, and recommends missing content
Chatbot helps users conduct risk assessments
Native quantitative analysis tools
Good user interface and configuration options

Cons:

Platform's risk response capability lacks mitigation planning tools
Reference customers wanted additional in-platform collaboration tools and project planning capabilities
Pricing model differs mainly by deployment type
Lacked native SaaS offering at time of evaluation (planned for Q4 2023)

OneTrust - Strong Performers

Pros:

Intuitive platform excels at leveraging native and third-party intelligence data to automate risk response and remediation
Embedded regulatory research database strengthens regulatory change management
In-house research team provides curated frameworks, templates, and industry content
One of few vendors with dedicated AI model risk management solution
Unmatched commitment to innovation with 300+ approved patents
Strong community strategy
Level of continuous improvement

Cons:

Still lacks viable ERM solution - significant gap for risk aggregation and reporting (solution in preview)
Reference customers less satisfied with reporting capabilities
Rapidly evolving from privacy roots to holistic GRC market

Riskonnect - Strong Performers

Pros:

Market-leading ERM use case
Real-time quantitative Monte Carlo simulations and bow-tie analysis
First-line user portal
AI-supported 'easy buttons' that accelerate risk mapping and assessments
Brings insurable risk and GRC into integrated platform
Successful community engagement approach
Strong customer service commitment

Cons:

Weaker in IT risk management and delivery of GRC content
Reference customers wished for more integrations and data extraction capabilities
Overall innovation strategy lags compared with others
Vision and roadmap focus narrower than competitors

Workiva - Strong Performers

Pros:

Strong risk identification capabilities including risk workshop collaboration space
Project planning and data visualization tools for efficient audit management
Generative AI streamlines policy creation and management
Data management suite
One of larger global partner networks
Solution-based licensing with unlimited users
Sponsors multiple industry professional groups

Cons:

IT risk management module prioritizes compliance over risk analysis
Control mapping is mostly manual until common framework integration
Reference customers unsatisfied with workflow automation
Compliance management solution uses consumption-based model limiting smaller GRC teams

Fusion Risk Management - Contenders

Pros:

Strong risk monitoring capability with powerful indicators library
Integrates with variety of data brokers and intelligence providers
IT risk management integrated with IT disaster recovery module
On-par risk response and communication capabilities
Self-service reporting and dashboards
Leader in business continuity management market

Cons:

Generally weaker in other GRC use cases
Does not have native ERM or internal audit functionality
Reference customers wished for additional capabilities for regulatory compliance and enhanced issue management
Innovation strategy lacking, focusing on resilience needs rather than comprehensive GRC approach
Roadmap narrower in focus than others

NAVEX - Contenders

Pros:

On par in IT risk, policy, and audit management
Cost-effective 'IRM Out of the Box' approach
Overall implementation experience
Workflow customization and integration functionality
One of the larger virtual user conferences
One of most cost-effective GRC products on market

Cons:

Weaker in ERM functionality and user experience
Prioritizes helping teams get started over in-depth use case build-outs
Majority of reference customers said data visualization, dashboards, and reporting need improvement
Weaker in innovation, sacrificing general R&D for targeted AI/ML enhancements

Resolver - Contenders

Pros:

Strong risk response and monitoring capabilities
Strong first-line support for incident capture and automated risk response recommendations
Real-time investigations
Variety of risk intelligence, regulatory, and ratings/analytics feeds
On-par functionality in IT risk and policy management
Workflow automation and self-assessment tools
Strong pricing model with simple, tiered packages

Cons:

Weaker in ERM and audit with less native capability than others
Reference customers noted reporting and dashboards fell short
Weaker in strategic areas such as vision, innovation, and roadmap
Roadmap prioritizes services and risk intelligence over broader GRC innovations

SAI360 - Contenders

Pros:

On par for many GRC use cases including ERM, IT risk, policy, audit, regulatory change management, and continuous control monitoring
Native risk quantification and Monte Carlo analysis
Comprehensive prebuilt workflows
Embedded Power BI tools
ESG cloud platform connecting GRC, EHS&S, and learning
On-par innovation strategy with regained momentum

Cons:

Weaker in AI deployment and GRC content lacking depth and availability of resources
Reference customers want more low-code configuration options
Roadmap focuses on improvements that largely help stay on par with current market direction rather than leading

AuditBoard - Challengers

Pros:

On-par audit solution with intuitive interface and workflows
Strong position in audit and compliance industry with 40% of Fortune 500 as customers
Modern UX and collaborative platform for compliance use cases
Industry expertise

Cons:

ERM and IT risk solutions provide relatively simple risk assessment and monitoring tools
Lack robust analysis, integrations, risk intelligence, mitigation, and dashboarding tools that mature practitioners expect
Strategically underperforms compared with other GRC vendors
Still adding GRC use cases to platform to catch up with other vendors
Declined to participate in full Forrester Wave evaluation process

FAQs

Q: Which vendors are Leaders in 2023?

A: Diligent, LogicGate, MetricStream, ServiceNow

Q: What does "Leader" mean in Forrester Wave terms?

A: Leaders in the Forrester Wave demonstrate strong current offerings and robust strategies. In the GRC Platforms market, Leaders excel at balancing technical sophistication with ease of use, offering integrated data models and advanced workflows while providing sufficient preconfigured applications and content. They show superior vision and roadmap focusing on AI-enabled automation, next-gen user experiences, and advanced risk analytics. Leaders demonstrate a holistic approach to governance, risk, and compliance with clear platform depth and breadth aligned to user GRC maturity. They position on the upper-right quadrant of the Wave graphic, indicating both strong current offerings (vertical axis) and strong strategy (horizontal axis).

Q: How do I interpret a Forrester Wave?

A: https://www.forrester.com/policies/forrester-wave-methodology/

Report:

Top Vendor Products for Governance, Risk, And Compliance Platforms in 2023

Governance, Risk, And Compliance Platforms Vendor Product Comparisons 2023

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

Pros:

Cons:

FAQs

Q: Which vendors are Leaders in 2023?

Q: What does "Leader" mean in Forrester Wave terms?

Q: How do I interpret a Forrester Wave?

Reference