Report:

The Forrester Wave™: Governance, Risk, And Compliance Platforms, Q4 2023

How does Forrester define the Governance, Risk, And Compliance Platforms market in 2023?

GRC platforms are strategically shifting from cost centers to business enablers that help organizations safely take on more risk for more reward. Reference customers prioritize improving operational efficiency (top business priority) and removing organizational silos (71% of customers) over traditional compliance-focused approaches. The market is experiencing transformation as vendors expand solutions into new use cases while focusing on contextualized content quality, AI-enabled automation, next-generation user experiences, and advanced risk analytics and intelligence. The evaluation assessed 15 significant GRC platform providers across 25 criteria to help risk and compliance professionals select the right solution.

Key Facts for The Forrester Wave™: Governance, Risk, And Compliance Platforms, Q4 2023 in 2023

• Publication Date: 05-Dec-2023
• Document ID: RES179975
• Summary: In our 25-criterion evaluation of governance, risk, and compliance (GRC) platform providers, we identified the most significant ones and researched, analyzed, and scored them. This report shows how each provider measures up and helps risk and compliance professionals select the right one for their needs.
• Authors: Cody Scott, Amy DeMartine, Caroline Provost, Peter Harrison

How did the Governance, Risk, And Compliance Platforms market evolve in 2023?

• GRC is strategically shifting from a cost center to a value center and business enabler
• 71% of reference customers consider removing organizational silos a top driver for investing in a GRC platform
• Improving operational efficiency is the top business priority for GRC programs, ahead of compliance requirements
• US SEC filed 784 enforcement actions for nearly $5 billion in FY 2023, a 6.1% average increase since FY 2021
• Vendors are expanding solutions into new use cases with AI-enabled automation, next-gen user experiences, and advanced risk analytics
• The GRC market is experiencing transformation as vendors develop AI solutions to reimagine user experience
• 15 vendors were evaluated using 25 criteria across current offering, strategy, and market presence
• Evaluation materials were provided by vendors by September 22, 2023
• Customer reference surveys and interviews were conducted as part of the evaluation process

What product features are required to be included in this year's evaluation?

• A holistic platform approach to GRC. In addition to supporting multiple use cases, each vendor emphasizes a holistic approach to GRC by aligning GRC efforts to various business functions across the enterprise. These platforms have a cumulation of content, analysis, workflow, visualization, and reporting, supported by predictive analytics, artificial intelligence, machine learning, and native integrations with internal systems and external technologies to automate GRC efforts across a broad range of risk domains, sectors, and vertical markets.
• $25 million or more in GRC product revenue. All evaluated vendors earned $25 million or more in global revenue directly from their GRC products.
• Significant client mindshare and market relevance. Forrester clients ask about the evaluated vendors during inquiries and interviews or have use cases that these vendors are well suited to support. Inclusion in this evaluation also means that the vendor actively competes in the GRC market, showing up in competitive situations and discussions among Forrester clients.

What are the common features of top products in the Governance, Risk, And Compliance Platforms space?

No common features specified.

Scope Exclusions

• Point solutions that only offer some but not all holistic GRC capabilities (content, analysis, workflow, visualization, reporting, predictive analytics, AI/ML, and native integrations)
• Vendors with less than $25 million in GRC product revenue
• Vendors without significant client mindshare and market relevance among Forrester clients
• Solutions that don't support multiple GRC use cases across the enterprise

Inclusion Criteria

Vendors must, among other requirements:

• A holistic platform approach to GRC supporting multiple use cases and emphasizing alignment of GRC efforts to various business functions across the enterprise
• $25 million or more in GRC product revenue
• Significant client mindshare and market relevance, with vendors actively competing in the GRC market and appearing in competitive situations among Forrester clients

Offering Strengths — Relative Weighting

• Risk management lifecycle capabilities — 20%
• Enterprise risk management — 10%
• IT/cyber risk management — 10%
• Policy and procedure management — 5%
• Audit management — 10%
• Regulatory change management — 5%
• Continuous control monitoring — 5%
• AI, ML, and NLP — 10%
• Content delivery, mapping, and maintenance — 5%
• Holistic data inputs — 5%
• Workflow and process automation — 5%
• User experience — 10%

Strategy Strength — Relative Weighting

• Vision — 20%
• Innovation — 20%
• Roadmap — 20%
• Partner ecosystem — 10%
• Pricing flexibility and transparency — 10%
• Community — 20%

Reference

• Forrester, The Forrester Wave™: Governance, Risk, And Compliance Platforms, Q4 2023, 05-Dec-2023, ID RES179975

View Leaders
View Vendor Movements