MetricStream ConnectedGRC - Now Integrated with AWS Audit Manager

My main use case for MetricStream is the audit module within it. I was working for a company that implemented an audit framework, and then I was on one of the client's sides where I was using that developed framework. From a client side perspective, we usually look out for whether the audit structure that we need to develop, as part of our internal process, has been properly configured within MetricStream.

The org structure includes all your entities, where the primary one would be your organizations, and within that, the hierarchy consists of all the processes to be audited, having further sub-processes defined. We also require a frequency developed in MetricStream to schedule the audits, ensuring that they can trigger that an audit needs to be performed at particular frequencies, and when the audit has been performed, it has been scoped in for the processes that have been configured. We used to develop the scope of the audit within MetricStream, with audit fieldwork happening outside, but further, all the testing done with the ready framework called Objective Risk Control testing framework, we have the objectives defined for verifying particular scope items and against that, what is the inherent risk we are looking at. We also see the controls that are there in place, and validating those controls would provide our test results, along with end-to-end documentation of that entire flow. If we identify any issues during testing, we flag them and mark particular stakeholders for each issue, requiring those stakeholders to log into MetricStream and respond to those issues, which is facilitated by an inbuilt workflow for approval and tracking for the audit issues with due dates configured, providing a brief overview of the end-to-end process for the audit module we have used in MetricStream.

MetricStream has been quite helpful, as it ultimately automates my process, reducing manual intervention, with a repository where everything is maintained under one place. If I need an overview of any audit, including issues, stakeholders, and resolutions, I have everything consolidated in one place, making it a foolproof process. MetricStream was truly beneficial, easing the lives of everyone, including auditors and auditees, reinforcing its overall usefulness.

The best features MetricStream offers include a high degree of customization, allowing you to configure it the way you want for your internal processes, such as creating the org structure or defining processes and sub-processes, with many fields that can be configured on your own. The flexibility it provides is unmatched compared to any other tool in the market, and that flexibility to customize it for your needs stands out as one of the best parts of MetricStream.

MetricStream has positively impacted our organization by providing significant improvements and time savings, especially for management representations, where reports customized within MetricStream are exceptional. The ability to showcase specific fields in reports eases the management presentation process. Additionally, the system prepares all the documentation for us, allowing us to refer to anything by logging into the system and checking the specific audit, thus making maintenance of documentation far more efficient.

Improving MetricStream ultimately depends on how well we utilize the system, as its vast capabilities can be customized to meet our needs. It is up to us to mature with the system, discovering features and enhancing our experience as we proceed, potentially with vendor support guiding us on optimizations that could be made.

Regarding the user interface, MetricStream is quite user-friendly with no issues found. However, it is important to ensure the underlying infrastructure has the appropriate server space or RAM to avoid latency issues. Once that is in place, user experience is smooth, and having good vendor support with defined SLAs is essential to ensure timely resolutions for issues, especially since audit activities are time-sensitive.

I have been using MetricStream for more than three years.

We had the necessary infrastructure in place, including minimum server space and RAM requirements, so we did not experience any outages or issues, allowing us to utilize the application reliably without complaints.

Scalability with MetricStream has been satisfactory, with no challenges faced as every department, including compliance and risk, used it seamlessly.

Our experience with customer support through the vendor during implementation was positive, with satisfactory support, provided we had defined SLAs to outline response times and handling of issues accordingly.

It was our first foray into automation within the organization, having previously relied on a manual process, and MetricStream is the first GRC tool we introduced.

Using MetricStream helped us save 15 to 20 days of documentation and collation for management representation since all information is ready in the system. Instead of searching through files, we just generate a report and present it for management inputs or feedback.

Regarding return on investment, I know it was used across teams for risk and compliance modules, providing a consolidated view of its usefulness, but since I was not part of those discussions, I cannot provide specific metrics.

I think we were a bit skeptical about pricing and setup costs, as it required a significant upfront investment, but it is ultimately worth it since we see positive results from the investment, despite having to extend our budget to accommodate it.

We evaluated alternatives such as IDEA and Pentana, a UK-based company, but found the flexibility in MetricStream to be far superior to Pentana, which had limitations such as only the audit module, making MetricStream a clear choice for its broader utility across our teams.

While I have not personally used MetricStream's AI capabilities, I trust that if they have implemented such features, they would meet expectations since I have had a positive experience with them otherwise.

My advice to others considering MetricStream is that it is a useful product, and I fully recommend it based on our good experience. Investing time and resources into it yields benefits for the organization.

My experience with MetricStream has been satisfactory, and I do not have concerns about continuing forward with it. I urge others to explore its full potential to ensure balanced ROI. My review rating for MetricStream is 9 out of 10.

Private Cloud

Amazon Web Services (AWS)

MetricStream is the enterprise GRC tool for LSEG, and we are using eight different solutions from MetricStream as part of LSEG. We are using RCA, Risk and Compliance Assessment, Control Management, Issue Management, and the Third-Party Risk Management module. Along with that, we are also using Business Continuity Management, Policy Management, and Operational Resilience Management as part of MetricStream use case.

The entire Enterprise GRC in LSEG has been implemented, and we are using another seven modules apart from RCA in MetricStream. We have Control Management, Third-Party Risk Management, BCM, Operational Resilience, and Issue Management. All these modules have been implemented in the same way I explained for RCA at LSEG. Each module has been purchased as an out-of-box solution from MetricStream, and we have done around 20 to 25 solution customizations for each module to ensure that the out-of-box solutions are configured as per LSEG need. GRC is not an individual siloed application, so whenever we are using RCA, BCM, Third-Party Risk Management, or Incident Management, all solutions are integrated. The beauty of any GRC platform is that all these solutions sit under a common umbrella, allowing their data and use cases to communicate. Similarly, MetricStream has been integrated with our internal applications in LSEG, communicating via a centralized data lake where all data related to Risk Control, TPRM, and BCM is sent. Other third-party applications pull data from the centralized data lake, creating an end-to-end workflow across LSEG where data can be sent to and fro via the data lake.

The best features of MetricStream include its centralized application that connects all the different GRC use cases under one roof. It is a plug-and-play tool where after purchasing the GRC product from MetricStream, you receive all the industry standard workflows, requiring a minimal amount of effort to configure or customize the workflows, which typically varies between 10 to 20 percent of the total effort. The beauty of the product lies in its out-of-box solution workflows from MetricStream, which can be integrated with other enterprise GRC solutions under MetricStream.

MetricStream positively impacts our organization significantly by saving costs and enhancing our risk and compliance maturity. As a FinTech operating under heavy regulatory requirements, we require a stringent risk and compliance framework, and MetricStream helps us achieve our target state easily. Each year, we conduct numerous cycles for Risk and Control Assessment, and before implementing MetricStream, it took around three to four months to complete the Risk and Compliance Assessment with a lot of manual activities. Now, with the help of MetricStream, we complete the Risk and Compliance Assessment in approximately 30 to 40 days without a lot of manual follow-ups. It has become a business-as-usual process for us, leading to many improvements in managing critical issues and control testing and assurance. As a highly regulated entity, we meticulously manage our control lifecycle, and MetricStream has streamlined this process effectively, helping us progress in maturity and yielding visible benefits across our risk and compliance posture.

From our perspective, MetricStream can improve by developing the product towards a more low-code, no-code solution. In today's GRC environment, we aim to create a leaner team, avoiding long-term development efforts inside the MetricStream GRC team. After purchasing MetricStream, we desire a product that does not require development teams for customization but enables users to make configurations or adjustments with little effort.

Beyond low-code, no-code, we also seek modernization of reporting and dashboard capabilities. Currently, changing reports and dashboards to fit our organizational needs demands significant time and effort. We require MetricStream to build self-customization capabilities for reporting, allowing end users to configure reports based on their filtering and search criteria, saving bespoke reports only for their visibility. This self-reporting capability will enhance usability and cater to individual needs better.

I have been using MetricStream for the last three years.

MetricStream is scalable at the enterprise level, accommodating around 15,000 users within our instance. In terms of scalability, MetricStream performs very well, and it is also a stable product.

Customer support from MetricStream is very good. We work with MetricStream team to address our issues, and we have consistently received good support.

From LSEG's perspective, we previously did not have any automated solution and managed our GRC needs manually before MetricStream.

There is a measurable return on investment since we have reduced the time for Risk and Control Assessment from three to four months to approximately 30 to 40 days, which lowers costs significantly. Previously, many people were involved in the Risk and Control Assessment activity, but now it is a system-driven business-as-usual activity, saving a lot of costs and reducing time investment. Moreover, it streamlines the Risk and Control Assessment process with a solid end-to-end structure where team members understand their responsibilities clearly after logging into the tool. This brings tremendous cost optimization and reduces noise during the RCA cycle significantly after implementing MetricStream.

There is a strong return on investment. After implementing MetricStream, we have improved our costs because we have automated many reports, workflows, and other tasks through MetricStream.

From my standpoint, MetricStream is a bit costly. We spend a significant amount of money for the product, and I cannot disclose specifics due to confidentiality. Additionally, any customization incurs more costs because we must involve MetricStream consulting team to make the necessary changes.

We evaluated Archer GRC and ServiceNow but found that MetricStream's out-of-box use cases aligned more closely with our business use case, which is why we chose to implement MetricStream as it minimized our customization expenses.

For any customization, a development effort is necessary. It is not very complex, but it is not just a no-code, low-code solution. You need some degree of development effort, requiring the hiring of developers to customize the solution, unlike other no-code, low-code solutions that do not necessitate any developers. In summary, while you need some development effort to customize the solution, it is less complex compared to other heavily customized solutions.

Apart from that, this solution has a defined workflow and a notification system, along with all the features expected from a modernized GRC solution. You do need to spend some effort for customization and some development resources, but the new version of the solution called Euphrates, specifically Euphrates two, supports AI modernization efforts. If you have the latest version of MetricStream, you can build AI functionalities on top of the GRC platform. MetricStream is adopting many AI features compared to other GRC vendors in the market, which is a notable strength.

Before using MetricStream GRC tool, it is essential to understand your actual business use case. Do not purchase any solution blindly; instead, ensure that MetricStream GRC solution aligns with your needs. For example, if you want to implement the control management module, you must assess whether your current control testing processes align with what MetricStream offers and how much customization is necessary.

I would rate this product a 7 out of 10.

Public Cloud

Amazon Web Services (AWS)

MetricStream is utilized for property risk management by creating a workflow for TPRM. Assessments are assigned to the internal risk questionnaires created for business users. Business owners fill out the internal questionnaire, and upon approval, the auto workflow triggers, sending the Siglite questionnaire to third-party risk management. Vendors fill the DDQ, attach certifications, documents, and policy procedures, and submit it once completed for review.

Interactions with MetricStream occur through dedicated resources to handle documents like DDQs when workflows fail, or questionnaires need updating. Changes can be made from the sandbox, but vendor consultancy is needed for production implementation.

MetricStream's best features include its ease of use, compliance program, TPRM, audit management, and implementation effort. It effectively handles large data volumes and provides good workflow capabilities with decent reporting flexibility and a better user interface.

MetricStream impacts the organization by reducing follow-ups through reminder settings during questionnaire assignments. It automatically sends reminders based on set reminders, fostering trust when configured with the organization's email domain. Metrics improvements like operational efficiency, centralized GRC management, enhanced risk visibility, streamlined compliance, reduced manual efforts, enhanced third-party risk monitoring, improved decision-making with real-time dashboards, and risk analytics follow from automated workflows and issue tracking.

MetricStream could improve by simplifying the user interface to enhance navigation for business users and improve system performance, especially with large data sets. Enhancing reporting and dashboard customization with less technical dependency is important. Reducing implementation complexity for faster deployment is beneficial, as is providing more out-of-the-box templates, workflows, and industry-use cases. Strengthening integration capabilities with business and security tools, and streamlining administrative tasks to minimize maintenance efforts, would help. An enhanced FAQ or knowledge base could address small issues without frequent vendor consultation.

I joined recently, about four years ago, and before my time here, I was not aware of which tool was used; it was manually sending due diligence questionnaires and handling records through Excel spreadsheets.

MetricStream's scalability is impressive. It is an enterprise-grade platform designed to support large global organizations with thousands of users, handling high volumes of risk controls, audits, issues, and assessments. It is well-established with years of adoption across various industries, supporting growth from a single GRC function to enterprise-wide implementations, featuring strong workflow automation for approvals, notifications, escalations, and remediation tracking.

I believe the customer support is excellent and extremely talented, and I rate them 8 out of 10 for their responsiveness and expertise.

Before choosing MetricStream, I evaluated other options like OneTrust and ServiceNow GRC due to their functionalities in IT management, TPRM, and risk management. I considered multiple tools such as AuditBoard, OneTrust, ServiceNow GRC, RSA Archer, LogicGate, and HighBond, but MetricStream is more user-friendly in terms of accessing modules and navigation.

I have seen a return on investment with MetricStream as it reduces manual effort, improves audit efficiency, lowers compliance costs, and increases risk visibility and vendor risk management. Organizations with multiple business units benefit from using MetricStream, especially for managing several regulatory frameworks and replacing multiple GRC tools and spreadsheets. It delivers strong ROI as an enterprise-wide GRC platform with value realized through automation, reduced compliance effort, improved visibility, and efficient auditing. The ROI typically spans one to three years depending on the scope, adoption, and maturity level of GRC programs.

I rate MetricStream an 8 or 8.5 because it has strong areas in TPRM, internal audit, compliance, risk management, reporting, dashboard customization, workflow automation, user experience, and overall enterprise GRC capabilities.

I chose the number 8 or 8.5 because the implementation speed is not up to the mark. Considering areas like enterprise risk management (rating 9), compliance management (rating 9), TPRM (rating 9), internal audit (rating 8.5), workflow and automation (rating 9), customization (rating 9.5), reporting and dashboard (rating 8), user experience (rating 7), and ease of administration (rating 7), while implementation speed averages around 5 to 6, MetricStream is a strong enterprise-grade GRC platform for larger organizations with mature risk and compliance programs.

Regarding MetricStream's AI capabilities, the platform excels at using AI to enhance risk, compliance, audit, and TPRM processes, but AI should be viewed as an accelerator rather than the primary reason to choose MetricStream. The core strength is its comprehensive enterprise GRC functionality, with AI capabilities rated at 7 or 8. AI helps identify risks and trends across large data sets, supports risk prioritization and faster decision-making, improves compliance monitoring, enhances third-party risk assessments, and provides sophisticated dashboards with executive-level insights.

MetricStream's AI capabilities effectively assist GRC teams, though the accuracy and usefulness of outputs heavily depend on the quality of well-structured data. The accuracy is rated at 7 or 7.5. While AI can automate tasks, human decision-making is indispensable for regulatory interpretations, risk acceptance decisions, and audit conclusions.

My advice for others considering MetricStream is to use it if you need a scalable enterprise GRC solution with the resources for implementation and governance. Keep configurations simple, invest in user training, and avoid unnecessary customization for long-term success. I rate MetricStream an overall 8 out of 10.

Public Cloud

Amazon Web Services (AWS)

My main use case for MetricStream is for audit and risk management.

We utilize MetricStream for audit and risk management by developing risk dashboarding and risk library development, standardizing libraries across enterprise organizations where risk management, corporate audit, and other business units can all utilize the same system of record and libraries.

MetricStream's shared system works well across all business units by standardizing similar risks and controls that exist across multiple business units. For instance, IT risk management and information security risk management have overlapping risks and controls, but we standardize them into one centralized risk and control.

The best features MetricStream offers take into consideration all the elements of a full governance, risk, and compliance system from both risk management to corporate audit, being able to develop applications within the solution that meet our needs, having a degree of full customization, as well as reporting, utilizing Infolets and Info Centers to establish reports that may not typically be out of the box and are definitely value-added.

MetricStream's customization and reporting have helped my work significantly. Compared to other systems, we have had the ability to essentially write SQL code that allows us to develop a report in real time that gives us insight into various different KPIs or KRIs leveraged across the organization. In comparison to other systems where you might be limited on what you can develop a separate report on, most of the fields and data captured within MetricStream have been reportable.

A favorite aspect I have regarding MetricStream is a love-hate relationship. The record level security sometimes backfires in terms of configuration, but usually it is relatively easy to work around.

MetricStream has positively impacted my organization by reducing silos across the organization. Having a centralized risk library maintained by risk management allows the corporate audit team to shave time off annual planning and enables more audit work to be done by ensuring validity of risks and controls in the system to support audit testing.

Since implementing MetricStream, audit teams have shaved about two weeks off of annual planning across various teams, allowing audit departments of about 140 auditors across maybe 10 teams to squeeze in 10 extra audits, one audit per each team, if not additional testing.

MetricStream can be improved in several areas. Sometimes the overall flow of the application can seem a bit clunky, based on feedback from clients.

From my understanding and what I have heard from developers within MetricStream during my deeper use of the application, the application seems to have been developed within silos, and the interaction of certain applications internally could definitely be improved in terms of the overall coding that exists between applications within the solution.

The only improvement I suggest for MetricStream is to gather a collaborative think tank from several of the largest clients and compile feedback to prioritize suggested enhancements from multiple organizations.

I have been using MetricStream for a combined total of about six years.

MetricStream is mostly stable.

MetricStream's scalability is adaptable, though the biggest issue I have encountered with clients has been around upgrades that require re-implementing customizations to the out-of-box solutions after significant upgrades.

Customer support from MetricStream has been great. We had to engage with senior management from time to time, but they were responsive and quick in working through our issues.

Before MetricStream, we used Archer, Ideagen, and Thomson Reuters Paisley. We switched because MetricStream was much more robust.

I have not seen specific metrics on return on investment with MetricStream, outside of reducing silos and allowing time savings off of annual planning.

In terms of pricing, setup cost, and licensing for MetricStream, we did run into issues with insufficient licensing, but the ability to acquire new licenses was relatively quick and effortless.

Before choosing MetricStream, we did evaluate other options depending on the client. We chose Archer for one installation and Thomson Reuters for another implementation.

My advice for others looking into using MetricStream is to ensure collective representation from all business units that will be clients of the application across the organization. For example, in a bank, make sure you have audit, risk management, and other departments involved. I would rate this review a 7.

Public Cloud

Amazon Web Services (AWS)

What do you like best about the product?

This was the first QMS that I implemented in my career and because of that has naturally become the bar that I measure everything against. Since this time I have worked in 4 other QMS and I continue to appreciate MetricStream and wish for the functions that it offers. One of the things that I liked best was the Document Control module which makes searching for documents so easy. Not only can you search on the basic metadata you can search for terms within the document. Additionally, because this was implemented as a global system it gave each site view access to one another's procedures which made collaborating much easier.

What do you dislike about the product?

The system could be a bit buggy after vendor supplied upgrades are installed. The upgrades were intended to fix some issues but would inevitably end up breaking something else. That being said the vendor's support was very fast to address and correct these issues.

What problems is the product solving and how is that benefiting you?

Taking a paper-based system to be zero paper. This is a huge win in an industry where record retention is key. By implementing all of the QMS modules it also makes metric reporting super easy. This is much appreciated when creating APRs, management review and assessing compliance to procedural timelines.