MetricStream ConnectedGRC - Now Integrated with AWS Audit Manager

My main use case for MetricStream  is internal audits.

I use MetricStream  for internal audits by having modules in a bank where I have deployed basic GRC  controls to test work papers and then issue management. When any exceptions arise during the assessment of particular entities, those exceptions trigger as issues which then flow down to audits for further conduct.

Everything about my main use case for MetricStream fits into our audit process. For example, when we do a disaster recovery test, if it fails, it gets logged in MetricStream, and approvals for exceptions are tracked along with the identified root causes to perform retests based on availability and schedules.

MetricStream offers many inbuilt modules that require less customization, especially with risk management, controls, and issue management modules reflecting current industry needs including vulnerability management and DR tests.

The inbuilt modules, such as risk management, controls, and issue management, make my work easier and more efficient by providing a complete picture of the assessment process, effectively tracking risks and exceptions during entity assessments conducted yearly or quarterly, and automating the flow of issues into issue management.

MetricStream has positively impacted my organization by improving compliance, as previously processes were maintained in Excel sheets shared across the organization, but now it has centralized access for users.

Centralizing those processes has reduced errors and made audits faster while improving collaboration, as reviewers can log in at any point to see pending actions and who is responsible for them without the confusion of shared Excel sheets.

MetricStream needs improvements, particularly regarding performance as data grows.

Performance issues become noticeable, particularly with SQL queries, especially when Infolets run.

Overall, improvements are needed in performance and form loading times.

MetricStream is a good product, but there is a need to improve form loading performance and address potential data loss when multiple users submit forms simultaneously.

I have been using MetricStream for three years.

MetricStream is stable, but it is not 100% stable. It is a good product, yet I experience more data losses and flow control issues as data volume increases.

MetricStream has good scalability.

The customer support is very good, as I have not encountered issues because the offshore team is always available to help when needed.

I would rate the customer support on a scale of 1 to 10 as a nine.

I joined a company where MetricStream was already in use, so I transitioned directly to it without previously using another solution, though I have experience with RSA Archer .

I have seen a return on investment primarily through user cleanup processes that reduced unnecessary licenses and saved money after customizing the system to track user activity.

My experience with pricing, setup cost, and licensing reveals that licensing is very expensive, which contributes significantly to revenue.

My team evaluated other options before choosing MetricStream, including AuditBoard , RSA Archer , and ServiceNow .

My main use case for MetricStream  is the audit module within it. I was working for a company that implemented an audit framework, and then I was on one of the client's sides where I was using that developed framework. From a client side perspective, we usually look out for whether the audit structure that we need to develop, as part of our internal process, has been properly configured within MetricStream .

The org structure includes all your entities, where the primary one would be your organizations, and within that, the hierarchy consists of all the processes to be audited, having further sub-processes defined. We also require a frequency developed in MetricStream to schedule the audits, ensuring that they can trigger that an audit needs to be performed at particular frequencies, and when the audit has been performed, it has been scoped in for the processes that have been configured. We used to develop the scope of the audit within MetricStream, with audit fieldwork happening outside, but further, all the testing done with the ready framework called Objective  Risk Control testing framework, we have the objectives defined for verifying particular scope items and against that, what is the inherent risk we are looking at. We also see the controls that are there in place, and validating those controls would provide our test results, along with end-to-end documentation of that entire flow. If we identify any issues during testing, we flag them and mark particular stakeholders for each issue, requiring those stakeholders to log into MetricStream and respond to those issues, which is facilitated by an inbuilt workflow for approval and tracking for the audit issues with due dates configured, providing a brief overview of the end-to-end process for the audit module we have used in MetricStream.

MetricStream has been quite helpful, as it ultimately automates my process, reducing manual intervention, with a repository where everything is maintained under one place. If I need an overview of any audit, including issues, stakeholders, and resolutions, I have everything consolidated in one place, making it a foolproof process. MetricStream was truly beneficial, easing the lives of everyone, including auditors and auditees, reinforcing its overall usefulness.

The best features MetricStream offers include a high degree of customization, allowing you to configure it the way you want for your internal processes, such as creating the org structure or defining processes and sub-processes, with many fields that can be configured on your own. The flexibility it provides is unmatched compared to any other tool in the market, and that flexibility to customize it for your needs stands out as one of the best parts of MetricStream.

MetricStream has positively impacted our organization by providing significant improvements and time savings, especially for management representations, where reports customized within MetricStream are exceptional. The ability to showcase specific fields in reports eases the management presentation process. Additionally, the system prepares all the documentation for us, allowing us to refer to anything by logging into the system and checking the specific audit, thus making maintenance of documentation far more efficient.

Improving MetricStream ultimately depends on how well we utilize the system, as its vast capabilities can be customized to meet our needs. It is up to us to mature with the system, discovering features and enhancing our experience as we proceed, potentially with vendor support guiding us on optimizations that could be made.

Regarding the user interface, MetricStream is quite user-friendly with no issues found. However, it is important to ensure the underlying infrastructure has the appropriate server space or RAM to avoid latency issues. Once that is in place, user experience is smooth, and having good vendor support with defined SLAs is essential to ensure timely resolutions for issues, especially since audit activities are time-sensitive.

I have been using MetricStream for more than three years.

We had the necessary infrastructure in place, including minimum server space and RAM requirements, so we did not experience any outages or issues, allowing us to utilize the application reliably without complaints.

Scalability with MetricStream has been satisfactory, with no challenges faced as every department, including compliance and risk, used it seamlessly.

Our experience with customer support through the vendor during implementation was positive, with satisfactory support, provided we had defined SLAs to outline response times and handling of issues accordingly.

It was our first foray into automation within the organization, having previously relied on a manual process, and MetricStream is the first GRC  tool we introduced.

Using MetricStream helped us save 15 to 20 days of documentation and collation for management representation since all information is ready in the system. Instead of searching through files, we just generate a report and present it for management inputs or feedback.

Regarding return on investment, I know it was used across teams for risk and compliance modules, providing a consolidated view of its usefulness, but since I was not part of those discussions, I cannot provide specific metrics.

I think we were a bit skeptical about pricing and setup costs, as it required a significant upfront investment, but it is ultimately worth it since we see positive results from the investment, despite having to extend our budget to accommodate it.

We evaluated alternatives such as IDEA and Pentana, a UK-based company, but found the flexibility in MetricStream to be far superior to Pentana, which had limitations such as only the audit module, making MetricStream a clear choice for its broader utility across our teams.

While I have not personally used MetricStream's AI capabilities, I trust that if they have implemented such features, they would meet expectations since I have had a positive experience with them otherwise.

My advice to others considering MetricStream is that it is a useful product, and I fully recommend it based on our good experience. Investing time and resources into it yields benefits for the organization.

My experience with MetricStream has been satisfactory, and I do not have concerns about continuing forward with it. I urge others to explore its full potential to ensure balanced ROI. My review rating for MetricStream is 9 out of 10.

MetricStream  is the enterprise GRC  tool for LSEG, and we are using eight different solutions from MetricStream  as part of LSEG. We are using RCA, Risk and Compliance Assessment , Control Management, Issue Management, and the Third-Party Risk Management  module. Along with that, we are also using Business Continuity Management, Policy Management, and Operational Resilience Management as part of MetricStream use case.

The entire Enterprise GRC in LSEG has been implemented, and we are using another seven modules apart from RCA in MetricStream. We have Control Management, Third-Party Risk Management, BCM, Operational Resilience, and Issue Management. All these modules have been implemented in the same way I explained for RCA at LSEG. Each module has been purchased as an out-of-box solution from MetricStream, and we have done around 20 to 25 solution customizations for each module to ensure that the out-of-box solutions are configured as per LSEG need. GRC is not an individual siloed application, so whenever we are using RCA, BCM, Third-Party Risk Management, or Incident Management , all solutions are integrated. The beauty of any GRC platform is that all these solutions sit under a common umbrella, allowing their data and use cases to communicate. Similarly, MetricStream has been integrated with our internal applications in LSEG, communicating via a centralized data lake where all data related to Risk Control, TPRM, and BCM is sent. Other third-party applications pull data from the centralized data lake, creating an end-to-end workflow across LSEG where data can be sent to and fro via the data lake.

The best features of MetricStream include its centralized application that connects all the different GRC use cases under one roof. It is a plug-and-play tool where after purchasing the GRC product from MetricStream, you receive all the industry standard workflows, requiring a minimal amount of effort to configure or customize the workflows, which typically varies between 10 to 20 percent of the total effort. The beauty of the product lies in its out-of-box solution workflows from MetricStream, which can be integrated with other enterprise GRC solutions under MetricStream.

MetricStream positively impacts our organization significantly by saving costs and enhancing our risk and compliance maturity. As a FinTech operating under heavy regulatory requirements, we require a stringent risk and compliance framework, and MetricStream helps us achieve our target state easily. Each year, we conduct numerous cycles for Risk and Control Assessment , and before implementing MetricStream, it took around three to four months to complete the Risk and Compliance Assessment with a lot of manual activities. Now, with the help of MetricStream, we complete the Risk and Compliance Assessment in approximately 30 to 40 days without a lot of manual follow-ups. It has become a business-as-usual process for us, leading to many improvements in managing critical issues and control testing and assurance. As a highly regulated entity, we meticulously manage our control lifecycle, and MetricStream has streamlined this process effectively, helping us progress in maturity and yielding visible benefits across our risk and compliance posture.

From our perspective, MetricStream can improve by developing the product towards a more low-code, no-code solution. In today's GRC environment, we aim to create a leaner team, avoiding long-term development efforts inside the MetricStream GRC team. After purchasing MetricStream, we desire a product that does not require development teams for customization but enables users to make configurations or adjustments with little effort.

Beyond low-code, no-code, we also seek modernization of reporting and dashboard capabilities. Currently, changing reports and dashboards to fit our organizational needs demands significant time and effort. We require MetricStream to build self-customization capabilities for reporting, allowing end users to configure reports based on their filtering and search criteria, saving bespoke reports only for their visibility. This self-reporting capability will enhance usability and cater to individual needs better.

I have been using MetricStream for the last three years.

MetricStream is scalable at the enterprise level, accommodating around 15,000 users within our instance. In terms of scalability, MetricStream performs very well, and it is also a stable product.

Customer support from MetricStream is very good. We work with MetricStream team to address our issues, and we have consistently received good support.

From LSEG's perspective, we previously did not have any automated solution and managed our GRC needs manually before MetricStream.

There is a measurable return on investment since we have reduced the time for Risk and Control Assessment from three to four months to approximately 30 to 40 days, which lowers costs significantly. Previously, many people were involved in the Risk and Control Assessment activity, but now it is a system-driven business-as-usual activity, saving a lot of costs and reducing time investment. Moreover, it streamlines the Risk and Control Assessment process with a solid end-to-end structure where team members understand their responsibilities clearly after logging into the tool. This brings tremendous cost optimization and reduces noise during the RCA cycle significantly after implementing MetricStream.

There is a strong return on investment. After implementing MetricStream, we have improved our costs because we have automated many reports, workflows, and other tasks through MetricStream.

From my standpoint, MetricStream is a bit costly. We spend a significant amount of money for the product, and I cannot disclose specifics due to confidentiality. Additionally, any customization incurs more costs because we must involve MetricStream consulting team to make the necessary changes.

We evaluated Archer  GRC and ServiceNow  but found that MetricStream's out-of-box use cases aligned more closely with our business use case, which is why we chose to implement MetricStream as it minimized our customization expenses.

For any customization, a development effort is necessary. It is not very complex, but it is not just a no-code, low-code solution. You need some degree of development effort, requiring the hiring of developers to customize the solution, unlike other no-code, low-code solutions that do not necessitate any developers. In summary, while you need some development effort to customize the solution, it is less complex compared to other heavily customized solutions.

Apart from that, this solution has a defined workflow and a notification system, along with all the features expected from a modernized GRC solution. You do need to spend some effort for customization and some development resources, but the new version of the solution called Euphrates, specifically Euphrates two, supports AI modernization efforts. If you have the latest version of MetricStream, you can build AI functionalities on top of the GRC platform. MetricStream is adopting many AI features compared to other GRC vendors in the market, which is a notable strength.

Before using MetricStream GRC tool, it is essential to understand your actual business use case. Do not purchase any solution blindly; instead, ensure that MetricStream GRC solution aligns with your needs. For example, if you want to implement the control management module, you must assess whether your current control testing processes align with what MetricStream offers and how much customization is necessary.

I would rate this product a 7 out of 10.

MetricStream  is utilized for property risk management by creating a workflow for TPRM. Assessments are assigned to the internal risk questionnaires created for business users. Business owners fill out the internal questionnaire, and upon approval, the auto workflow triggers, sending the Siglite questionnaire to third-party risk management. Vendors fill the DDQ, attach certifications, documents, and policy procedures, and submit it once completed for review.

Interactions with MetricStream  occur through dedicated resources to handle documents like DDQs when workflows fail, or questionnaires need updating. Changes can be made from the sandbox, but vendor consultancy is needed for production implementation.

MetricStream's best features include its ease of use, compliance program, TPRM, audit management, and implementation effort. It effectively handles large data volumes and provides good workflow capabilities with decent reporting flexibility and a better user interface.

MetricStream impacts the organization by reducing follow-ups through reminder settings during questionnaire assignments. It automatically sends reminders based on set reminders, fostering trust when configured with the organization's email domain. Metrics improvements like operational efficiency, centralized GRC  management, enhanced risk visibility, streamlined compliance, reduced manual efforts, enhanced third-party risk monitoring, improved decision-making with real-time dashboards, and risk analytics follow from automated workflows and issue tracking.

MetricStream could improve by simplifying the user interface to enhance navigation for business users and improve system performance, especially with large data sets. Enhancing reporting and dashboard customization with less technical dependency is important. Reducing implementation complexity for faster deployment is beneficial, as is providing more out-of-the-box templates, workflows, and industry-use cases. Strengthening integration capabilities with business and security tools, and streamlining administrative tasks to minimize maintenance efforts, would help. An enhanced FAQ or knowledge base could address small issues without frequent vendor consultation.

I joined recently, about four years ago, and before my time here, I was not aware of which tool was used; it was manually sending due diligence questionnaires and handling records through Excel spreadsheets.

MetricStream's scalability is impressive. It is an enterprise-grade platform designed to support large global organizations with thousands of users, handling high volumes of risk controls, audits, issues, and assessments. It is well-established with years of adoption across various industries, supporting growth from a single GRC  function to enterprise-wide implementations, featuring strong workflow automation for approvals, notifications, escalations, and remediation tracking.

I believe the customer support is excellent and extremely talented, and I rate them 8 out of 10 for their responsiveness and expertise.

Before choosing MetricStream, I evaluated other options like OneTrust and ServiceNow  GRC due to their functionalities in IT management, TPRM, and risk management. I considered multiple tools such as AuditBoard , OneTrust, ServiceNow  GRC, RSA Archer , LogicGate , and HighBond , but MetricStream is more user-friendly in terms of accessing modules and navigation.

I have seen a return on investment with MetricStream as it reduces manual effort, improves audit efficiency, lowers compliance costs, and increases risk visibility and vendor risk management. Organizations with multiple business units benefit from using MetricStream, especially for managing several regulatory frameworks and replacing multiple GRC tools and spreadsheets. It delivers strong ROI as an enterprise-wide GRC platform with value realized through automation, reduced compliance effort, improved visibility, and efficient auditing. The ROI typically spans one to three years depending on the scope, adoption, and maturity level of GRC programs.

I rate MetricStream an 8 or 8.5 because it has strong areas in TPRM, internal audit, compliance, risk management, reporting, dashboard customization, workflow automation, user experience, and overall enterprise GRC capabilities.

I chose the number 8 or 8.5 because the implementation speed is not up to the mark. Considering areas like enterprise risk management (rating 9), compliance management (rating 9), TPRM (rating 9), internal audit (rating 8.5), workflow and automation (rating 9), customization (rating 9.5), reporting and dashboard (rating 8), user experience (rating 7), and ease of administration (rating 7), while implementation speed averages around 5 to 6, MetricStream is a strong enterprise-grade GRC platform for larger organizations with mature risk and compliance programs.

Regarding MetricStream's AI capabilities, the platform excels at using AI to enhance risk, compliance, audit, and TPRM processes, but AI should be viewed as an accelerator rather than the primary reason to choose MetricStream. The core strength is its comprehensive enterprise GRC functionality, with AI capabilities rated at 7 or 8. AI helps identify risks and trends across large data sets, supports risk prioritization and faster decision-making, improves compliance monitoring, enhances third-party risk assessments, and provides sophisticated dashboards with executive-level insights.

MetricStream's AI capabilities effectively assist GRC teams, though the accuracy and usefulness of outputs heavily depend on the quality of well-structured data. The accuracy is rated at 7 or 7.5. While AI can automate tasks, human decision-making is indispensable for regulatory interpretations, risk acceptance decisions, and audit conclusions.

My advice for others considering MetricStream is to use it if you need a scalable enterprise GRC solution with the resources for implementation and governance. Keep configurations simple, invest in user training, and avoid unnecessary customization for long-term success. I rate MetricStream an overall 8 out of 10.