SWOT Assessment: Acuity, Stream Integrated Risk Manager v4.0

Transcription

1 SWOT Assessment: Acuity, Stream Integrated Risk Manager v4.0 Analyzing the strengths, weaknesses, opportunities, and threats Publication Date: 15 May 2015 Product code: IT Alan Rodger

2 Summary Catalyst The increase in compliance-related burdens for enterprises continues due to factors such as regulatory pressures, the need to adhere to recognized standards, and supply chain assurance, and has led to a rise in related spending to deal with the greater scale of work required. Consequently, there are significant pressures for efficiencies in operational areas that deal with governance, risk, and compliance (GRC) matters. Combined with these considerations there is an increased focus on risk, and there are many initiatives to integrate risk into business decisions, including those made on investments.many organizations need to achieve these objectives or benefits without large-scale investment in a sizeable implementation ranging across multiple business units. Ovum believes there is a place for limited-scale GRC solutions that cater for these requirements without enormous investment in time and setup costs. Key messages Stream is aimed at fulfilling risk- and compliance-related requirements for organizations wanting to replace unsatisfactory risk management, without employing lengthy and complex implementations. Stream provides numerous GRC functions around automated risk registers and self-assessment of risks and controls, and can integrate key risk indicators and metrics from external systems. Using Stream helps improve efficiency and maturity in an organization's risk management practices and enables better understanding of investments in problem remediation on risk performance. The solution provides flexibility, configurability, ease of use, and actionable intelligence to improve risk management effectiveness without high cost of ownership or lengthy implementation. Ovum view The scale of commitment needed to implement GRC solutions must be viewed realistically, underpinned by a clear understanding of potential benefits. The larger GRC solutions are sometimes compared to enterprise resource planning (ERP) systems in terms of the scope of functionality and potential degree of change resulting from adoption. Consequently, there is notable space in the market for GRC solutions that address a scope more closely focused on risk management and compliance, cause less disruption to organizational processes due to adoption, and can rapidly deliver value. Stream is a highly capable solution which has already matured substantially and been successfully adopted by numerous organizations across varied industry sectors. It can automate risk management and compliance monitoring, and provide easy implementation via a range of pre-defined, configurable templates of regulatory requirements and standards of practice. Services assistance with implementation is the recommended approach, and Acuity partners provide this in a growing range of geographies. Ovum. All rights reserved. Unauthorized reproduction prohibited. Page 2

3 Recommendations for enterprises Why consider Stream? Stream automates and integrates the handling of risk registers, risk and control self-assessments, and key risk indicators and metrics from external systems, managing these in the context of compliance against defined management systems. It has specific functionality to deal with multiple risk types, including cyber risk, incorporating privacy, integrity, and availability of data assets in the context of their supporting infrastructure business continuity, in the context of the availability of key business processes meeting requirements, and assuring the status of supporting assets compliance relating to health and safety and environmental risks supply chain risks project and program risks corporate risk reporting, incorporating management of risks to business objectives. SWOT analysis Strengths Costs of implementation and ownership are low compared to competitor solutions Acuity states that a large-scale implementation with enterprise licensing for unlimited usage would cost about 100,000, including services costs. Ovum views this as a major competitive advantage for Acuity, as equivalent costs relating to alternative solutions can be far greater. Easy-to-use means of connecting IT risks to business implications Inbuilt, automated integration with IT monitoring tools enables Stream to access IT metrics, which can be understood in a business risk context via configurable relationships of organization structure, IT assets, and key external risk-level metrics (e.g. security status). The solution supports risk-related modeling of potential investments Stream can model risk performance improvement based on potential investments in control changes. This analysis can be across multiple controls, systems, or processes. Weaknesses There are no pre-defined templates for industry-specific compliance requirements Many of the larger competing solutions provide sets of controls out-of-the-box that reduce the costs and timescales to implement measures necessary for some heavily regulated industries such as financial services, energy, and healthcare. Although customers can import such control information to Ovum. All rights reserved. Unauthorized reproduction prohibited. Page 3

4 Stream (from existing systems such as spreadsheets) this is an extra task compared to the larger competing solutions. Acuity currently has a limited number of partners supporting implementations Implementation support is available via partnerships in a growing number of European countries and in Saudi Arabia, and the company has plans to extend its partner base to 12 major countries across all continents in This is likely to include another major European economy via a major consultancy s headquarters there. However, prospective customers in some geographical areas, particularly the Americas and Asia, cannot currently benefit from local implementation support. Opportunities Scalable licensing for Stream can provide reduced ownership costs Licensing for Stream is payable in bands determined by the number of risk registers or compliance reporting views that a customer manages with it. Organizations can try out Stream initially on a free basis, and three payable options allow limited-cost adoption as it is used to manage more risk and compliance data. Pre-configured standards templates help reduce implementation timescales Customers are provided with templates for numerous commonly used standards, such as ISO standards relating to cyber security, business continuity, health and safety, environmental responsibility, IT service management, quality management, enterprise risk management, and supply chain (as well as many others). The templates are amongst features that reduce implementation timescales to very short periods compared with the equivalent for larger-scale competing solutions. Threats Larger competitors could introduce cut-down solution versions to win in the smaller-scale market Larger GRC competitors mostly compete for very large customers, but there will come a point where certain of these vendors realize this market approach will not sustain them. Foreseeing this, it is likely that cut-down versions of larger solutions will be marketed for the type of smaller-scale implementation that is currently the target market for Stream. Many organizations are persuaded that large-scale GRC implementations are a necessity Contrary to this perspective, Ovum believes that rapid delivery of benefits is an essential cultural factor for some organizations, especially when funding sources or time constraints are significant challenges (in the context of investing in GRC capabilities). Also, the organizational appetite and capacity for extensive change should be considerations when assessing the feasibility of adopting larger GRC solutions, and the scale of organizational commitment needed must be viewed realistically. Ovum. All rights reserved. Unauthorized reproduction prohibited. Page 4

5 Data sheet Key facts about the solution Table 1: Data sheet: Acuity Risk Management Product name Stream Integrated Risk Manager Product classification GRC, risk management Version number 4.0 Release date March 2015 Industries covered All Geographies covered Implementation support is available via partnerships in a growing number of countries. Relevant company sizes SMEs commonly use Stream for all enterprise risks, whereas larger organizations tend to deploy Stream for one or more specific risk applications, such as cyber risk, supply chain risk, etc. Platforms supported Windows application with a Microsoft SQL Server database. Fat-, thin-, or browser-based-client options. Languages supported English, French, Dutch, Spanish, Russian Licensing options Based on number of risk registers or compliance views. Free to download for single user and up to five risk registers. Upgrade levels available, up to unlimited data volumes. Deployment options On-premises, hosted, or SaaSApp available for access from ipad, iphone, and Android devices. Routes to market Direct, mainly in Western Europe.Online, for small-scale requirements.via reseller partners, in individual countries. URL Company headquarters London, UK Source: Ovum Appendix Methodology Ovum SWOT Assessments are independent reviews carried out using Ovum s evaluation model for the relevant technology area, supported by conversations with vendors, users, and service providers of the solution concerned, and in-depth secondary research. Further reading Assessing the Requirements for Enterprise Governance, Risk, and Compliance (GRC) Solutions, IT (March 2015) External factors continue to drive enterprise GRC solution adoption, IT (March 2015) IT Governance: Enterprise Priorities 2014, IT (April 2014) IT Governance: How to Target Ongoing Organizational Benefit, IT (January 2015) Organizations must establish IT governance that will continue to deliver value, IT (December 2014) Ovum. All rights reserved. Unauthorized reproduction prohibited. Page 5

6 Author Alan Rodger, Senior Analyst, Enterprise ICT Management Ovum Consulting We hope that this analysis will help you make informed and imaginative business decisions. If you have further requirements, Ovum s consulting team may be able to help you. For more information about Ovum s consulting capabilities, please contact us directly at consulting@ovum.com. Copyright notice and disclaimer The contents of this product are protected by international copyright laws, database rights and other intellectual property rights. The owner of these rights is Informa Telecoms and Media Limited, our affiliates or other third party licensors. All product and company names and logos contained within or appearing on this product are the trademarks, service marks or trading names of their respective owners, including Informa Telecoms and Media Limited. This product may not be copied, reproduced, distributed or transmitted in any form or by any means without the prior permission of Informa Telecoms and Media Limited. Whilst reasonable efforts have been made to ensure that the information and content of this product was correct as at the date of first publication, neither Informa Telecoms and Media Limited nor any person engaged or employed by Informa Telecoms and Media Limited accepts any liability for any errors, omissions or other inaccuracies. Readers should independently verify any facts and figures as no liability can be accepted in this regard readers assume full responsibility and risk accordingly for their use of such information and content. Any views and/or opinions expressed in this product by individual authors or contributors are their personal views and/or opinions and do not necessarily reflect the views and/or opinions of Informa Telecoms and Media Limited. Ovum. All rights reserved. Unauthorized reproduction prohibited. Page 6

7 CONTACT US INTERNATIONAL OFFICES Beijing Dubai Hong Kong Hyderabad Johannesburg London Melbourne New York San Francisco Sao Paulo Tokyo Ovum. All rights reserved. Unauthorized reproduction prohibited. Page 7