Accelerated Risk Management Workflows

Evidence and data. Organizations experienced accelerated risk management workflows, driven by a reduction in time spent on creating and managing risk registers, and a streamlined risk attestation process. Protecht replaced manual, spreadsheet-based processes, enabling risk teams to efficiently build and manage risk registers tailored to their specific needs. Automated workflows also eliminated the need for paper-based approvals and manual follow-ups in risk attestation processes.

• The compliance and risk officer shared that it used to take 80% to 90% of his time just managing and building risk registers. Shifting from manual spreadsheets to Protecht ERM — a configurable, dynamic risk register system —has reduced that time by up to 60%.

• Previously, it took the GRC manager at the Australian organization two months to complete the model risk attestation process. After adopting Protecht ERM, much of the process was automated, removing the need for manual follow-ups, which reduced the time spent on the attestation process to two weeks. They shared: “We’ve alleviated the need for someone to print out a piece of paper and get five or six signatures. It’s all electronic now.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Four GRC specialists are involved in managing and creating risk registers.

• Each GRC specialist spends 32 hours a week managing risk registers. After deploying Protecht ERM, this duration is reduced by 60%.

• Three GRC specialists and one risk analyst are involved in the model risk attestation process. They each spend two months (i.e., 320 hours) managing the process in their legacy environment.

• After deploying Protecht ERM, there is a 75% reduction in time spent on risk attestation process.

• The average fully burdened hourly salary for a GRC specialist and risk analyst is $75 and $65 respectively.

• A productivity recapture rate of 50% is applied under the assumption that not all time saved is fully realized as additional productive time.

Risks. Organizations may realize results might differ from those presented in the financial model due to:

• The time spent by GRC specialists and risk analysts on risk management workflows in their previous state.

• The average fully burdened hourly salary rates for GRC specialists and risk analysts.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $412,000.

Time Savings From Improved Reporting Capabilities

Evidence and data. Interviewees shared that their previous reporting processes were highly manual and inefficient. Risk owners struggled to update information, while risk managers had to extract, reformat, and compile data from spreadsheets for each reporting cycle — which often required multiple iterations. Protecht ERM addressed these challenges through customizable dashboards and reports. With intuitive dashboards and configurable reporting tools, teams could instantly access trend insights and generate consistent, accurate reports. This significantly enhanced operational efficiency, reduced manual effort, and minimized the risk of reporting errors.

• On average, interviewees noted that their organizations spent 16 hours creating each report prior to deploying Protecht. The compliance and risk officer at an Australian financial services organization shared: “Our previous solution was very difficult for risk owners to update. The risk manager at the time would have taken data from a spreadsheet and then uploaded it manually, then redownloaded it to another spreadsheet and had to reformat it. So, it was a very, very clunky process, and it was essentially a loading exercise every quarter when we had to do the reporting.”

• After deploying Protecht ERM, interviewees reported up to an 80% reduction in time spent on creating reports. This improvement was attributed to the platform’s powerful reporting capabilities and intuitive dashboards. As the chief risk officer at an Australian financial services organization noted: “Dashboards are live and easy to build. Reporting is no longer a chore.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• It creates 120 risk reports annually.

• After deploying Protecht ERM, there is an 80% reduction in time spent creating reports.

• The average fully burdened hourly salary for a risk manager is $85.

• A productivity recapture rate of 50% is applied under the assumption that not all time saved is fully realized as additional productive time.

Risks. Organizations may realize results might differ from those presented in the financial model due to the: 

• Number of reports created annually.

• Time spent creating reports in the previous environment.

• Average fully burdened hourly salary of a risk manager.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $146,000.

Elimination Of GRC-related Professional Services Fees

Evidence and data. Organizations previously incurred third-party data management costs due to the complexity and siloed nature of their legacy systems. The senior manager of enterprise risk support in the US financial service organization shared that they had to outsource the manual task of updating risk registers, as changes made in one register were not automatically reflected across all registers. Protecht eliminated these costs by providing an integrated, centralized platform where updates were automatically synchronized across related registers.

• The senior manager of enterprise risk support in the US financial service organization explained that in their legacy environment, they had no central risk library, and every risk register had its own table. Updates in one register had to be manually replicated across all other registers, or there would be data inconsistency.

• Their organization also had to outsource these updates to a third-party vendor due to the sheer volume of manual work required.

• After adopting Protecht, there was no need for manual intervention, and they were able to eliminate these third-party costs.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Third-party data management costs amount to $40,000 in Year 1 and increase by 5% year-over-year.

Risks. Organizations may realize results might differ from those presented in the financial model due to:

• The previous environment and process of managing and updating data.

• The cost and service structure agreed with vendor.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $83,000.

Decommissioned Legacy Technology

Evidence and data. Upon deployment, organizations that were previously using legacy GRC systems were able to decommission them completely, thus eliminating associated licensing costs.

• The senior manager of enterprise risk support at the US financial services organization shared that their organization’s legacy system was built up over a decade by previous employees, and required a lot of manual workarounds. This made the system difficult to scale or adapt. Protecht replaced this dated system with a modern, configurable platform that enabled the team to manage risk more effectively.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite uses a legacy GRC system in the previous state and retires the solution upon adopting Protecht.

• The cost of the legacy GRC solution is $170,000 in Year 1 and increases by 5% year-over-year.

Risks. Organizations may realize results might differ from those presented in the financial model due to:

• The legacy environment of an organization (i.e., whether there is an incumbent GRC system).

• The cost of the legacy solution, if applicable.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $354,000.

Reduced Effort In Audit Administration

Evidence and data. The chief risk officer from the Australian financial services organization shared that it took their organization an average of 20 hours to complete admin and management tasks associated with closing each audit. Each finding involved multiple actions, owners, and due dates, which they had to follow up through emails, and manually track in spreadsheets. Significant effort had to be spent compiling the data for closure.

• Since deploying Protecht, they were able to streamline and automate workflows, resulting in a 75% reduction in time spent on audit administration tasks.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• It conducts 40 audits annually.

• In the prior state, the average time spent on admin tasks is 20 hours per audit.

• The time spent on admin tasks associated with audit closures decreases by 75% after deploying Protecht.

• The average fully burdened hourly salary of an audit manager is $85.

• A productivity recapture rate of 50% is applied, under the assumption that not all time saved is fully realized as additional productive time.

Risks. Organizations may realize results might differ from those presented in the financial model due to the:

• Number of audits conducted annually.

• Previous process and time spent on administrative tasks associated with audit closure.

• Average fully burdened hourly salary rate of an audit manager.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $54,000.

Unquantified Benefits

• Improved risk culture and ownership. Interviewees reported a marked shift from compliance-driven behavior to proactive risk ownership. This decreased the likelihood and impact of negative events such as penalties, audit findings, and control failures. Protecht ERM enabled risk to become a visible, accessible, and shared responsibility across the organization. The compliance and risk officer of the UK financial services organization noted that the solution brings the risk register to the top priority in risk owners’ desktops, transforming updates from a burdensome task into a routine part of leadership accountability.

• Ability to create specific, custom registers. Protecht ERM’s flexibility allows organizations to build tailored registers to meet unique, emerging needs — often replacing manual, spreadsheet-based workarounds. Interviewees mentioned several use cases that previously had no formal tracking mechanism, including freedom of information (FOI) requests, death grants, physical security assessments, facilities lease renewals, and policy exception programs. The ability to customize registers internally — without relying on external consultants — is considered a major value driver.

• Better visibility across risk and compliance. Protecht ERM consolidated disparate systems and manual processes into a single platform, which eliminated data silos and enabled holistic oversight to reduce reliance on fragmented spreadsheets and manual reconciliation. Interviewees described how the solution provides a clear overview across risk, compliance, audit, and incident management. Better visibility helped to prioritize resources and reduce blind spots that previously led to control failures. The ability to connect data across registers and roll it up to enterprise-level risks grants transparency for senior leadership and board reporting, enabled strategic alignment, and improved incident response capabilities. By improving visibility and control, Protecht helps organizations avoid risks that could otherwise lead to compliance breaches or operational disruptions. This was one of the principal considerations for interviewees to select Protecht over alternatives.

• Scalable, intuitive UI and flexibility in design. Interviewees praised Protecht ERM for its clean, user-friendly interface and adaptable design, which supports rapid onboarding and cross-functional adoption. New users — even those unfamiliar with GRC — could learn the platform quickly, and the continuous page layout makes it easy for risk owners to view ratings, controls, obligations, and actions in one place. The solution’s intuitive design was often cited as a key factor in its widespread adoption across general users, many of whom only access the system occasionally.

• Streamlined incident management. Protecht ERM significantly improved incident capture, triage, and resolution through automation and workflow integration. The chief risk officer from the Australian financial services organization said there was a 300% increase in incident reporting at their organization year-over-year, attributing the rise to better accessibility and awareness rather than an increase in actual incidents. The solution enabled faster triage and reduced both manual effort and lapsed time. Anonymous incident reporting via direct system links eliminated the need to transfer email-based breach reports into spreadsheets manually, ultimately reducing human error and improving data integrity.

• Enhanced vendor management. Interviewees highlighted Protecht ERM’s ability to improve vendor oversight and streamline onboarding processes through enhanced monitoring and automation. The adoption of vendor risk management capabilities — including control effectiveness ratings, residual risk scoring, and third-party risk assessments — enabled more structured and proactive vendor oversight. One financial services organization also implemented a Vendor Evaluation Form (VEF), which reduces the number of touchpoints required during onboarding and allows business units to initiate vendor assessments directly. These improvements led to greater SLA adherence, while the ability to monitor and report on SLA performance held internal stakeholders accountable and reduced delays caused by interdepartmental handoffs. Protecht ERM’s centralized vendor library and assessment workflows also support risk-based prioritization, allowing teams to focus on high-criticality vendors and reduce unnecessary assessments for low-risk engagements.

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Protecht ERM and later realize additional uses and business opportunities.

The interviewees consistently emphasized the flexibility of the Protecht ERM platform as a key enabler of future scalability and strategic alignment. While not directly tied to quantified financial benefits, this flexibility supports long-term value realization and organizational agility via:

• Deploying additional modules. Interviewees expressed strong interest in expanding their use of Protecht ERM through additional modules, particularly:

  • Compliance management. Interviewees shared that they aim to leverage Protecht’s compliance capabilities to streamline regulatory change management, automate obligation tracking, and reduce reliance on manual spreadsheets. For example, a senior manager of enterprise risk support noted that their organization is actively building out their compliance regulatory library and planning API integrations to automate updates from regulatory sources.
  • Cyber risk management. A director of compliance and risk and a GRC manager highlighted plans to adopt cyber risk modules to better segment and manage risks across outsourced IT providers, internal operations, and data administrators. This modular approach allows for granular control and tailored risk oversight.

Protecht’s modular architecture and marketplace offerings were frequently noted as a differentiator during vendor selection. As the compliance and risk officer from the UK financial services organization noted, “It was a system that could give us what we wanted at that time, but it would also give us what we wanted in the next five years.”

• Implementing AI functionalities. Interviewees were optimistic about the potential of Protecht’s upcoming AI capabilities, particularly in areas such as:

  • AI chat features. Interviewees anticipate using conversational AI to assist with system navigation, user support, and contextual guidance —especially for new or infrequent users.
  • Data analysis. There is strong interest in leveraging AI to aggregate and interpret data across registers, identify directional risk trends, and support strategic decision-making. For example, a senior manager of enterprise risk support is exploring AI-driven analysis to support business continuity planning and risk aggregation across more than 3,000 risks and beyond 2,000 controls.
  • Automated risk scoring and formula interpretation. A GRC manager and a GRC officer expressed interest in AI tools that could assist with interpreting risk scoring formulas, control ratings, and dashboard logic — further reducing manual effort and improving consistency.
  • Framework mapping and gap analysis. AI is seen as a potential solution for automating the linkage between legislative frameworks, obligations, controls, and risks. This is currently a manual and time-intensive process.

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).