Avoided Costs Across GRC-Related Activities

Evidence and data. The interviewees shared that Enterprise GRC enabled their GRC teams to become increasingly productive in their roles, allowing their organizations to save on costs associated with additional hires. Enterprise GRC provided their organizations with a centralized, shared, governed platform for risk, controls, and compliance assessments, replacing fragmented processes, scattered data and documentation, manual reporting, and reconciliation and restatement work. As such, employees spent far less time gathering, normalizing, reconciling, and manipulating data and more time on actual risk and compliance analysis.

Centralization on a governed platform not only reduced the amount of data searching, manipulation, and reconciliation but also enabled GRC teams at the interviewees’ organizations to consolidate controls, policies, and risks, removing duplicates and aligning taxonomies and processes. For example, the Head of compliance analytics at the European banking organization reduced the risks they regularly tracked by between 73% and 76%, with a focus on the most material risks. Similarly, the global operational risk management director from the global banking organization reported reducing the number of controls they had to track for effective risk mitigation by more than 50%.

Lastly, with data readily available, GRC teams reduced the time they spent on reporting workflows and audits while increasing report quality and audit results. For example, the head of compliance technology and enablement from the global insurer said, “Quarterly reports that previously required weeks of manual aggregation are now prepared in one to two days.” The director at the healthcare company said, “Enterprise GRC helped establish an RPA-integrated workflow that saved us 1,800 hours annually on universe validation.”

Modeling and assumptions. For the composite organization, Forrester models the following:

• Data management process improvements in Year 1 are equivalent to avoiding six FTEs on an ongoing basis. Two additional FTEs are avoided by Year 2 on an ongoing basis.

• Risk, policy, and control management process improvements in Year 1 are equivalent to avoiding two FTEs on an ongoing basis. One additional FTE is avoided by Year 2 on an ongoing basis.

• Reporting and audit process improvements in Year 1 are equivalent to avoiding two FTEs on an ongoing basis. One additional FTE is avoided by Year 2 on an ongoing basis.

• The average fully burdened annual salary for GRC team members is $160,000.

Risks. This benefit may vary across organizations due to:

• The maturity of existing GRC tools and cross-departmental collaboration.

• Current team size and maturity of current GRC processes and talent.

• The regulatory environment in any given authority and industry.

• Variations in labor costs and labor regulations.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $4.2 million.

Technology Cost Savings

Evidence and data. The interviewees noted how their organizations reduced the cost of legacy technology tools and their associated infrastructure and labor. For example, the director at the healthcare organization reported replacing several preexisting technologies with Enterprise GRC, including a legacy GRC solution, an HR policy system, and hundreds of intranet sites.

Other interviewees reported replacing tools and solutions such as internal controls repositories, database management systems, homegrown GRC systems, myriad spreadsheets, and other disaggregated data tracking systems.

Importantly, before implementing Enterprise GRC, the interviewees incurred the above technology expenses and still heavily relied on manual processes for data cleansing; data entry; record maintenance; risk, policy, and control management and testing; risk assessments; reporting; and audit-related work.

Modeling and assumptions. For the composite organization, Forrester models the following:

• The composite replaces a legacy GRC solution in Year 1, saving $500,000 annually.

• When it decommissions the legacy GRC solution, the composite also recognizes savings on the associated labor, equivalent to one system administrator FTE who has an average fully burdened annual salary of $117,000.

• It conservatively keeps two additional tools related to compliance management, audit and issue tracking, risk-related workflows, documentation management, and process oversight until Year 2. Upon decommissioning these tools, it saves an additional $500,000 annually. The composite then also realizes labor savings equivalent to one additional system administrator.

Risks. This benefit may vary across organizations due to:

• The number and mix of homegrown and vendor GRC solutions.

• The mix of cloud versus on-premises solutions.

• The amount of data aggregation.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $2.3 million.

Reduced Risk Of Fines And Reputational Damage

Evidence and data. The interviewees shared how consolidating data and processes under MetricStream’s Enterprise GRC improved their organizations’ risk and compliance postures and reduced the likelihood of future violations. With regard to customers, the interviewees reported that Enterprise GRC improved risk management, control monitoring, issue tracking, due-date management, and visibility across subsidiaries, which reduced risk, audit likelihood, and the possibility of repeating prior failures in different departments. By building RPA processes on top of Enterprise GRC, the interviewees shared that files matched the format required by regulatory standards and reduced the risk of oversight-related penalties. By linking risks, processes, policies, controls, and incidents together, they improved discipline and data quality, which reduced regulatory exposure. Relative specifically to auditors, Enterprise GRC enabled the interviewees’ organizations to provide direct, read-only access to centralized, timestamped, and sourced risk and compliance data. Regulators could be certain that the organizations were using standardized definitions, taxonomies, and processes, effectively matching regulations. Lastly, Enterprise GRC provided regulators with an enterprisewide view into processes and controls linked to risks. The Head of compliance analytics from the banking sector shared, “Regulators want to know you’ve covered your entire organization. We can now demonstrate that clearly.”

Modeling and assumptions. For the composite, Forrester models the following:

• The average total cost of regulatory penalties, including fines and internal costs to remediate, is $5,000,000 annually.

• The composite loses an average of $10,000,000 annually from reduced revenue or customer loyalty due to reputational damage.

• Modernization of GRC practices leads to a 20% reduction in the likelihood of a violation.

• Thirty-three percent of this reduction is attributable to technologies like MetricStream as opposed to people and processes.

• The reduction in the likelihood of a violation attributable to MetricStream Enterprise GRC is 6.6% (20% x 33%).

Risks. This benefit may vary across organizations due to:

• The prior state of GRC-related people, processes, and technology.

• The average incident rate, fine amount, and reputational damage sustained based on geography and industry.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $2.0 million.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Centralized source of truth. Interviewees often stated that their organizations’ ultimate goal for investing in MetricStream’s Enterprise GRC solution was to centrally locate and share consistent, high-quality information across their entire enterprises. Having holistic organizational GRC data available led to better and faster decision-making. The director at the healthcare company shared, “Enterprise GRC enables us to make faster decisions because we can see everything across the whole company.”

• Enabled early AI solutions. By having clean, consistent data flowing through GRC processes, the interviewees’ organizations were able to standardize workflows for testing, issues, actions, and policies. This standardization enabled their GRC teams to pilot new AI solutions to help employees retrieve policy guidance more easily, interpret documents faster, and generate suggested remediation actions based on past patterns. The interviewees emphasized these capabilities are early‑stage and exploratory, but shared that having structured, daily GRC data available is what makes this experimentation possible across their global teams. The head of compliance technology and enablement at an insurance organization shared, “Because all our compliance work now follows the same structure in the GRC platform, we finally have the foundation to start experimenting with AI — whether that’s helping people find policy answers faster or suggesting actions based on what’s worked before.”

• Improved collaboration across regions and roles. Interviewees noted experiencing improvements to cross-region and cross-departmental collaboration. Decision‑makers in different units could collaborate more effectively because they had a shared, consistent picture of the state of their GRC practices. The director at the healthcare company shared: “Leaders can see everything at the parent level all the way down through the subsidiaries, including deficiencies, risks, due dates, and lateness. ... If an issue occurs in one unit, others can see how it was remediated and reuse the approach.” The global operational risk management director from the North American banking organization said, “The bank now establish[es] a consistent, enterprisewide set of definitions around operational risk, so teams are all singing off the same song sheet.”

• Importantly, and as alluded to earlier, the interviewees noted improving their ability to collaborate with regulators directly. The head of compliance technology and enablement at the insurance organization shared, “Regulators can sample evidence directly in the tool — reviews that used to take much longer now finish in an afternoon.” This reduced friction for all involved, including compliance, risk, legal, and local country teams.

• Deduplication of risk register and controls inventory. Interviewees discussed how their organizations reduced the number of risks and controls they worked with by more than 50%, providing time savings to a number of workflows and enabling sharper focus on truly important details from a risk and risk mitigation perspective.

• Increased regulator and customer trust. Interviewees described trust improving with regulators and customers. The insurance company’s head of compliance technology and enablement shared, “Regulators now receive direct walkthroughs in the GRC, and inspections can be satisfied in as little as 2 hours because everything is fully documented.” They attributed their strong regulator relationships to better insight, better documentation, fewer repeat issues, and faster remediation thanks to MetricStream’s Enterprise GRC solution. Regarding customer trust, the director at the healthcare company noted better protection of member data (especially in the context of third‑party oversight and preventing potential breaches), more consistency of compliance culture from the CEO downward (which reinforces public trust through strong governance), and stronger controls across subsidiaries (which improves enterprise reliability and reduces risk exposure), all thanks to MetricStream.

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement MetricStream’s Enterprise GRC and later realize additional uses and business opportunities, including:

• Key-person risk resiliency. Interviewees noted that MetricStream’s Enterprise GRC improved organizational flexibility by defending against key-person risk. Before MetricStream, the organizations depended on key employees who had specific knowledge or skill sets related to how data should be restated; how processes ran across spreadsheets, databases, and other disparate GRC data sources; and how to reformat siloed data in consistent reporting frameworks. After the investment, there existed a central repository for controls, deficiencies, and risks; a unified taxonomy of risk, products, and processes; and a standard way to document, track, and share all of these. The global operational risk management director from the North American bank shared: “Before, we would lose a key person with a certain skill set and there would be an impact, a cost to us, of losing that knowledge. With Enterprise GRC, we’ve come a long way in our maturity with respect to that operational risk.”

• Scale. Interviewees shared how MetricStream’s Enterprise GRC solution was able to scale with their use cases and needs. For example, the director at the healthcare organization said: “Scaling to 4,000-plus core users, 14,000 total users, and multiple subsidiaries wasn’t hard at all. We just add a new branch within the system. It’s very easy.” Similarly, the global operational risk management director from the North American banking organization reported leveraging Enterprise GRC’s single enterprise taxonomy, single control library, and consolidated risk methodology to scale across seven strategic business units and multiple geographies.

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).