ARIS vs. BWise

Well suited for enterprise architecture modeling where the intent to document elements beyond processes as well, such as risks and controls, KPIs, systems, org charts, etc. It also has the excellent capability of creating custom reports, hence if looking for various views right from summary to detailed, this is a great tool. It is less appropriate for implementing the processes as it is not very strong in BPMN.

Well suited for general compliance, multiple initiatives, and integration with TeamMate. SAP GRC Process control may be better suited for an SAP environment. Oracle GRC may be better suited for an Oracle environment. Overall, BWise is a very cost effective, and flexible solution.

Incentivized

• Query feature is excellent to extract information in a specific manner.
• Ability to create custom reports.
• Collaboration feature is very good.
• Semantic checks to check validation errors.
• cloud based central repository.

Incentivized

• Great reporting tool (uses SAP Business Objects). It is quite flexible on types of reports that can be created and supported. Also the reporting consultants are very competent and nice.
• Highly customizable solution: almost everything can be tailored to an organization's needs, assessments, audits, issues, recommendations, tasks, etc. However, there's a trade-off between customization and the integration of different areas of the organization.
• Increases visibility and efficiency in the organization. BWise offers centralized repositories (catalogs) that can be easily accessed and used by everyone in the organization (e.g. Process catalog, Policies and Procedures catalog, Risks, Controls, Laws catalogs, etc.). Also, the application allows findings on controls tested by Audit to be automatically reflected in controls monitored by SOX for example, without the need for SOX to retest them. So one area can leverage on the work of other areas increasing operational efficiency.
• Increases integration and avoids silos. By choosing the correct design (e.g. Risk Workshops instead of Open Assessments), one area can see and benefit from another areas' work. An example was mentioned above; another would be Operational Risk area considering the results of Business Continuity, Vendor Management, Info Security, etc. assessments when carrying out theirs. Additionally, processes can be integrated: when contracting a new vendor for instance, one can include questions about data confidentiality and usage of models in the Vendor risk assessment. Answers to these could then trigger Info Sec / Model Risk assessments.
• Increases accountability. Application provides full audit/change log with the type of change, name of executor, and date of change.
• Easier follow-up. BWise sends automatic emails with reminders to the people required to take action on an issue, assessment, etc.

Incentivized

• Defining databases, use of entities and relationship diagrams, define data, like data models, there is still a part they could improve.
• Providing more standard reports and improving on access rights and privileges functionality

Incentivized

• Integration with SAP for continuous control monitoring.
• Control mapping to standards: ISO; COSO; COBIT; HIPAA; SP800_53 (NIST); FedRAMP; PCI_DSS; BITS; GAAP; AICPA; BSI; CCM; COPPA; CSA
• Surveys.

Incentivized

BWIse is very flexible, and an affordable GRC tool.

Incentivized

I am a BPM and Enterprise Architect Consultant and hence have been using different BPM and EA tools for consulting practice. Until now I have used Opentext Provision EA,Sparx EA, MS Visio and IBM Blueworks. All of the tools used are good and have their own unique features and capabilities. ARIS BPA is widely used by my current organization for different projects.

Incentivized

I found BWise to be very intuitive and user friendly.

Incentivized

It has good, even complex functionality that is provided by its library and ability to create relations between items, yet it is not hard to use. Anyone can use it in a short time. It provides reporting abilities and good documentation with the availability of exporting options. The only drawback I have seen was user management/login issues.

Incentivized

BWise support is knowledgeable and responsive. Bug fixes and development are also timely and ongoing.

Incentivized

The main issues were managing the internal conflicts and competing objectives, rather than the capability and implementation of BWise itself.

Incentivized

The Service area, they have been very useful. ARIS suite is covering number of applications. ARIS engine is very powerful and robust. The tool can be configured in many ways which can be beneficial but can be a curse at the same time. As a user, you need to apply this flexibility with care.

Incentivized

Wasn't personally involved in the vendor selection process. I am aware that one of the main drivers for selecting BWise was cost (I believe BWise total project cost was several times lower than MetricStream's).

Incentivized

• Documentation of processes made it possible for anyone to see who does what, how and using what systems.
• Dependency on specific people is eliminated.

Incentivized

• Increased employee efficiency especially considering incident management and follow up.
• Increased visibility and senior management information/awareness.
• Increased employee accountability.
• Reduction of silos.

Incentivized