AuditBoard vs. Proofpoint Intelligent Compliance vs. Secureframe

Auditboard is especially useful for SOX control testing. It is very convenient having all our information on a single platform. It is easy to communicate PBC requests to clients, store control testing working papers for review, communicate deficiencies and build dashboards to provide visual statistics. Situations where it might not be useful are for organizations that are smaller in size where the templates don't fit well with their internal audit/controls program. There is a significant amount of testing required before using the platform, and adapting working papers to fit in well with AuditBoard

Incentivized

Proofpoint Intelligent Compliance is well suited for organizations with a large amount of employees, in my opinion, as they have a lot of options for grouping users in various ways to send specific learning content to them. For a smaller organization, the employees might utilize all of the built-in training videos, phishing simulations, and content more rapidly, which would not justify the pricey cost of the tool.

Incentivized

• AuditBoard allows real-time collaboration between control and business owners and auditors.
• AuditBoard has a lot of fantastic training sessions and office hours to help users make the most of the product.
• AuditBoard has great customer service personnel to answer questions and troubleshoot any issues.

Incentivized

• Email archiving. Being able to access, on the fly, your entire email archive. Being able to filter by date, sender, attachment, etc. It can get really granular and is able to pull up records fast.
• Targeted Attack Protection for all incoming emails. Having the ability to automatically scan, quarantine, or re-write URLs within emails. Comparing incoming emails to potential phishing attempts already seen by other institutions.
• Email encryption & automatic encryption are based on certain rules set up on the firewall. e.g. automatically encrypt outgoing email if it has an attachment or contains a string of numbers that may be personal information.

Incentivized

• We used to perform our Risk Control Analysis (RCA) for each audit's planning in an Excel spreadsheet. Once we purchased the Risk Oversight module, AuditBoard helped us convert the RCA to a system function rather than a spreadsheet. At first, we lost some of the functionality the spreadsheet provided, but AuditBoard did continue to help us build and work towards a solution more similar to what we previously had. Though happy with it, it's still not perfect. As one example, I'd like to be able to link actual Ops Audit work steps that cover the risk and controls being outlined in the RCA, rather than just adding a comment to state which steps cover them. More of a preference, I suppose.
• I also had demoed their beta Resources and Scheduling module, but it didn't have enough functionality at the time to work for how we put the quarterly Internal Audit schedule together (using Excel). One thing I recall was that you couldn't pull in SOX controls or non-chargeable work (such as education or administration) to auditor's schedules; it was meant to schedule the Ops Audits only. It is possible they have already fixed or improved this; I just haven't seen the updated version.

Incentivized

• The end-user interface is lacking in appeal/aesthetics and is not that intuitive. I have seen archive solutions that don't work very well have a better interface than this. I think the interface can be prettied up quite a bit.
• The admin interface is lacking in features and is not intuitive. It has more capabilities than the previous archives I've used, but utilizing these features is a little complicated without demos or being walked through it.
• We have had a lot of accounts not map properly. Apparently, there is a limit as to how many errors can be outstanding before you run into issues because all the emails tied to those issues are "queued" waiting for a home (and there is a storage limit for that). I have to set a reminder to check that periodically and resolve the issues manually.

Incentivized

I remember there were a lot of sync issues when I used the internally developed software, but that's probably because a few people were working on the same project at the same time. I have not come across this issue in AuditBoard

Incentivized

We did a bake off and for our particular needs Proofpoint was the right product. We used a matrix with requirements and their product checked all the boxes. Making it a easy decision.

Incentivized

• Hard to quantify. It was cheaper than the tool we had and we were able to get rid of standalone tool for surveys. overall, just better user experience for all.

Incentivized

• Strengthened our staff's Cybersecurity Skills.
• Provided a variety of additional training content that is used throughout the year
• Allowed us to track and monitor which of our users need additional training in regard to Cybersecurity

Incentivized