MetricStream Platform vs. OneTrust Tech Risk & Compliance

MetricStream is well suited for when you need to pull a report into Excel for further analysis. It is not good for when information needs to be entered as this is all done manually by analysts and managers. If we can implement a way to take parts of uploaded documents and have the system automatically enter the information in the designated fields in MetricStream, it would cut out lots of manual work for our department.

Incentivized

OneTrust provides a repeatable and defined process for vendor assessments but should be adapted to your organization. OneTrust functions well for a centralized document repository. The pricing of modules and what modules are required for workflows to function fully should be better defined. Automated assessments can wind up in spam filters and should be communicated outside of the platform prior to sending to the vendor.

Incentivized

• Easy to navigate.

Incentivized

• Module wise implementation.
• Very reasonable price structure.
• Easy and speedy to implement.
• Product roadmap.

• Speed/efficiency.
• Missing functionality: Uploading documents (Excel sheets) into MetricStream and being able to pull information from that form into the program.
• Improve number of outages and time that it is out for.

Incentivized

• Documentation chasing for assessments is not as automated or hands-off as demos made it seem.
• Getting custom risk matrix set up required professional onboarding.
• Platform is less than intuitive.
• Pricing is module dependent and demos do not highlight which module is included in which workflow.

Incentivized

Archer is more risk-management-friendly in that it has a better interface and more room to conduct risk-related tasks and pull reports.

Incentivized

During the assessment, we found that OneTrust is easier to use, set up, and administer. it has a quick ROI and value for business. The OneTrust product support and roadmap are far more competitive in comparison to TrustArc. OneTrust is specialized in GRC including Data Privacy and Cookie compliance, where Archer is good in Enterprise Risk management.

• It keeps records of all of our vendors and the corresponding documents.
• Other departments can access information on vendors.

Incentivized

• More uniform vendor assessments.
• Defensible numeric metrics reflecting risk.
• Centralized document repository for audit proofs.

Incentivized