MetricStream Reviews

MetricStream is utilized for property risk management by creating a workflow for TPRM. Assessments are assigned to the internal risk questionnaires created for business users. Business owners fill out the internal questionnaire, and upon approval, the auto workflow triggers, sending the Siglite questionnaire to third-party risk management. Vendors fill the DDQ, attach certifications, documents, and policy procedures, and submit it once completed for review.

Interactions with MetricStream occur through dedicated resources to handle documents like DDQs when workflows fail, or questionnaires need updating. Changes can be made from the sandbox, but vendor consultancy is needed for production implementation.

MetricStream's best features include its ease of use, compliance program, TPRM, audit management, and implementation effort. It effectively handles large data volumes and provides good workflow capabilities with decent reporting flexibility and a better user interface.

MetricStream impacts the organization by reducing follow-ups through reminder settings during questionnaire assignments. It automatically sends reminders based on set reminders, fostering trust when configured with the organization's email domain. Metrics improvements like operational efficiency, centralized GRC management, enhanced risk visibility, streamlined compliance, reduced manual efforts, enhanced third-party risk monitoring, improved decision-making with real-time dashboards, and risk analytics follow from automated workflows and issue tracking.

MetricStream could improve by simplifying the user interface to enhance navigation for business users and improve system performance, especially with large data sets. Enhancing reporting and dashboard customization with less technical dependency is important. Reducing implementation complexity for faster deployment is beneficial, as is providing more out-of-the-box templates, workflows, and industry-use cases. Strengthening integration capabilities with business and security tools, and streamlining administrative tasks to minimize maintenance efforts, would help. An enhanced FAQ or knowledge base could address small issues without frequent vendor consultation.

I joined recently, about four years ago, and before my time here, I was not aware of which tool was used; it was manually sending due diligence questionnaires and handling records through Excel spreadsheets.

MetricStream's scalability is impressive. It is an enterprise-grade platform designed to support large global organizations with thousands of users, handling high volumes of risk controls, audits, issues, and assessments. It is well-established with years of adoption across various industries, supporting growth from a single GRC function to enterprise-wide implementations, featuring strong workflow automation for approvals, notifications, escalations, and remediation tracking.

I believe the customer support is excellent and extremely talented, and I rate them 8 out of 10 for their responsiveness and expertise.

Before choosing MetricStream, I evaluated other options like OneTrust and ServiceNow GRC due to their functionalities in IT management, TPRM, and risk management. I considered multiple tools such as AuditBoard, OneTrust, ServiceNow GRC, RSA Archer, LogicGate, and HighBond, but MetricStream is more user-friendly in terms of accessing modules and navigation.

I have seen a return on investment with MetricStream as it reduces manual effort, improves audit efficiency, lowers compliance costs, and increases risk visibility and vendor risk management. Organizations with multiple business units benefit from using MetricStream, especially for managing several regulatory frameworks and replacing multiple GRC tools and spreadsheets. It delivers strong ROI as an enterprise-wide GRC platform with value realized through automation, reduced compliance effort, improved visibility, and efficient auditing. The ROI typically spans one to three years depending on the scope, adoption, and maturity level of GRC programs.

I rate MetricStream an 8 or 8.5 because it has strong areas in TPRM, internal audit, compliance, risk management, reporting, dashboard customization, workflow automation, user experience, and overall enterprise GRC capabilities.

I chose the number 8 or 8.5 because the implementation speed is not up to the mark. Considering areas like enterprise risk management (rating 9), compliance management (rating 9), TPRM (rating 9), internal audit (rating 8.5), workflow and automation (rating 9), customization (rating 9.5), reporting and dashboard (rating 8), user experience (rating 7), and ease of administration (rating 7), while implementation speed averages around 5 to 6, MetricStream is a strong enterprise-grade GRC platform for larger organizations with mature risk and compliance programs.

Regarding MetricStream's AI capabilities, the platform excels at using AI to enhance risk, compliance, audit, and TPRM processes, but AI should be viewed as an accelerator rather than the primary reason to choose MetricStream. The core strength is its comprehensive enterprise GRC functionality, with AI capabilities rated at 7 or 8. AI helps identify risks and trends across large data sets, supports risk prioritization and faster decision-making, improves compliance monitoring, enhances third-party risk assessments, and provides sophisticated dashboards with executive-level insights.

MetricStream's AI capabilities effectively assist GRC teams, though the accuracy and usefulness of outputs heavily depend on the quality of well-structured data. The accuracy is rated at 7 or 7.5. While AI can automate tasks, human decision-making is indispensable for regulatory interpretations, risk acceptance decisions, and audit conclusions.

My advice for others considering MetricStream is to use it if you need a scalable enterprise GRC solution with the resources for implementation and governance. Keep configurations simple, invest in user training, and avoid unnecessary customization for long-term success. I rate MetricStream an overall 8 out of 10.

MetricStream is the enterprise GRC tool for LSEG, and we are using eight different solutions from MetricStream as part of LSEG. We are using RCA, Risk and Compliance Assessment, Control Management, Issue Management, and the Third-Party Risk Management module. Along with that, we are also using Business Continuity Management, Policy Management, and Operational Resilience Management as part of MetricStream use case.

The entire Enterprise GRC in LSEG has been implemented, and we are using another seven modules apart from RCA in MetricStream. We have Control Management, Third-Party Risk Management, BCM, Operational Resilience, and Issue Management. All these modules have been implemented in the same way I explained for RCA at LSEG. Each module has been purchased as an out-of-box solution from MetricStream, and we have done around 20 to 25 solution customizations for each module to ensure that the out-of-box solutions are configured as per LSEG need. GRC is not an individual siloed application, so whenever we are using RCA, BCM, Third-Party Risk Management, or Incident Management, all solutions are integrated. The beauty of any GRC platform is that all these solutions sit under a common umbrella, allowing their data and use cases to communicate. Similarly, MetricStream has been integrated with our internal applications in LSEG, communicating via a centralized data lake where all data related to Risk Control, TPRM, and BCM is sent. Other third-party applications pull data from the centralized data lake, creating an end-to-end workflow across LSEG where data can be sent to and fro via the data lake.

The best features of MetricStream include its centralized application that connects all the different GRC use cases under one roof. It is a plug-and-play tool where after purchasing the GRC product from MetricStream, you receive all the industry standard workflows, requiring a minimal amount of effort to configure or customize the workflows, which typically varies between 10 to 20 percent of the total effort. The beauty of the product lies in its out-of-box solution workflows from MetricStream, which can be integrated with other enterprise GRC solutions under MetricStream.

MetricStream positively impacts our organization significantly by saving costs and enhancing our risk and compliance maturity. As a FinTech operating under heavy regulatory requirements, we require a stringent risk and compliance framework, and MetricStream helps us achieve our target state easily. Each year, we conduct numerous cycles for Risk and Control Assessment, and before implementing MetricStream, it took around three to four months to complete the Risk and Compliance Assessment with a lot of manual activities. Now, with the help of MetricStream, we complete the Risk and Compliance Assessment in approximately 30 to 40 days without a lot of manual follow-ups. It has become a business-as-usual process for us, leading to many improvements in managing critical issues and control testing and assurance. As a highly regulated entity, we meticulously manage our control lifecycle, and MetricStream has streamlined this process effectively, helping us progress in maturity and yielding visible benefits across our risk and compliance posture.

From our perspective, MetricStream can improve by developing the product towards a more low-code, no-code solution. In today's GRC environment, we aim to create a leaner team, avoiding long-term development efforts inside the MetricStream GRC team. After purchasing MetricStream, we desire a product that does not require development teams for customization but enables users to make configurations or adjustments with little effort.

Beyond low-code, no-code, we also seek modernization of reporting and dashboard capabilities. Currently, changing reports and dashboards to fit our organizational needs demands significant time and effort. We require MetricStream to build self-customization capabilities for reporting, allowing end users to configure reports based on their filtering and search criteria, saving bespoke reports only for their visibility. This self-reporting capability will enhance usability and cater to individual needs better.

I have been using MetricStream for the last three years.

MetricStream is scalable at the enterprise level, accommodating around 15,000 users within our instance. In terms of scalability, MetricStream performs very well, and it is also a stable product.

Customer support from MetricStream is very good. We work with MetricStream team to address our issues, and we have consistently received good support.

From LSEG's perspective, we previously did not have any automated solution and managed our GRC needs manually before MetricStream.

There is a measurable return on investment since we have reduced the time for Risk and Control Assessment from three to four months to approximately 30 to 40 days, which lowers costs significantly. Previously, many people were involved in the Risk and Control Assessment activity, but now it is a system-driven business-as-usual activity, saving a lot of costs and reducing time investment. Moreover, it streamlines the Risk and Control Assessment process with a solid end-to-end structure where team members understand their responsibilities clearly after logging into the tool. This brings tremendous cost optimization and reduces noise during the RCA cycle significantly after implementing MetricStream.

There is a strong return on investment. After implementing MetricStream, we have improved our costs because we have automated many reports, workflows, and other tasks through MetricStream.

From my standpoint, MetricStream is a bit costly. We spend a significant amount of money for the product, and I cannot disclose specifics due to confidentiality. Additionally, any customization incurs more costs because we must involve MetricStream consulting team to make the necessary changes.

We evaluated Archer GRC and ServiceNow but found that MetricStream's out-of-box use cases aligned more closely with our business use case, which is why we chose to implement MetricStream as it minimized our customization expenses.

For any customization, a development effort is necessary. It is not very complex, but it is not just a no-code, low-code solution. You need some degree of development effort, requiring the hiring of developers to customize the solution, unlike other no-code, low-code solutions that do not necessitate any developers. In summary, while you need some development effort to customize the solution, it is less complex compared to other heavily customized solutions.

Apart from that, this solution has a defined workflow and a notification system, along with all the features expected from a modernized GRC solution. You do need to spend some effort for customization and some development resources, but the new version of the solution called Euphrates, specifically Euphrates two, supports AI modernization efforts. If you have the latest version of MetricStream, you can build AI functionalities on top of the GRC platform. MetricStream is adopting many AI features compared to other GRC vendors in the market, which is a notable strength.

Before using MetricStream GRC tool, it is essential to understand your actual business use case. Do not purchase any solution blindly; instead, ensure that MetricStream GRC solution aligns with your needs. For example, if you want to implement the control management module, you must assess whether your current control testing processes align with what MetricStream offers and how much customization is necessary.

I would rate this product a 7 out of 10.

My main use case for MetricStream is the audit module within it. I was working for a company that implemented an audit framework, and then I was on one of the client's sides where I was using that developed framework. From a client side perspective, we usually look out for whether the audit structure that we need to develop, as part of our internal process, has been properly configured within MetricStream.

The org structure includes all your entities, where the primary one would be your organizations, and within that, the hierarchy consists of all the processes to be audited, having further sub-processes defined. We also require a frequency developed in MetricStream to schedule the audits, ensuring that they can trigger that an audit needs to be performed at particular frequencies, and when the audit has been performed, it has been scoped in for the processes that have been configured. We used to develop the scope of the audit within MetricStream, with audit fieldwork happening outside, but further, all the testing done with the ready framework called Objective Risk Control testing framework, we have the objectives defined for verifying particular scope items and against that, what is the inherent risk we are looking at. We also see the controls that are there in place, and validating those controls would provide our test results, along with end-to-end documentation of that entire flow. If we identify any issues during testing, we flag them and mark particular stakeholders for each issue, requiring those stakeholders to log into MetricStream and respond to those issues, which is facilitated by an inbuilt workflow for approval and tracking for the audit issues with due dates configured, providing a brief overview of the end-to-end process for the audit module we have used in MetricStream.

MetricStream has been quite helpful, as it ultimately automates my process, reducing manual intervention, with a repository where everything is maintained under one place. If I need an overview of any audit, including issues, stakeholders, and resolutions, I have everything consolidated in one place, making it a foolproof process. MetricStream was truly beneficial, easing the lives of everyone, including auditors and auditees, reinforcing its overall usefulness.

The best features MetricStream offers include a high degree of customization, allowing you to configure it the way you want for your internal processes, such as creating the org structure or defining processes and sub-processes, with many fields that can be configured on your own. The flexibility it provides is unmatched compared to any other tool in the market, and that flexibility to customize it for your needs stands out as one of the best parts of MetricStream.

MetricStream has positively impacted our organization by providing significant improvements and time savings, especially for management representations, where reports customized within MetricStream are exceptional. The ability to showcase specific fields in reports eases the management presentation process. Additionally, the system prepares all the documentation for us, allowing us to refer to anything by logging into the system and checking the specific audit, thus making maintenance of documentation far more efficient.

Improving MetricStream ultimately depends on how well we utilize the system, as its vast capabilities can be customized to meet our needs. It is up to us to mature with the system, discovering features and enhancing our experience as we proceed, potentially with vendor support guiding us on optimizations that could be made.

Regarding the user interface, MetricStream is quite user-friendly with no issues found. However, it is important to ensure the underlying infrastructure has the appropriate server space or RAM to avoid latency issues. Once that is in place, user experience is smooth, and having good vendor support with defined SLAs is essential to ensure timely resolutions for issues, especially since audit activities are time-sensitive.

I have been using MetricStream for more than three years.

We had the necessary infrastructure in place, including minimum server space and RAM requirements, so we did not experience any outages or issues, allowing us to utilize the application reliably without complaints.

Scalability with MetricStream has been satisfactory, with no challenges faced as every department, including compliance and risk, used it seamlessly.

Our experience with customer support through the vendor during implementation was positive, with satisfactory support, provided we had defined SLAs to outline response times and handling of issues accordingly.

It was our first foray into automation within the organization, having previously relied on a manual process, and MetricStream is the first GRC tool we introduced.

Using MetricStream helped us save 15 to 20 days of documentation and collation for management representation since all information is ready in the system. Instead of searching through files, we just generate a report and present it for management inputs or feedback.

Regarding return on investment, I know it was used across teams for risk and compliance modules, providing a consolidated view of its usefulness, but since I was not part of those discussions, I cannot provide specific metrics.

I think we were a bit skeptical about pricing and setup costs, as it required a significant upfront investment, but it is ultimately worth it since we see positive results from the investment, despite having to extend our budget to accommodate it.

We evaluated alternatives such as IDEA and Pentana, a UK-based company, but found the flexibility in MetricStream to be far superior to Pentana, which had limitations such as only the audit module, making MetricStream a clear choice for its broader utility across our teams.

While I have not personally used MetricStream's AI capabilities, I trust that if they have implemented such features, they would meet expectations since I have had a positive experience with them otherwise.

My advice to others considering MetricStream is that it is a useful product, and I fully recommend it based on our good experience. Investing time and resources into it yields benefits for the organization.

My experience with MetricStream has been satisfactory, and I do not have concerns about continuing forward with it. I urge others to explore its full potential to ensure balanced ROI. My review rating for MetricStream is 9 out of 10.

My main use case for MetricStream is to design the GRC workflow. At PG&E, I leverage MetricStream GRC to support compliance with NERC, the North American Electric Reliability Corporation reliability standards, by designing and configuring the end-to-end compliance workflows. I collaborate with compliance subject matter experts, auditors, and other business stakeholders to translate the NERC standards and requirements into structured controls, assessments, and evidence collection processes, issue management workflows, and remediation tracking within MetricStream. I map regulatory obligations to control activities, configure the approval workflows, automate compliance attestations and notifications, and establish traceability between standards, controls, risks, findings, and corrective action plans. By doing this, it enables centralized compliance monitoring, improves audit readiness, reduces manual tracking efforts, and provides leadership with real-time visibility into compliance status across multiple NERC standards.

This solution streamlines compliance operations, reduces manual effort by approximately thirty-five percent, improves audit preparedness, and provides real-time reporting and dashboards for compliance leadership overseeing programs impacting about twenty-three thousand plus employees at PG&E. Overall, this was the specific use case I have used MetricStream for.

The top MetricStream features that I found most valuable are control and compliance mapping, workflow automation, issue and corrective action management, and the evidence management repository. Control and compliance mapping was one of the most powerful features for NERC compliance as we can map NERC standards and requirements directly to controls, risks, evidence, and corrective actions, creating end-to-end traceability. During audits, it is very easy to demonstrate which controls satisfy specific regulatory obligations.

Workflow automation allowed us to automate approval workflows, evidence collection requests, compliance attestations, and issue remediation activities, significantly reducing manual follow-ups and email-based tracking. The issue and corrective action management feature provides a structured process for tracking issues, assigning owners, monitoring due dates, and validating remediation activities. The evidence management repository creates a centralized location to manage everything from documents to reports, screenshots, and audit artifacts, creating a single source of truth.

Other helpful features include the dashboard and executive reporting, as well as risk control regulation relationships. These were the features I found most valuable in MetricStream.

Since I have used MetricStream for the last three years, one of the top improvements that comes to my mind is enhanced user experience and UX/UI. I believe that while MetricStream is highly configurable, some workflows can feel really complex for occasional users or first-time users, and I do not find the existing UI/UX experience very intuitive. A more intuitive interface with simplified navigation and role-based dashboards could reduce training time and improve user adoption for both first-time and occasional users.

Additionally, MetricStream could include advanced analytics and AI capabilities. More AI-driven insights using predictive risk analysis and intelligent recommendations could help organizations identify compliance gaps before they become audit findings. Furthermore, simplified configuration and integration could be beneficial; configuring workflows, forms, and integrations currently requires a lot of specialized expertise. Low-code or no-code enhancements and easier integration with enterprise systems such as SharePoint, ServiceNow, SAP, or Azure DevOps could reduce implementation effort and operational time.

The reporting needs enhancement, perhaps by including role-based reporting and simplifying the dashboard, which currently has too much information and can overwhelm first-time or occasional users. It would be better to show only what is necessary or introduce configurations to display what each user wants to see on their dashboard.

MetricStream could definitely improve its accuracy and reliability of output. It could provide more curated, personalized recommendations instead of generic suggestions. Additionally, MetricStream could develop recommendations that align with role-based dashboards instead of providing uniform recommendations across the board.

I have been using MetricStream for three years.

MetricStream's performance is reliable for daily compliance operations, reporting, and workflow executions. For large data loads and complex reports, it is important to maintain responsiveness and user experience, but overall, MetricStream performs well in managing large volumes of data.

MetricStream demonstrates strong scalability by supporting enterprise compliance programs with large volumes of regulatory requirements, controls, assessments, evidence records, and user activity. It effectively supports thousands of users and compliance NERC compliance workflows. Proper configuration, data management, and performance monitoring are important to maintain efficiency as usage grows.

The customer support is great. They assist with all initial questions and if any glitches occur, they are prompt in helping us understand how to configure things. Additionally, when needed, they help set up additional training to walk us through demos of each module to help us make the best use of MetricStream for our organization's needs.

We follow the training guide provided by MetricStream, and we are able to integrate it easily with our systems and data sources, although we did encounter some initial bottlenecks, which we resolved and moved forward.

In my organization, we have a MetricStream onboarding training that I took. Once I completed that, I gained a good understanding of how MetricStream works and started using it to build and design all the GRC workflows.

MetricStream delivers measurable return on investment by reducing manual compliance activities, improving audit readiness, and streamlining evidence management. At PG&E, we observe approximately a thirty-five percent reduction in manual effort due to workflow automation and centralized documentation, which leads to faster evidence retrieval, improved remediation tracking, and better visibility into compliance status. Therefore, I see a positive and substantial return on investment.

I did not handle the pricing, setup cost, and licensing aspects of MetricStream, as that was managed by another team at PG&E overseeing all applications. I was involved once MetricStream was deployed and started building the GRC workflows, so I do not have any experience with pricing, setup costs, and licensing.

Before selecting MetricStream, we evaluated other GRC platforms such as ServiceNow GRC, Archer, and SAP GRC based on scalability, compliance capabilities, workflow flexibility, and integration. I think MetricStream is a stable platform for managing enterprise compliance, supporting NERC standard requirements, audit, evidence management, and regulatory workflows reliably at PG&E.

My advice to others looking into using MetricStream is to clearly define compliance processes, data structures, and user roles before implementing it. Investing time in workflow design, stakeholder alignment, and user training is crucial to maximize adoption. Organizations should also focus on integration strategies, reporting needs, and continuous optimization to ensure MetricStream delivers long-term value for their GRC programs. I would rate this product a seven out of ten.

My main use case for MetricStream is the automation of the IT audit process, governance, risk, and compliance. I was working for a specific third-party client who was implementing MetricStream, and I was contracted to be the administrator of it. As an administrator, I started setting up MetricStream process by entering the controls and started by entering the business process, followed by the financial controls, and then the supporting IT general controls. For each of these controls, I would identify the point of contact, the process owners, and other relevant parties so that they would be responsible for sign-off on the controls. I configured the setup such that if an analyst or an IT audit GRC analyst sends the control evidence, and if the sign-off is pending from the control owner, the control owner would receive a notification indicating that as part of the audit period, the sign-off has to occur. I also configured dashboards in MetricStream for the specific status of the IT audit, which mostly concerned SOX 404 IT general controls testing.

One major thing about MetricStream is its alerting, which was much better than the tool called Resolver GRC, where it not only provided dashboards or the status of the audits, but I could also attach evidences. In that way, evidences are not lost in emails for the audit; they are entirely within the tool.

The best features that MetricStream offers for the automation of audits include the alerting system and the ability to attach evidence. These two things are what I found to be among the best.

The evidence attaching system, in the absence of it, would have required sending the evidence in an email, which would result in a file sitting on the desktop. However, with the evidence attaching system, the file is now within the tool, so it is on the cloud. This way, one never faces issues if someone loses their laptop or if data corruption occurs; you still have access to the evidence of the audit period. It is not dependent on any person anymore. It is very easy to track back on the status of the audit since the application is in the cloud, and all the data is not shared via email, making it much more secure. The alerting system keeps the auditors informed about when an audit is pending, what the timeline is, so they understand their responsibility and are able to efficiently respond.

For our client, MetricStream made the audits incredibly efficient. In real time, I could provide the status of the audit to stakeholders, indicating which controls had deviations, which control was pending, and who it was pending on. It helps in bringing responsibility and ownership to a person, making it much more efficient and faster to conduct audits and understand audit status. Instead of having to hold status calls, with MetricStream, you could just log on, look at the dashboard, and understand where you are in meeting your targets.

There were definitely fewer daily status meetings required after implementing MetricStream; only a weekly status meeting was needed, which involved a walkthrough of the dashboard and what had been done. Overall, the audit time became much more efficient because it was now a nine to five process without last-minute sign-offs at midnight or one day before the audit.

MetricStream at that point did not have a template, and I had to build the entire SOX 404 IT general controls testing framework myself. It depended on how knowledgeable the person using it was. If pre-built templates existed for the latest ISO 27000, ISO 4200, or NIST 853 frameworks, that would be far more helpful.

If MetricStream could provide certifications that the public could learn about MetricStream rather than only offering them to partners, that would be beneficial.

I have been working in my current field for almost ten years, more than a decade of experience.

MetricStream is stable; I never faced any major errors or outages.

MetricStream was pretty scalable, and I was able to deploy it across multiple business processes and integrate it.

Customer support was very quick to respond anytime I needed assistance. I would rate the customer support about eight out of ten.

I was previously using Resolver GRC and switched because Resolver GRC did not have all the advanced capabilities that MetricStream had, including advanced features.

I definitely saw a return on investment; there was a lesser number of audit headcount required, which saved us money and time on audits. Overall, it helped us because I reduced the number of headcount and used MetricStream instead, and the number of hours I needed was less, with no overtime required.

My experience with the pricing, setup cost, and licensing was that it was reasonable.

I only evaluated Archer at that time, but I preferred MetricStream over Archer.

Overall, the API integrations of MetricStream were very good, and I did not face any issues, so it was good.

I did not face any major challenges when customizing MetricStream to fit my organization's needs. The only point was that pre-built templates were absent, which led to a little bit of a learning curve. The good news was that I could customize it very well, so overall, the customization experience was good.

The reporting capabilities of MetricStream were amazing. The dashboards that I created for audits and the reports produced were very good. However, overall, the product did not have analytical capabilities at that time.

The user interface and user experience of MetricStream were intuitive and easy to use.

When I worked with MetricStream, the AI capabilities did not exist because I used MetricStream from 2011 to 2013, during which it did not have any artificial intelligence capabilities.

At the time I worked on MetricStream, AI capabilities were not in place, so I could not provide details about its accuracy and reliability of output.

In the era of different GRC tools available, my advice is that MetricStream is much more reliable because it has been around for a long time and has provided good support to everyone requiring it since the old days. Therefore, it is a reliable tool. I would rate this review overall a seven out of ten.

My main use case for MetricStream is for audit and risk management.

We utilize MetricStream for audit and risk management by developing risk dashboarding and risk library development, standardizing libraries across enterprise organizations where risk management, corporate audit, and other business units can all utilize the same system of record and libraries.

MetricStream's shared system works well across all business units by standardizing similar risks and controls that exist across multiple business units. For instance, IT risk management and information security risk management have overlapping risks and controls, but we standardize them into one centralized risk and control.

The best features MetricStream offers take into consideration all the elements of a full governance, risk, and compliance system from both risk management to corporate audit, being able to develop applications within the solution that meet our needs, having a degree of full customization, as well as reporting, utilizing Infolets and Info Centers to establish reports that may not typically be out of the box and are definitely value-added.

MetricStream's customization and reporting have helped my work significantly. Compared to other systems, we have had the ability to essentially write SQL code that allows us to develop a report in real time that gives us insight into various different KPIs or KRIs leveraged across the organization. In comparison to other systems where you might be limited on what you can develop a separate report on, most of the fields and data captured within MetricStream have been reportable.

A favorite aspect I have regarding MetricStream is a love-hate relationship. The record level security sometimes backfires in terms of configuration, but usually it is relatively easy to work around.

MetricStream has positively impacted my organization by reducing silos across the organization. Having a centralized risk library maintained by risk management allows the corporate audit team to shave time off annual planning and enables more audit work to be done by ensuring validity of risks and controls in the system to support audit testing.

Since implementing MetricStream, audit teams have shaved about two weeks off of annual planning across various teams, allowing audit departments of about 140 auditors across maybe 10 teams to squeeze in 10 extra audits, one audit per each team, if not additional testing.

MetricStream can be improved in several areas. Sometimes the overall flow of the application can seem a bit clunky, based on feedback from clients.

From my understanding and what I have heard from developers within MetricStream during my deeper use of the application, the application seems to have been developed within silos, and the interaction of certain applications internally could definitely be improved in terms of the overall coding that exists between applications within the solution.

The only improvement I suggest for MetricStream is to gather a collaborative think tank from several of the largest clients and compile feedback to prioritize suggested enhancements from multiple organizations.

I have been using MetricStream for a combined total of about six years.

MetricStream is mostly stable.

MetricStream's scalability is adaptable, though the biggest issue I have encountered with clients has been around upgrades that require re-implementing customizations to the out-of-box solutions after significant upgrades.

Customer support from MetricStream has been great. We had to engage with senior management from time to time, but they were responsive and quick in working through our issues.

Before MetricStream, we used Archer, Ideagen, and Thomson Reuters Paisley. We switched because MetricStream was much more robust.

I have not seen specific metrics on return on investment with MetricStream, outside of reducing silos and allowing time savings off of annual planning.

In terms of pricing, setup cost, and licensing for MetricStream, we did run into issues with insufficient licensing, but the ability to acquire new licenses was relatively quick and effortless.

Before choosing MetricStream, we did evaluate other options depending on the client. We chose Archer for one installation and Thomson Reuters for another implementation.

My advice for others looking into using MetricStream is to ensure collective representation from all business units that will be clients of the application across the organization. For example, in a bank, make sure you have audit, risk management, and other departments involved. I would rate this review a 7.

MetricStream is primarily used as a GRC platform, with most banking and non-banking sectors utilizing it for internal audit, third-party risk management, and compliance management, making it a valuable platform for all auditing needs.

Recently, I implemented the internal audit module for one of my clients, which helps auditors work on daily activities without needing to rely on paperwork, allowing them to complete tasks directly on the web.

This is the main use case for the client, and I have also made some modifications based on client requirements, utilizing very useful objects such as forms and data objects. I appreciate that MetricStream has a user-friendly UI, making it enjoyable to work with.

MetricStream offers the best features such as its UI and development utilities that enable developers to complete module development within committed timelines using its built-in functionality.

One specific tool that makes my work easier is the workflow functionality, which helps define how tasks flow through the module, detailing how tasks are allocated to stakeholders while simplifying the process.

MetricStream definitely impacts my organization positively because it is very useful and offers low-code utilities to configure all components, allowing team members to complete tasks quickly.

It helps my organization with time management and ensures compliance with timelines, enabling us to operate efficiently within committed periods.

Currently, I believe MetricStream has sufficient functionality, but for the Indian banking sector, the UI and overall complexity could be improved, as many Indian banks require a simplified UI.

It would be beneficial if MetricStream could embed tools such as Power BI into the analytical software through APIs, as currently it has limited charting options. Integration with external utilities such as Tableau would enhance reporting capabilities.

I have been working with MetricStream for around four years with the M7 platform, and I am satisfied with working on MetricStream.

MetricStream's stability is very powerful, and it can handle a lot of tasks effectively.

MetricStream has huge scalability as it is one of the powerful platforms with M7, supporting all environments including local and cloud setups.

The customer support for MetricStream is very good and responsive, and I have communicated with the OEM, who typically responds within 24 hours.

I have been using MetricStream exclusively from the beginning and did not previously use a different solution.

I have not tried any other solutions, but I am currently learning about SAI360 and ServiceNow GRC.

MetricStream is deployed as an on-premises solution in my organization.

MetricStream's AI compatibility is definitely useful for upcoming projects and governance security, which will be beneficial for future features.

I believe that the accuracy and reliability of MetricStream's AI capabilities will enhance its features, leveraging a good team for backup resources.

MetricStream offers compatibility for all organizations needing compliance and GRC utilities for effective governance and management, and it features many powerful functionalities.

I rate this review as a 9 overall.

My main use case for MetricStream is internal audits.

I use MetricStream for internal audits by having modules in a bank where I have deployed basic GRC controls to test work papers and then issue management. When any exceptions arise during the assessment of particular entities, those exceptions trigger as issues which then flow down to audits for further conduct.

Everything about my main use case for MetricStream fits into our audit process. For example, when we do a disaster recovery test, if it fails, it gets logged in MetricStream, and approvals for exceptions are tracked along with the identified root causes to perform retests based on availability and schedules.

MetricStream offers many inbuilt modules that require less customization, especially with risk management, controls, and issue management modules reflecting current industry needs including vulnerability management and DR tests.

The inbuilt modules, such as risk management, controls, and issue management, make my work easier and more efficient by providing a complete picture of the assessment process, effectively tracking risks and exceptions during entity assessments conducted yearly or quarterly, and automating the flow of issues into issue management.

MetricStream has positively impacted my organization by improving compliance, as previously processes were maintained in Excel sheets shared across the organization, but now it has centralized access for users.

Centralizing those processes has reduced errors and made audits faster while improving collaboration, as reviewers can log in at any point to see pending actions and who is responsible for them without the confusion of shared Excel sheets.

MetricStream needs improvements, particularly regarding performance as data grows.

Performance issues become noticeable, particularly with SQL queries, especially when Infolets run.

Overall, improvements are needed in performance and form loading times.

MetricStream is a good product, but there is a need to improve form loading performance and address potential data loss when multiple users submit forms simultaneously.

I have been using MetricStream for three years.

MetricStream is stable, but it is not 100% stable. It is a good product, yet I experience more data losses and flow control issues as data volume increases.

MetricStream has good scalability.

The customer support is very good, as I have not encountered issues because the offshore team is always available to help when needed.

I would rate the customer support on a scale of 1 to 10 as a nine.

I joined a company where MetricStream was already in use, so I transitioned directly to it without previously using another solution, though I have experience with RSA Archer.

I have seen a return on investment primarily through user cleanup processes that reduced unnecessary licenses and saved money after customizing the system to track user activity.

My experience with pricing, setup cost, and licensing reveals that licensing is very expensive, which contributes significantly to revenue.

My team evaluated other options before choosing MetricStream, including AuditBoard, RSA Archer, and ServiceNow.

My main use case for MetricStream was that I was a developer and I prepared templates for a client while also testing the UI platform for the client.

I can give a specific example of a template I prepared for a client. We had a task about what the client wanted, about the solution, about governance, about the tech template, and about SOX compliance. After we had some points, I created forms. It was basically something similar to Microsoft Forms. I prepared templates within MetricStream and took these blocks to create components together, something resembling Lego parts.

When I was a developer, this was a quite narrow template, and it consisted mostly of pieces from a constructor. I created one large form for the client. However, the main issue is that if a client needs something larger or more custom, there are no tools to change these blocks. Instead, I need to create a task for the developer team. Additionally, my customer team from MetricStream is located in India. A significant issue is with technical support because for the first month, they do not have any time and they do not want to change anything. Basically, I only have access to the UI and do not have access to the code base. However, for developers preparing solutions for clients who need to make a change in the code base, it would be much easier to change our own code rather than wait two or three months.

The best features MetricStream offers are the nice dashboards. However, I believe that the same system could be built much cheaper. With the help of one Python developer and one data engineer, it could be created more easily. To me, it appears to be mostly a marketing-driven product, functioning basically as a better package for something similar to Microsoft Forms.

Regarding features, I think it was nice when I knew what was needed, and when a client had seen the issue beforehand. MetricStream is something like an all-in-one solution where I do not need to write scripts or conduct audits. However, it may be a cheaper option when an audit is not necessary, such as a Microsoft audit or governance audit. It might be cheaper for two or three months, but when deeper research on a company is needed, it is not suitable. Essentially, it is an audit platform with a nice dashboard.

MetricStream has positively impacted my organization because we sell it in Europe. However, I implemented it at a couple of companies and I do not see any positive impact. For the client, they can see a nice platform with a friendly UI and a dashboard. For a developer, there is basically no added value because all these things can be obtained from scripts. Scripts can be written easily and are a really cheap alternative. I do not see any reason to buy MetricStream for a couple of thousand euros per month when scripts can be written with internal audit, cyber risk audit, or policy searching capabilities. Essentially, it is a business version of Grafana.

A specific example of how a client benefited from using MetricStream is that it is better for usability. If a client needs to check risk inside a cloud environment or internal environment, they have a nice dashboard with compliance status, open issues, and key risk information. If the management part is implemented, there is also a nice dashboard with compliance status ranging from zero to 100, control test requests and results, and a nice dashboard from the forms.

MetricStream can be improved in the area of developers. There are two parts of developers: those who prepare solutions for clients and those from India who support the application. The support part is terrible, rating about one out of ten. The support quality needs significant improvement.

I have been using MetricStream for one to one and a half years.

MetricStream is stable, but if there is an issue, it will be complicated to resolve with the support team.

The scalability of MetricStream is basically easy. I can create many forms, but there is a cost associated with it.

The customer support of MetricStream is terrible.

Before MetricStream, we used Databricks and scripts for audit checks and our cybersecurity implementation. However, the business decided to switch to MetricStream and started selling MetricStream to other clients. I do not think it was a good solution because after a couple of months or years, we came back to manual checks.

I did not purchase MetricStream through the AWS Marketplace.

My company had a business relationship with the vendor other than being a customer because I was a reseller at my old company. Currently, I do not use MetricStream in my current job.

I have not seen a return on investment.

The advice I would give to others looking into using MetricStream is to not use MetricStream. I would rate this recommendation a four out of ten.

We are system integrators. We propose solutions to the customers.

They have now reworked it. The interface is mobile-friendly and it is getting a good response from our customers. It's a very good feature that the product offers. It is also available as a cloud option, which is getting a lot of interest from customers who are looking into the GRCC.

It is very useful, especially in the solution platform.

It has good features and good functionality, and our customers feel there is a lot of merit in that.

I think that the portal is constantly improving. They do their own enhancements very often. They keep doing those enhancements from their site itself.

As we are system integrators, we rely on the customer's feedback. We have not had any customers complain or express any concerns with the product.

There can be some small updates done with the interface.

I would like to see out-of-the-box integration with more security, it would be helpful.

We have been working with MetricStream for more than four years.

It's a pretty stable product.

MetricStream is a scalable product, depending on the customer's needs.

I would say that our clients are medium-size companies. 

It is difficult to define them, and it depends on the vendor. 

If it is $100,000 or more it would be considered to be a large enterprise company, or if it's $50,000 it would be a medium-sized company.

If customers are faced with any challenges, the support team is really responsive and very fast to address any concerns.

They have a good technical support team that is based out of India. 

They do a fair job.

The integration is very easy and it is fast.

In regards to deployment, most are out of the box.

The pricing is reasonable.

They are flexible in terms of customers' needs. We have seen customers who have a smaller compliance team, and they have been able to support them as well as large enterprise and global customers.

We have aligned with MetricStream only. We will recommend it, but we have seen comparisons between MetricStream and RSA Archer from when we have come across those customers. We have been head to head in those comparisons.

My advice is to be sure to have your use cases very clear in what you want to achieve, be it risk management or just relations management. If it's an audit, you have to be very precise and clear as to what your needs are. Based on that only, you should be evaluating it, because it is all modularized. There are more than 15 or 16 modules of MetricStream solutions available. 

The customer has to be very clear as to which module they are interested in and what they want to implement.

I would rate MetricStream an eight out of ten.