BWise vs. SAI360

- What does our organization aim to achieve with the application? - Who will be using the tool? - How mature is our organization in the areas/processes that will fall in scope? - Are our areas averse to change? - How flexible and prone are our areas to modify their way of doing business and processes/procedures to accommodate BWise? - After implementation, who and how will perform application maintenance and change management (e.g. how easy will it be to update user privileges, central catalogs, assessment configurations, etc).

Incentivized

The usage of ROAM, as well as the integration of external programmes through API and import functions, has almost reduced duplication of work. One thing to keep in mind is that your use cases must be very clear. There are a lot of SAI solutions, and their titles don't always correspond to what they actually perform.

Incentivized

• Great reporting tool (uses SAP Business Objects). It is quite flexible on types of reports that can be created and supported. Also the reporting consultants are very competent and nice.
• Highly customizable solution: almost everything can be tailored to an organization's needs, assessments, audits, issues, recommendations, tasks, etc. However, there's a trade-off between customization and the integration of different areas of the organization.
• Increases visibility and efficiency in the organization. BWise offers centralized repositories (catalogs) that can be easily accessed and used by everyone in the organization (e.g. Process catalog, Policies and Procedures catalog, Risks, Controls, Laws catalogs, etc.). Also, the application allows findings on controls tested by Audit to be automatically reflected in controls monitored by SOX for example, without the need for SOX to retest them. So one area can leverage on the work of other areas increasing operational efficiency.
• Increases integration and avoids silos. By choosing the correct design (e.g. Risk Workshops instead of Open Assessments), one area can see and benefit from another areas' work. An example was mentioned above; another would be Operational Risk area considering the results of Business Continuity, Vendor Management, Info Security, etc. assessments when carrying out theirs. Additionally, processes can be integrated: when contracting a new vendor for instance, one can include questions about data confidentiality and usage of models in the Vendor risk assessment. Answers to these could then trigger Info Sec / Model Risk assessments.
• Increases accountability. Application provides full audit/change log with the type of change, name of executor, and date of change.
• Easier follow-up. BWise sends automatic emails with reminders to the people required to take action on an issue, assessment, etc.

Incentivized

• Customized unified design platform
• Modules that fit your organization
• Low technology involvement with information department.
• Built on foundational platforms some bidirectional in the ERM framework with TPRM contracts
• Single sign-on web-based applications

Incentivized

• Integration with SAP for continuous control monitoring.
• Control mapping to standards: ISO; COSO; COBIT; HIPAA; SP800_53 (NIST); FedRAMP; PCI_DSS; BITS; GAAP; AICPA; BSI; CCM; COPPA; CSA
• Surveys.

Incentivized

• Reporting
• Legacy modules (i.e. tasks)
• Look and feel
• Intuitive UI

BWIse is very flexible, and an affordable GRC tool.

Incentivized

I found BWise to be very intuitive and user friendly.

Incentivized

Overall it is a very versatile system that does help to keep our processes automated and secure. We are able to streamline our day to day activities.

Incentivized

BWise support is knowledgeable and responsive. Bug fixes and development are also timely and ongoing.

Incentivized

The main issues were managing the internal conflicts and competing objectives, rather than the capability and implementation of BWise itself.

Incentivized

Wasn't personally involved in the vendor selection process. I am aware that one of the main drivers for selecting BWise was cost (I believe BWise total project cost was several times lower than MetricStream's).

Incentivized

This system is compatible and compares to others in the marketplace.

Incentivized

• Increased employee efficiency especially considering incident management and follow up.
• Increased visibility and senior management information/awareness.
• Increased employee accountability.
• Reduction of silos.

Incentivized

• Less administration for risk assessments allowing for quarterly control assessments
• 100% removal of IT effort in our annual conflicts of interest assessments
• Reduction of manual processes
• Consolidation of legacy systems into SAI360