articles

How much reliance should you place on analyst reports when investing in new technology?

Forrester have published their 2021 GRC Wave report, which assesses the relative merits of 15 vendors in this sector. If you'd like a complimentary copy , designated leaders such as Workiva will provide one.

Analyst reports are an emotive subject for those being assessed — great if you're awarded leader status, less so if placed in a lower tier. This is true for all sector reports, but the market dynamics for GRC make things particularly challenging for analysts when ranking the vendors:

The market comprises multiple personas with diverging needs
Significant M&A activity is causing significant change to the landscape
It’s a partner-heavy market – vendor performance is highly contingent on third parties

Trust or ignore

Whilst acknowledging the challenges faced by analysts, some of the results in this latest publication are surprising, although this could be said of most reports in this sector.

So what does this mean for a business looking to procure a new GRC solution? (or IRM — it’s the same thing…) Are analyst assessments helpful?

As a general rule, these reports could be used to shape tentative shortlist faster, but the relative positioning of each vendor in the summary quadrant won’t necessarily be a good indicator of which offering will best suit your needs. Moreover, in tailoring your short list, you may need to cast your net beyond those vendors contained in these reports.

By way of illustration, consider two projects, focused on a specific use case, whereby the right shortlist won’t correlate with this latest Forrester report:

Health and safety risk — Enablon (placed last by Forrester in 2020 and missing entirely from this report) would be a front runner and solutions like Cority (not included in the quadrant either) would make a better alternate than any of the other solutions included in the report.
IT Risk — RSA Archer would move from ‘last’ spot (see below as to the veracity of this positioning) to being a leader, you’d likely discard several other solutions on the report (including one of the leaders), and add the likes of SureCloud (which, like Cority, doesn’t feature in this report).

To be fair to Forrester, this need to look beyond an aggregated assessment is noted, with scores being provided by GRC area. On the flip-side, it’s a concern that they continue to assess vendors who’ve elected not to participate — is it coincidence that those placed, who’ve elected not to be assessed, are both placed in the bottom quartile?

Researching the right decision — some lessons learned

Selecting GRC technology can be a complex task and is typically part of a broader transformation program. Consider these 5 critical learnings from previous GRC selection progams:

Be clear on your case and determine which vendors are aligned with these. As above, the right shortlist is likely to include vendors not in the analyst reports.
Provide specific use cases for shortlisted vendors to demonstrate their capabilities. Focus the use cases on areas of work more likely to be tackled differently by each vendor (this will likely require independent guidance).
Be mindful of vendors demonstrating what is little more than a façade to win the selection, only to lead to an implementation that relies on heavy customisation and an end solution that is costly to maintain and difficult to upgrade.
Listen to the references provided by the vendors, but balance this with truly independent references, gathered through your own network or introduced to you by intermediaries.
Manage internal expectations. Even if your preferred vendor seemingly meets your requirements, be prepared to change how you work and accept some solution limitations.

For an objective view of options omitted from analyst reports, or for any other selection support, please contact us.