Internal auditors play the critical role of being the third line of defense. When risk owners and management do not identify risk or adequately mitigate the risk, it is imperative for the internal auditors to provide independent and objective insight on risk. The audit management solutions market caters to this need by automating internal audit operations through its primary and secondary offerings. Audit management solutions help manage the complexity of the auditor's role, not the organization's risk.
Gartner defines business continuity management program solutions as the primary tools used by organizations to manage all phases of the business continuity management (BCM) life cycle, from planning to crisis activation. BCMP solutions provide capabilities for availability risk assessment, business impact analysis (BIA), business process and resource/asset dependency mapping, recovery plan management, exercise and crisis management, and BCMP management metrics and analysis.
Corporate Compliance and Oversight (CCO) tools provide the framework and support for standardization of compliance activities and automation to increase efficiency and effectiveness of compliance management programs. CCO enables a common cross-enterprise approach to IT compliance activities that most affect the regulatory oversight of corporate governance. This is done through support of the five major requirements for managing a compliance program: policy development, aggregation and normalization, control monitoring, workflow management, and case management.
The IT risk management (ITRM) market focuses on solutions that support the ITRM discipline through automating common workflows and requirements. For the purposes of defining this market, IT risks are risks within the scope and responsibility of the IT department. These include IT dependencies that create uncertainty in daily tactical business activities, and IT risk events resulting from inadequate or failed internal IT processes, people or systems, or from external events.
Gartner defines IT vendor risk management (IT VRM) as the discipline of addressing the residual risk that businesses and governments face when working with external service providers, IT vendors and related third parties. The scope typically addresses risks related to data protection, business continuity, security and other risk domains as relevant to laws, regulation and industry practices.
Gartner defines Integrated risk management (IRM) as the combined technology, processes and data that serves to fulfill the objective of enabling the simplification, automation and integration of strategic, operational and IT risk management across an organization.
The SACBT market is characterized by vendor offerings that include one or more of the following capabilities: Ready-to-use training and educational content; Employee testing and knowledge checks; Availability in multiple languages, natively or through subtitling or partial translation (in many cases, language support is diverse and localized); Phishing and other social engineering attack simulations; Platform and awareness analytics to help measure the efficacy of the awareness program. Training modules are available as cloud-hosted SaaS applications or on-premises deployments via client-managed learning management systems (LMSs), and also support the Sharable Content Object Reference Model (SCORM) standard, enabling integration with corporate LMSs.
The compliance third-party risk management (TPRM) solutions market consists of vendors offering technologies to CCOs, among other senior leaders responsible for TPRM, to manage the risks associated with due diligence and/or ongoing monitoring of third-party vendors, distributors, agents, partners or other parties. Products in this market are often capable of supporting a range of TPRM workflows across multiple risk terrains. Risks specifically addressed may include anti-bribery and anti-corruption (ABAC), anti-money-laundering, data management and supply chain, and business continuity risks among others.
Whistleblowing Software, also known as Anonymous Reporting Software or Ethics Hotline Software, is designed to facilitate the reporting of misconduct, fraud or other unethical behavior within an organisation. It allows employees, customers or other stakeholders to report concerns or wrongdoing through multiple reporting channels such as mobile apps, web forms, email and/or chat while maintaining their anonymity. It also enables organizations to assign cases to investigators, track progress through reporting and analytics and ensure timely resolution. Other benefits include increased compliance with laws and regulations, reduced risk of financial loss and reputational damage, and improved employee morale by creating a culture where employees feel safe and comfortable reporting wrongdoing.