Resources

Vendor Selection Checklist: ERM Software

Written by: Keith Reinhardt

A strong Enterprise Risk Management program is integral to making wise and safe organizational decisions.  

It’s not just banks and credit unions anymore. Companies of all shapes and sizes now recognize the importance of investing in Enterprise Risk Management software to help organize their program and create efficiencies around: 

Many companies also realize the hard work and resources that go into getting risk management right and are smartly adopting automated software solutions to help streamline their processes.  

But picking the right vendor is tricky, and there’s no one-size-fits-all solution. This dynamic leaves many companies stuck wondering where to start and exposed to unnecessary risk.  

If you’re in this position, have no fear. This article dives into what to look for as you evaluate prospective partners.  

Vendor Selection Criteria for ERM

Before you delve into features and functionality, start with some high-level business questions:

Corporate

How long have they been around? Risk management is far too complex and vital to be handled by a firm with minimal experience. If they don’t have at least 5 years of experience (on the low end), they likely don’t have the expertise necessary to warrant you even thinking about giving them the keys to your risk management kingdom.  

Do they have experience with your industry? This one is crucial. Sure, your appliance repairman likely has experience with motors. That doesn’t make them your first (or 100th) best option to fix your car engine. The same thing goes for risk management software. Look for a company with a deep, documented history of helping clients of a similar size and industry. Threats, regulations, and nuances vary too much to take a flyer on an unproven upstart.  

Have they recently been acquired or merged with another company? Even the best companies in the world take time to adjust after a significant business transaction. People, processes, and technologies can change quickly, especially after a merger or acquisition. In many cases, customer service and platform functionality get worse before they get better. Don’t be the guinea pig for the new entity.  

Do they have referenceable accounts? Hiring an ERM software vendor is a lot like hiring a new employee – if they don’t have two or three people to vouch for them, that’s a major red flag! Ensure they’ve helped organizations like yours solve the problems you are facing and be sure to speak with references.  

People

Leadership: Who is steering the ship? How long have they been there? What’s their level of experience? Are they available, or just a figurehead? 

Implementation: Risk management platforms are rarely plug-and-play. Setting them up to address your organization’s unique needs and nuances takes time, money, and expertise. Be sure you know who will guide you through the process, how long it will take, and how much it will cost. If the vendor can’t provide clear answers here, keep on moving.  

Customer Support: The ERM vendor should provide accessible training, documentation, and a responsive support team to address issues promptly. 

Sales: How is the sales process? If the sales team is unresponsive, unreliable, or lacks subject matter expertise, what makes you think things will get any better once you start paying them and working with other parts of the company? 

ERM Platform Essentials

So, you’ve satisfactorily vetted the company and its people. Great! Now, it’s time to move on to the fun stuff, features, and functionality.  

Ease of Use and Implementation: Nobody wants to buy shelfware, and that’s exactly what many risk management and GRC tools are. All the bells and whistles in the world won’t make any difference if your team can’t stand up and use the platform. Ask references about their experience with implementation. Also, ask the vendor for a free trial or sandbox to ensure their promise of simplicity is authentic. 

Product Updates: When was the last major product update (and why)? The value should be clear and worthwhile – otherwise, it’s just changing to keep up, not changing to get ahead. It’s also important to think hard about what product updates are being made and how they are helpful to you. If those changes don’t provide value to you or your team, you can be pretty sure they aren’t using their client feedback to make a solution that fits your organization.  

Comprehensive risk coverage: Can the tool assess risk over a broad range of functional areas via a consistent methodology? For example, WolfPAC covers a wide range of risk pillars, from strategic and reputation risk to data security, regulatory compliance, market risk, and beyond. 

Scalability and Customization: A solid ERM solution should scale as your organization grows, accommodating increasing data and complexity. You want to grow your business, and the last thing you need is to change ERM tools once you have them set up the way you want them to be.  

KRI & KPI monitoring: Does the ERM tool identify potential risks before they become significant issues and track the effectiveness of risk mitigation strategies? Can it track Key Risk Indicators over time? 

Data Interoperability & API Capabilities: Seek out ERM platforms with robust API capabilities enable the solution to connect with other systems and avoid data silos. 

Dashboards & Threat Identification: Does the solution highlight top threats at a glance? (WolfPAC does!) If not, you’ll be wasting time fishing around for information that should be right at your fingertips. 

Seats & Licenses: Be clear about how many user seats come with the software package and the potential cost of adding additional users. As a point of reference, WolfPAC provides an unlimited number of user licenses for all customers.  

Use of AI: Every ERM software user wants their tool to make life (especially the risk assessment process) easier and enhance their strategic decision-making process. Advancements in AI are making this a reality. Find out precisely how the vendor currently uses AI and get a look at their AI roadmap for the next few years.  

WolfPAC checks all of these boxes and more!  

Want to learn more about what separates WolfPAC from the crowd and how we delight customers of all shapes, sizes, and types? 

Visit our website or contact us today to speak with one of our risk management experts.  

Related Reading: 

More About WolfPAC:  WolfPAC Integrated Risk Management® is a fully integrated suite of software and expert advisory services designed to make the hard work associated with risk management easier. Our low-friction platform keeps you one step ahead of emerging risks and ensures that regulators and executives are 100% satisfied with your reporting.Â