About MetricStream
MetricStream sells a connected GRC system that automates risk and compliance work with AI assistants and agents. MetricStream says its platform is purpose-built for governance, risk, compliance, cyber, and audit. MetricStream tells buyers to stop using multiple GRC tools and spreadsheets in favour of one connected system.[7]
MetricStream describes a federated data model that links each risk, control, obligation or asset to every process, policy, audit and third party it touches. MetricStream lets customers build their own agents or deploy purpose-built agents from MetricStream and partners. MetricStream says its autonomous workflows automate assessments, gather evidence for controls and give in-workflow recommendations while maintaining human oversight. Embedded BI in MetricStream lets GRC teams build and share dashboards to analyze data and understand trends without leaving MetricStream.[7][8][9]
On the risk side, enterprise risk assessments in MetricStream use configurable models, weighted multi-dimensional aggregation, and Monte Carlo simulation, with exposure expressed in monetary terms. For operational risk, MetricStream supports Risk and Control Self-Assessments (RCSAs) with qualitative and quantitative assessments and Monte Carlo simulation to quantify risk exposure.[10][11]
On the compliance side, MetricStream compliance agents extract and classify potential obligations from regulatory documents, provide source references and confidence indicators, and recommend mappings to risks, controls, policies and processes. MetricStream compliance agents can auto-fill surveys and assessments with citations and confidence scores from available evidence, and teams make the final decision by reviewing, approving, overriding, and rejecting the suggestions.[12][16]
MetricStream covers cyber, third-party, audit and resilience work in the same platform. MetricStream cyber risk work covers risk quantification across frameworks and standards including PCI, HIPAA, NIST, ISO 27001, DORA and NIS2. MetricStream third-party due diligence assesses cyber, privacy, financial, compliance, resilience, operational, sanctions, corruption, and reputational risk through proportionate questionnaires. AI Survey Autofill in MetricStream drafts answers from SOC reports, policies, certifications, technical documents, and prior submissions.[1][8][14][15]
MetricStream says its work spans hundreds of Fortune 500 and Global 1000 organizations spanning 35+ countries. MetricStream says its risk expertise covers thousands of implementations in the most regulated industries worldwide. Shell chose MetricStream to be a central part of its journey towards a more integrated GRC future and to manage audit, compliance and risk management activities across a range of its businesses.[1][7][8][9][13][16]
MetricStream on the record