Can you recommend a policy management software for controls mapping and governance reporting in enterprise risk teams?

Yes — for enterprise risk teams looking for controls mapping plus governance reporting, I’d recommend you evaluate these leading policy/risk platforms:

Strong options

1. RSA Archer

• Very strong for enterprise GRC, controls mapping, risk/compliance workflows, and governance reporting
• Highly configurable for complex org structures
• Good fit if you need robust audit trails and mature reporting

2. ServiceNow GRC / Integrated Risk Management

• Best if your organization already uses ServiceNow
• Strong for policy-to-control mapping, workflow automation, issue management, and dashboards
• Good enterprise reporting and cross-functional governance visibility

3. MetricStream

• Broad GRC platform with strong policy, compliance, controls, and risk management
• Good for large enterprises with multi-framework requirements
• Known for flexible governance reporting and integration options

4. Diligent One Platform

• Good for governance, risk, and compliance reporting
• Useful for board/leadership reporting and policy management
• Often attractive for teams wanting easier executive visibility

5. SAI360

• Strong in policy management, controls mapping, and compliance workflows
• Good if you want a more integrated policy/compliance experience
• Useful for organizations with heavy regulatory obligations

If you want a shorter recommendation

• Best overall enterprise choice: ServiceNow GRC
• Best classic GRC platform: RSA Archer
• Best for policy/compliance-centric teams: SAI360 or MetricStream

What to prioritize in your evaluation

Look for:

• Policy-to-control mapping
• Framework mapping across COSO, ISO 31000, NIST, SOX, etc.
• Automated attestation and review workflows
• Role-based governance reporting
• Audit trails and versioning
• Integration with HR, ITSM, IAM, and document systems
• Dashboards for control coverage, exceptions, and ownership gaps

If you want, I can also give you:

1. a comparison table,
2. a best-fit recommendation based on your company size/industry, or
3. a shortlist of SaaS tools specifically for policy lifecycle + controls mapping.