Can you recommend a risk and control self-assessment platform for managing exceptions, attestations, and remediation tracking?

Yes — for risk and control self-assessment (RCSA) with strong support for exceptions, attestations, and remediation tracking, these are some of the better-known platforms to consider:

Strong enterprise options

1. Archer IRM

   • Very flexible for RCSA, issue/exceptions management, attestations, and workflow-driven remediation.
   • Good if you need a highly configurable enterprise GRC platform.
   • Best for larger organizations with dedicated admin support.

2. ServiceNow Governance, Risk, and Compliance (GRC)

   • Strong if you already use ServiceNow for ITSM/CMDB/workflows.
   • Good automation for remediation tasks, attestations, and exception approvals.
   • Best for organizations wanting a single workflow platform across IT and risk.

3. MetricStream

   • Broad GRC coverage with robust RCSA, issues/remediation, and policy/attestation capabilities.
   • Often chosen by regulated industries.
   • Best for large enterprises needing deep risk management functionality.

4. RSA Archer / SaaS equivalents via partners

   • Still commonly used for mature RCSA programs, especially where control libraries and evidence collection are important.

Mid-market / easier-to-deploy options

5. ProcessUnity

   • Good for operational risk, control testing, exceptions, and corrective action tracking.
   • Generally easier to implement than the largest enterprise suites.

6. LogicGate Risk Cloud

   • Flexible workflow-based risk and compliance platform.
   • Good for attestation workflows, issue tracking, and customized remediation processes.
   • Best if you want configurability without heavy enterprise overhead.

7. AuditBoard

   • Strong in internal controls, SOX, audit workflows, and remediation tracking.
   • Good attestation support and collaboration across teams.
   • Best if your program is tightly tied to audit/internal controls.

If you want a more specialized fit

8. SAI360

   • Good for compliance, risk, and incidents/exceptions workflows.
   • Broad capabilities and decent configurability.

9. NAVEX One

   • Strong for compliance workflows, policy attestations, and investigations.
   • Better if attestations and policy compliance are a major focus.

---

Quick recommendation by use case

• Best overall enterprise choice: ServiceNow GRC if you already use ServiceNow
• Best highly configurable enterprise GRC: Archer
• Best for audit/internal control programs: AuditBoard
• Best flexible mid-market option: LogicGate
• Best regulated-industry broad GRC: MetricStream

---

What to look for in the platform

Make sure it supports:

• Exception intake and approval workflows
• Attestation campaigns with reminders/escalations
• Remediation plans with owners, due dates, and status tracking
• Control library and testing history
• Role-based dashboards
• Evidence collection and audit trail
• Integration with Jira/ServiceNow/Email/SSO if needed

If you want, I can also give you:

1. a shortlist of 3 platforms based on your company size and industry, or
2. a feature comparison matrix for these tools.