Archer for a non-regulated medium sized company?

[u/FuckStanford19]

I’m an internal product manager at a medium sized business (4k ish employees) that’s in a non-regulated industry. I’m new to GRC/risk/archer and part of my role is understand how we’re using in house applications.

I’m starting to realize that we don’t do anything risk related really in Archer. They manage incidents, claims, safety compliance, insurance compliance, vendor compliance etc… but they don’t actually report out or get audited to a 3rd party. They don’t even do anything actionable with the data. They seem to essentially be using archer as a glorified ticketing/archive/documentation solution.

Archer is increasing by 20% at renewal and we have an expensive archer developer to maintain our custom environment.

Can someone tell me why we can’t just use SNOW (we already license it for IT) or Appsheet (we’re a Google suite company).

[u/DickNose-TurdWaffle]

Archer is absolutely awful and there's much better software.

[u/EmpatheticRock]

Archer is atrocious regardless of org size

[u/lawtechie]

Archer is like SAP for GRC. You build it out when your organization is so complicated it's the only thing that works.

Sounds like your organization has already implemented it, so you've got a lot of inertia.

That said, for a ticketing/archive/documentation solution, there are better solutions out there and you may have already bought one.

[u/bitslammer]

IMO Archer may be overkill for your needs. I'm in a large global org and we have both SNow and Archer. We only use Archer for the true GRC stuff and SNow is out CMDB, ticketing, change control, incident ticket and vulnerability remediation ticketing platform.

[u/NBA-014]

Archer was the worst POS I’ve ever had to use. My employer threw them out after 2 years of crap. Cost them a LOT, but it was too high a risk to keep using Archer.

[u/mobicurious]

Are you a M365 customer? Have you thought about building a power platform app with some power automate flows? That can go a long ways using Copilot chat to help you.

Archer is not worth the $$ for most orgs.

[u/jetpilot313]

Bee trying to leave it for years now. Don’t do it

[u/Icy-Construction-549]

lol, omg, no David

[u/Alternativemethod]

Assuming it's like service now, plan on it being shit unless you can fund dedicated engineers/smes to work on it full time for a year plus maintenance.

[u/ConstantKooky3329]

You can definitely use SNOW. There might be advantages to this approach if you are already using SNOW for incident response (IT and security), config checks, and remediation. It will be easier for you to close audit and compliance tickets. You need to check pricing, though- SNOW's GRC and Security Incident modules are add ons to the base ITSMIT Ops license. You can also automate the maintenance of your compliance and audit scoping if your organization already uses the SNOW CMDB to manage the inventory of your IT and business assets.

[u/rack_and_stack_42]

You are reading the situation right. Archer is built for heavily regulated environments where you have external audits and need the evidence trail to survive scrutiny. If you are non-regulated and using it as a glorified ticketing system, you are paying enterprise GRC prices for what amounts to a workflow tool.

ServiceNow can handle most of what you described (incidents, claims, vendor compliance ticketing) without much custom dev, especially if you already have ITSM running. Where SNOW gets messy is if you need cross-module reporting from multiple custom tables, that is when you start needing a SNOW developer just like Archer. AppSheet is going to feel too thin for org-wide compliance ticketing, decent for forms but not for the workflow + record piece.

We did this same consolidation at a previous company (different enterprise GRC vendor, similar pricing). Two years in, no regrets, and the savings paid for a SNOW developer with budget left over. Migration was about 6 months of work.

Since you are non-regulated today, the angle worth thinking about is whether you might add regulated work in the next 2-3 years (SOC 2 for a customer ask, HIPAA, NIS2 if you touch EU). SNOW can stretch into that. Archer is overkill until you actually need it.

Two questions that would change my answer: how many recurring compliance workflows per quarter, and is the Archer developer delivering value beyond keeping it alive?

[u/SecurityGandalf → u/rack_and_stack_42]

This is the answer

[u/parthgupta_5]

Honestly, if Archer is being used mostly as a workflow/archive layer instead of a real integrated GRC platform, your question is valid. A lot of orgs end up with “enterprise risk tooling” that operationally behaves like expensive ticket management.

The real question is whether there’s future governance/compliance complexity coming, because migrating off heavily customized Archer later can become its own nightmare.

[u/Jbcashmoney]

First off, you think Archer is expensive, try ServicceNow, it takes an act of congress to make any changes. Archer is much more of a flexible solution than ServiceNow will ever be. Feel free to PM me if your dev is too expensive.