04 — Product · PR-780
Archer
An integrated risk management platform with use cases for enterprise and operational risk, regulatory and corporate compliance, policy, IT and security risk, third parties, audit and operational resilience on one configurable data model, plus the newer Evolv family of AI features. Offered as SaaS or installed software.
// FIG. 04 · Capability coverage
Each tile is an L1; the bar is how many of this product's capabilities realize something beneath it. Our judgment, not a vendor claim.
Direct & Govern
Finance
People & Workplace
Customer & Market
Products & Services
Operations & Supply
Technology & Data
Resilience & Responsibility
Industry L1s
- Plant Operations0
- Production Planning & Scheduling0
- Manufacturing Quality & Compliance0
- Industrial Engineering & Continuous Improvement0
- Plant & Process Safety0
- Dealer & Distributor Network0
- Aftermarket & Service Parts0
- Platform Engineering0
- Software Product Release0
- Site Reliability0
- Developer Experience & API Ecosystem0
- Subscription & Tenant Operations0
- Product Analytics & Experimentation0
- Trust & Compliance Assurance0
- Open Source & Community0
- Merchandising & Assortment0
- Store Operations0
- E-commerce & Omnichannel0
- Category & Trade Promotion0
- Loss Prevention0
- Consumer Insights0
- Store Network & Real Estate0
- Returns & Reverse Logistics0
- Network Planning & Engineering0
- Network Build & Field Operations0
- Network Operations & Assurance0
- Subscriber Order & Activation0
- Usage Charging & Subscriber Billing0
- Content & Programming0
- Advertising Sales & Operations0
- Communications Regulatory Obligations0
- Network Planning & Investment0
- Network Construction & Field Work0
- Network Operations & Control0
- Generation & Treatment Operations0
- Metering & Meter Data0
- Utility Customer Service & Billing0
- Energy Supply, Markets & Flexibility0
- Utility Regulation & Resilience0
- Transmission System Operations0
- Water & Wastewater Networks0
- Deposits & Accounts0
- Lending & Credit0
- Payments & Cards0
- Insurance Products & Policy0
- Insurance Claims0
- Wealth & Investment Management0
- Financial Crime0
- Prudential Risk & Regulatory Reporting0
- Patient Access0
- Clinical Care Delivery0
- Clinical Support Services0
- Revenue Cycle0
- Quality & Patient Safety0
- Population Health0
- Health Plan Operations0
- Health Information0
- Post-Acute & Home-Based Care0
The product at the base, its capabilities in the middle (taller = more mature), and the L1s they land under on top (taller = more of them). Our judgment, not a vendor claim.
- Top · Lands under
- L1Enterprise Risk · 8
- L2Compliance · 7
- L3Business Continuity & Crisis · 5
- L4Internal Audit · 3
- L5Corporate Governance · 2
- L6Cybersecurity · 2
- L7Supplier & Contract Management · 2
- L8IT Strategy & Governance · 1
- Middle · Product capabilities
- P1Enterprise & Operational Risk Management · core
- P2Loss and Indicator Management · strong
- P3Regulatory & Corporate Compliance Management · core
- P4Policy Management · strong
- P5Linked Control Library · strong
- P6IT & Security Risk Management · strong
- P7Third-Party Governance · strong
- +3 more in Plan
- Base · Product
- Archer · Archer Technologies LLC
Product capabilities · 10
How to read maturity and confidence
Maturity · how much it covers
- core
- What the product is built around; the capability is covered end to end.
- strong
- Covered well, with a few gaps a buyer would notice.
- partial
- Covers part of the capability; expect to pair it with something else.
- emerging
- New or thin; on the roadmap more than in the product.
Confidence · how well it is evidenced
- Evidence confidence: high
- The vendor's own documentation describes this module doing it.
- Evidence confidence: medium
- Documented, but how far it reaches into the capability is our reading.
- Evidence confidence: low
- Our judgment; we found no public page that confirms it.
- PC-780.10
Enterprise & Operational Risk Management
Evidence confidence: highMaturity: coreA single register of enterprise and operational risks rated on common definitions, each with a named owner and unit; self-assessment campaigns sent to managers with their risks and controls already filled in and approved by the risk team; board and management views showing how ratings have moved.
- BC-130.20.10Risk Identification
- BC-130.20.20Risk Analysis & Rating
- BC-130.10.20Risk Taxonomy
- BC-130.40.20Risk Reporting
- PC-780.20
Loss and Indicator Management
Evidence confidence: highMaturity: strongRecords of losses with their dates, causes and impact tied to the risks and controls involved, and risk indicators with two warning levels reported by their owners on a set schedule.
Vendor page: archerirm.com/enterprise-operational-risk ↗ - PC-780.30
Regulatory & Corporate Compliance Management
Evidence confidence: highMaturity: coreRegulatory news gathered from feeds into one library, laws and standards broken down to the clause and linked to the policies and controls that answer them, and the impact of each change reviewed with findings raised from the same record.
- BC-140.10.10Obligation Inventory
- BC-140.10.20Regulatory Change Monitoring
- BC-140.40.30Compliance Issue Remediation
- PC-780.40
Policy Management
Evidence confidence: highMaturity: strongPolicies written, reviewed, approved and published to the people they apply to, with exceptions recorded alongside their justification.
- BC-120.30.20Policy Authoring & Approval
- BC-120.30.30Policy Publication & Access
- BC-140.20.10Compliance Policy Development
- PC-780.50
Linked Control Library
Evidence confidence: highMaturity: strongEach control written once, mapped to every standard it satisfies and tested once, with the result reported against each control set.
- BC-130.30.30Control Library Maintenance
- BC-140.40.20Compliance Testing
- BC-160.40.10Key Control Testing
- PC-780.60
IT & Security Risk Management
Evidence confidence: mediumMaturity: strongTechnology and security risks, the controls over them and open issues kept together, with Evolv agents that keep watch on them and put the most pressing first.
Vendor page: archerirm.com/ ↗ - PC-780.70
Third-Party Governance
Evidence confidence: mediumMaturity: strongThird-party risk reviews that Evolv agents can carry out in full, with watch kept on each vendor until its next assessment.
- BC-640.40.10Supplier Risk Tiering
- BC-640.40.20Continuous Risk Monitoring
- BC-760.60.10Supplier Security Assessment
- PC-780.80
Audit Management
Evidence confidence: mediumMaturity: partialAudit engagements that open with evidence and earlier findings already collected by Evolv agents, which also mark where the auditor should look first.
Vendor page: archerirm.com/ ↗ - PC-780.90
Resilience Management
Evidence confidence: highMaturity: strongBusiness impact analysis, continuity and IT recovery plans, incident and crisis handling and scenario tests on one dependency map of critical processes.
- BC-830.10.10Process Criticality Assessment
- BC-830.10.20Dependency Mapping
- BC-830.20.20Continuity Plan Development
- BC-830.40.10Crisis Team & Activation
- BC-830.50.10Exercise Program
- PC-780.95
Archer Evolv
Evidence confidence: mediumMaturity: emergingA family of AI products (Foundation, Compliance, Risk and agent Operators) that adds AI to an existing risk program, either on its own or next to Archer GRC, in the customer's data center or as a service.
Vendor page: archerirm.com/ ↗
Sources · checked
The public vendor documentation this mapping is based on. Maturity and confidence are our judgment, not the vendor's claim.
- Archer® | Regulatory Change Management www.archerirm.com/
- Archer Regulatory & Corporate Compliance Management www.archerirm.com/reg-corp-compliance-management
- Enterprise & Operational Risk Management | Archer www.archerirm.com/enterprise-operational-risk