SAI360 Reviews

I think that SAI360 really comes alive in terms of risk and control linkages. Once you create a risk, you can tie that risk directly to the controls used to mitigate the risk; once tied to controls, you can then tie those controls to your testing workpapers; and suddenly you have a chain of events (risk -> control -> test) that provides an easily traceable pathway rather than having to search through 3 separate spreadsheets for information. We've used it for SOX for approximately two years now, and it does a good job of bringing all aspects of the Control Environment (narratives, testing evidence, sign-offs) into one central location.

My major complaint is the approval workflow. If a tester completes a work paper and subsequently revises the work paper after completing the original work paper, SAI360 does not automatically move the revised version of the work paper from an approved status back to an unapproved status. Therefore, theoretically you could have a signed off document that was edited under the cover of the signatures. A minor complaint but I hate the dashboard widgets as they appear to be designed by someone that has never had to present this type of data to a CFO.

Prior to implementing SAI360, our SOX Program existed in a combination of Shared Drives, Excel Trackers and someones Email Inbox. With SAI360 there is now a single source where Risks Connect to Controls, Controls Connect to Testing and Testing Connects to Evidence. SAI360 has also assisted with Quarterly Certification Process - Sending 302/906 Questionnaires through Platform to Business Stakeholders and Tracking Responses is much easier than managing via Email. While SAI360 is not a perfect solution and the Learning Curve at the beginning was significant, it did replace a completely disorganized process with one that at least has some structure.

I like the template for questionnaires; they appear to be set up in such a manner that will make it easier for us to send requests to third-party entities without making it feel like we are trying to pull their teeth. Additionally, the AI assisted response mapping feature is useful as it identifies when vendors ask essentially the same questions in different manners and allows the responses to be filled-in without requiring much additional thought.

The reporting features allow for minimal customizations and this can become frustrating if your company needs to meet certain compliance requirements and also there are occasions where you can not create reports in the manner in which you would prefer. Also the number of alerts generated by the system can be too much and while not all alerts are urgent, you still have to review every single alert regardless of whether or not each one of them is an emergency.

Prior to sai360, we conducted vendor assessments via e-mail and large excel files. If you know anything about either method, then you understand why i describe it as horrible. Sai360 consolidates many of those processes such as vendor questionnaires are sent out, vendor responses received and documented, which eliminates some of the issues related to communication between departments and management.

It works with an endless number of systems (AWS, GitHub, Google Workspace, etc.) so finding evidence during an audit is literally seamless. The automated tests have been another major benefit - at a glance, i know when i need to pay attention to something that is failing, or something that needs to be addressed. And the trust center has also been beneficial because customers can now view their own compliance status rather than calling/emailing me every 5 minutes.

Some of the navigation is much too deep. For example, if a test is failing and i need to go fix something specific, i have to click through four pages to get there. That can be very annoying. Button contrast is also weirdly bad. Upload buttons just blend in with everything else so you are sitting around looking for something right in front of you. And every time you want to do anything it opens a new tab. After a while your browser is just full of tabs.

We are a small team; we don’t have any employees who have a background in security. And we needed to meet the requirements of soc 2. Without having a tool like sai360 that would’ve been extremely difficult. Sai360 provides what you need to meet the requirements of soc 2; assigns tasks related to those requirements; tracks them; and allows auditors to pull evidence directly from it rather than us having to put together a huge spreadsheet.

I think the part where it really shines is in creating courses — it’s very easy to upload videos, PDFs, SCORM files add a quiz at the end, etc and it does all of it easily without having to mess around. The AI-based course builder is very good for quickly building out something. Support also responds pretty quickly which I did not expect.

The reporting piece is lacking and it’s frustrating because everything else is okay. You cannot report on learning paths at all; you can only customize reports up to a point and some fields are not available, which means you’ll be duplicating information elsewhere to get the number you need. The new UI has a learning curve and some items are still in the older UI so you’re bouncing back and forth depending on what you are trying to accomplish. Pet peeve, but true: the training hours appear as “31m 55s” (text) instead of a number so you’ll have to write your own formula to total them.

SAI360 puts all of this into one place, automates the issuing of certificates, allows you to create groups and assign classes to those groups instead of individually, and gives employees the ability to complete classes on their own schedule. For our size team of trainers (managing training across hundreds of people without a large L&D staff), SAI360 is something that actually removes work from your plate as opposed to adding more.

I'm just glad that everything is now in one location and also the support team has been very responsive and I normally get a real person, as opposed to a bot. Onboarding was relatively quick and did not take weeks to set up and I really appreciate how it auto flags the risk for me to review rather than having to search for it myself.

I find customizing the reporting to be difficult. I simply want to rearrange the items, but I feel as though they are too rigid. Additionally the pricing can be somewhat steep for smaller companies and it appears at times there are too many clicks to access a simple vendor summary. I wish this were a little less expensive for what you receive.

The majority of the time, I am simply trying to keep track of our third party vendors to avoid being caught off guard. In addition to assisting with compliance audits (all data is located in one area), it prevents endless back and forth emails with security questionnaires.

What I like most about SAI360 is that it brings a wide range of features into a single platform, which makes compliance and risk management feel more connected and far less fragmented. Ease of use is another standout: despite the platform’s depth, moving through policies, training modules, and risk dashboards feels intuitive once you’ve had a little time to get familiar with it. I also found the implementation process smoother than I expected, with clear guidance that helped me integrate it quickly into my daily routine. Because I rely on it 12–13 times a day, consistency and reliability are essential, and it rarely lets me down. The integration capabilities are strong as well, letting me connect it with other tools I use without needing constant manual updates. Lastly, the customer support team adds real value—they’re responsive and knowledgeable, which makes the overall experience feel well supported and efficient.

One thing I dislike about SAI360 is that the interface can feel dated at times, which makes navigating complex compliance tasks less smooth than I’d like. Although the implementation process was manageable overall, some of the more advanced features took extra effort to fully understand, which slowed my initial adoption. Because I use the platform 12–13 times a day, the occasional lag or slower response is noticeable and can interrupt my workflow.

The reporting and analytics tools are functional, but they don’t always provide the level of insight I need for more strategic decision-making. Integrations generally work well, yet connecting with niche or less common systems can require additional time and troubleshooting. Overall, while the customer support team is helpful, I wish the platform itself felt more modern and streamlined to better match the reliability of the people behind it.

The no code function is good for fixing workflows without having to call a developer and the support team also answers me which is very unusual. I am able to connect multiple items such as risk and asset and it has not crashed. It is simple to use and easy to find your way around, as long as you don’t overcomplicate things.

It was a nightmare to create an entire dashboard by myself. I spent countless hours on creating it. Honestly I’m still upset about it. It is overpriced for what it does. The learning curve is high. I absolutely hate the redirect feature. It just seems old school. Why does it take me forever to format percentages correctly in the calculations?

We were able to get rid of the old excel sheets and notebooks that were killing us. We were both confused all the time during audits because the information wasn’t stored in a centralized location. I don’t have to run after the bosses to gather evidence from them because it sends emails to them automatically.

UI is very user friendly and pleasing to the eye. Configuration possibilities are very open ended and allow for heavy customization. Client partnership allows access to development team and gives us input to the platform's future. Multiple use cases available makes it a true risk management platform. New features and capabilities constantly being released.

Backend configuration is a bit of a learning curve. Advanced customization sometimes requires paying for professional services.

Automation for vendor risk management. Centralization of security and compliance audits. Comprehensive risk registers. Migration of manual processes to automated workflows. Integration of processes that break down silos within the organization.

Main reason for the usage of SAI360 is its flexibility to create nearly any entity, with any attributes and to use them in by yourself created workflows, filter the entities in tables, dasboards, treeviews and design your own functionalities arround it.

There is still potential to support configuration works with additional tools for example, for migration between environments, support for user rightsmanagement, archiving, anonymizsation and deleting of personal related data in instances of entities. options for module owners/admins, Microsoft Office integration for on premis clients , user section features.

SAI360 helps us fulfilling regulatory requirements and governance necessities in all the mentioned up topics.

Addenally we use SAI 360 to classify Third party outsourcings, our regulatory inventory, risk szenario management, second Line surveillance management, data privacy processing describtions according to Art 13 GDPR, data breach management.

We love how customizable this product is - we are able to build out each module with separate workflows that meet the needs of our organization.

We eagerly anticipate some of their upgrades on search functionality and other changes that make the product more end-user friendly.

Our primary use of SAI360 is third party risk management of our contracts, vendors and other business partners. We also use this product to support our organization's policy management, internal audit and enterprise risk management programs.