Arbutus Analyzer is the desktop audit-analytics tool from a small, privately held company in the Vancouver area that has spent two decades doing one thing: full-population testing against ERP extracts, bank cores and mainframes that spreadsheets cannot hold. For a team that already runs ACL and wants an alternative, or for any audit function that wants a scripted testing engine without buying into a full GRC suite, it belongs on the shortlist. The one thing to know before you shortlist it: Arbutus’s central sales pitch is ACL compatibility, built around a connector for former ACL customers’ projects, but the specific “one-click” framing and compatibility percentage that circulate in reseller blogs and forum threads do not appear anywhere on Arbutus’s own site, so verify them in a demo rather than assume them from the marketing that surrounds the product.
This review covers what Arbutus is and who owns it, the SmartApps, HUB, WebConnect, Results Manager and Mainframe Server line and how audit fits across them, a walkthrough by audit stage, where SOX belongs and does not, the analytics engine and its connectors, the version 9 AI features, our 12-area scorecard, fit by situation, the thin public pricing evidence, what the few verified reviews say, implementation, and how Arbutus compares with ACL and Caseware IDEA. It is part of the site’s independent buyer’s guide to internal audit software and follows the evidence rules in how we review audit software. If you are choosing among the three desktop analytics tools, the IDEA vs Arbutus vs ACL comparison puts them side by side.
Verdict
Arbutus Analyzer is a capable, ACL-literate scripting tool for teams that want full-population testing without buying an entire audit-management platform around it. The catch is a public record thin enough that a buyer has almost nothing outside a sales call to check the vendor’s claims against.
Best for. Teams already using ACL who want a compatible alternative; analytics-heavy audit functions of any size; organizations with mainframe or very large on-premises datasets; banks, credit unions and state government audit shops with peers already on the customer list.
Not for. Teams that want one platform for planning, workpapers and reporting rather than testing alone; SOX programs that need a control library and deficiency workflow out of the box; buyers who need a published price before they will take a sales call.
Evidence. Research-based: vendor documentation and release notes, public procurement records, third-party pricing data, verified user reviews on Gartner Peer Insights and G2, and analyst coverage. We have not used the product hands-on for this review.
Price evidence. No Arbutus-published price list and no Vendr marketplace listing exist. The only public figure is ITQlick’s own estimate, accessed 27 September 2026, of about $400 per user a year — a third-party number ITQlick itself scores at 77 out of 100 confidence, not one Arbutus has published or confirmed.
Last verified. 27 September 2026.
In this guide
- What Arbutus Analyzer is, and who owns it
- What you get: modules and how audit fits
- Walkthrough by audit stage
- SOX and controls
- Analytics, integrations and automation
- AI: what is real
- The scorecard
- Fit by situation
- Pricing and contract
- What users say
- Implementation and migration
- How it compares
- Questions about Arbutus Analyzer
- Sources and verification
- Related guides
What Arbutus Analyzer is, and who owns it
Arbutus Analyzer is published by Arbutus Software Inc., a privately held company headquartered in Burnaby, British Columbia, in the Metro Vancouver area, with 11 to 50 employees per Crunchbase. Founder, president and chief executive Grant Brodie has led the company since it was founded in 2003. Brodie is widely described, in reseller blogs and forum threads, as ACL’s former chief architect, but neither Arbutus’s About page nor any company-history page we read makes that claim, so treat the ACL lineage as a repeated background story rather than something Arbutus confirms in writing.
No acquisition, merger or outside investment shows up anywhere we looked: Crunchbase records no funding rounds, and Arbutus’s own site has no discoverable news or press archive, unlike almost every other vendor in this program. That is the best-supported reading of Arbutus’s ownership, not a confirmed negative; a company this size and this quiet about deal news may simply not publish any. Other named leaders include Greg Thomas, VP Sales and Marketing, and Brad Thiessen, Director of Client Services.
Arbutus runs no dated newsroom, so the timeline below leans on version numbers rather than press releases, and the two 2025 dates come from this program’s shared research base rather than a page that carries its own date.
| Date | Event | Why it matters to a buyer |
|---|---|---|
| Undated, pre-2026 | Arbutus 8 ships: Extended Profile, Containers, Zoom Navigation, improved pivot tables, and new connectors including Snowflake and SharePoint | The last major release before the AI and machine-learning additions |
| May 2025 (per shared research base; undated on the live page) | Arbutus 9 ships with Smart Query, Data Categorization, Clusters, Outliers and Sentiment Analysis | The version most of Arbutus’s current marketing describes |
| Dec 2025 (per this program’s brief; not dated on Arbutus’s own pages) | Arbutus 9.1 ships: expanded command-log navigation, VERIFY field-rule validation, non-English sentiment analysis, a new SAP NetWeaver Gateway connector, and HUB RAM optimization | The build behind every current download |
| 27 September 2026 (this review’s access date) | Current shipping build across the line is 9.1, build 2667: Analyzer, HUB, ConnectPlus, SmartLinkPlus, WebConnect, Results Manager and Mainframe Server each ship as a separate installer | What you would actually download today, and a reminder that pricing runs by product |
Scale claims are unaudited and inconsistent: the homepage says “1,000s of Supported Users” across “over 60 countries,” while the trial page claims “over 1,000 organizations across 60 countries.” Neither figure is broken out by product or region, and no third party confirms either.
What you get: modules and how audit fits
Arbutus sells seven products, each a separate download with its own installer, rather than a tiered Standard, Professional or Enterprise edition of one platform. That matters for budgeting: a buyer who wants only Analyzer pays for one thing, and every additional product below is a separate line item and, on the evidence available, a separate sales conversation, since Arbutus sells by direct contact rather than a self-serve pricing page (see Pricing and contract, below).
| Product | What it is | Licensing |
|---|---|---|
| Analyzer | The core desktop client: a self-service analytics platform with no stated file-size limit, processing millions of records a second against on-premises and cloud data | Licensed and downloaded separately |
| SmartApps | Prebuilt, script-based procedures across seven business-process domains: accounts payable, accounts receivable, fixed assets, fraud and compliance, general ledger and journal entries, inventory, and human resources | Bundled with Analyzer; the count varies by page — Arbutus’s SmartApps page says “nearly 90,” the Analyzer overview page says “nearly 70” and omits HR from its six named domains |
| Arbutus HUB | Windows-Server-based scheduling, automation and centralized data access, on-premises or “in the cloud” (AWS and Azure both named); keeps data “behind the organization’s firewall” | Separate download; whether “in the cloud” means the customer’s own account is not stated |
| WebConnect | Browser-based access to data, results and SmartApp outputs from phone, tablet or PC, with Excel export and no desktop install | Separate download |
| Results Manager | The findings and follow-up layer: visual workflows mapped to the customer’s own process, task and role assignment, deadlines and budgets, dashboards, and encryption at rest and in motion | Separate download; not bundled with Analyzer |
| Mainframe Server | Real-time access to z/OS, OS/390 and MVS data (DB2, IMS, ADABAS, VSAM, ISAM, flat files), with server-side filtering; marketed as a “Perfect Plug and Play Replacement for ACL Mainframe” | Separate download |
| ConnectPlus and SmartLinkPlus | Listed as separate downloads on the support page; their function beyond the name was not documented anywhere we could find | Separate download |
For an audit function, that structure turns one buying decision into several smaller ones. A team of one to five auditors that only needs to run tests against exported files can start with Analyzer alone. A team that wants those tests scheduled to run overnight, or wants results centralized somewhere other than individual laptops, adds HUB. A team that wants a documented follow-up process for what the tests find, rather than routing exceptions into whatever system already tracks audit issues, adds Results Manager. The site’s guide to the types of internal audit software places Arbutus in the audit-analytics category, distinct from the audit-management platforms reviewed elsewhere in this guide, precisely because none of these products plan an engagement, hold a workpaper with sign-off, or run an issue through the kind of lifecycle Optro (formerly AuditBoard) or TeamMate ship natively.
The SmartApps count is worth a moment: “nearly 70” against “nearly 90” is not a rounding difference, and suggests the two pages were written at different times and never reconciled. The practical answer either way: ask for the current SmartApps catalog by name in a demo, and check it covers the processes your plan calls for. The site’s accounts payable analytics catalog, journal entry analytics catalog and payroll analytics catalog describe the kind of tests Arbutus’s AP, GL and HR SmartApps are meant to automate, so you can compare Arbutus’s prebuilt version against what your team would otherwise script by hand.
Walkthrough by audit stage
Arbutus is fundamentally a CAATs and analytics tool with a bolt-on findings workflow, not an engagement-management platform with a native planning-to-reporting lifecycle. The walkthrough below follows the stages this guide uses everywhere else, and says plainly where Arbutus has nothing at all rather than stretching a feature to fit.
Planning. Arbutus has no audit-universe, risk-based scoping or engagement-calendar feature. The closest thing to a planning aid is the SmartApps library itself, organized by business process, which functions as a menu of ready-made tests rather than a planning module. A function that plans its audit universe and annual plan elsewhere can use that library to scope what an engagement will actually test once it starts; a function looking for planning support inside the tool itself will not find it here.
Engagement and fieldwork. This is Arbutus’s real strength. Analyzer’s core claim is 200-plus prebuilt audit-specific functions and commands, read-only access to source data, no stated file-size limit, and processing described as millions of records a second. Connectivity spans on-premises databases, cloud warehouses, the major ERPs and Microsoft infrastructure; the full connector list is in Analytics, integrations and automation, below.
Workpapers. Arbutus has no named workpaper object with sign-off, unlike the electronic working papers TeamMate or Optro ship. The nearest equivalent is the Command Log, which documents all user actions for audit-trail purposes; the analysis itself is built and run in Arbutus’s own scripting language, described on the vendor’s site as an industry standard, with script-protection features such as a disabled Escape key, input validation and view or edit protection, rather than a reviewable document type a second person signs off on.
Issues and follow-up. The separate Results Manager module supplies workflows, task and role assignment, deadlines and budgets, notifications and dashboards on open items. Because it is a separate download rather than a feature of Analyzer itself, ask during a demo whether it is included in the quote or priced as an add-on.
Reporting. Version 8 added visual and tabular Compare, Classify, Stratify and Aging outputs and drill-down pivot tables; WebConnect gives non-technical stakeholders browser access and an Excel export; Results Manager supplies its own dashboard layer. We found no audit-committee report generator or template library of the kind SAP or Optro publish, so board-level reporting is something you build from Arbutus’s outputs rather than something the product produces directly.
SOX and controls
Arbutus is not marketed anywhere in this research as a SOX or ICFR control-testing product; no page uses the words “SOX,” “Sarbanes-Oxley” or “internal control framework.” Its Fraud and Compliance SmartApps cover sanctioned-party matching and keyword screening, not control walkthroughs or deficiency evaluation. The practical role Arbutus can play in a SOX program is as a substantive-testing layer feeding a separate control-testing system of record, not as that system itself. The site’s guide to SOX 404 and ICFR compliance covers the programs these results would feed.
Analytics, integrations and automation
This is the section where Arbutus has the most to say. The underlying engine is a proprietary command language with more than 200 functions, plus, since version 9, a wizard-driven AI and machine-learning apps menu that needs no programming. R, Python, SQL, Power BI, Tableau, PowerShell and Excel are all named as connected or complementary tools, and the Clustering and Outliers apps specifically run on what Arbutus calls “industry-standard Python.”
| Category | Examples, as named by Arbutus |
|---|---|
| On-premises and NoSQL databases | SQL Server, Oracle, SAP HANA, MongoDB, Cassandra and others |
| Cloud data warehouses | Snowflake, BigQuery, Redshift, Databricks |
| ERPs and business applications | SAP, Oracle Cloud, Dynamics 365, NetSuite, Salesforce, Workday, ServiceNow, QuickBooks |
| Microsoft infrastructure | Exchange, Active Directory, SharePoint |
| Mainframe, via Mainframe Server | z/OS, OS/390, MVS: DB2, IMS, ADABAS, VSAM, ISAM, flat files |
| APIs and recent connectors | REST APIs (inbound); Access, Btrieve, SAP NetWeaver Gateway |
Integrations run inward: the connectors above bring data in, and we found no outbound integration or webhook framework, and no publicly documented Arbutus-side API for external systems to call into Analyzer, HUB or Results Manager. Treat a public API as not found rather than confirmed absent.
ACL Projects is a named, supported connection inside Arbutus, and it sits at the center of how Arbutus positions itself against ACL Analytics. What we could not find, despite checking Arbutus’s own site directly and re-checking with a targeted search, is the specific “one-click conversion” language or any stated compatibility percentage for ACL scripts. Arbutus’s founder has been quoted in outside commentary, dated to 2021, saying that “at least 95 percent” of ACL scripts run against Arbutus without changes; we could not independently locate that original interview in this pass, so treat the figure as a widely repeated industry claim rather than a number Arbutus currently publishes itself. If ACL compatibility is the reason you are evaluating Arbutus, ask the sales team to convert a real ACL project of yours in the demo, following the site’s audit software demo script for what else to test while you have their attention, rather than relying on either claim.
HUB is the scheduling and automation layer: recurring jobs and centralized data access, deployed on-premises or in the cloud, with AWS and Azure both named, though neither page states whose cloud account that means. Scheduled, recurring testing through HUB is the practical version of what other reviews in this guide call continuous monitoring; the site’s continuous monitoring guide and guide to RPA in internal audit cover the broader automation options a team can weigh against it.
AI: what is real
Arbutus’s AI and machine-learning apps menu, introduced in version 9, splits cleanly into two approaches with two different data-handling postures, and the split is the single most useful thing to understand about it before a demo.
| Feature | What it does | Data handling |
|---|---|---|
| Smart Query | Answers natural-language questions against a dataset | Cloud, OpenAI-based, opt-in; disabled by default |
| Data Categorization | Labels free-text fields via ChatGPT | Cloud, OpenAI-based, opt-in; disabled by default |
| Arbutus Assistant | A general ChatGPT and Copilot-style helper, not dataset-specific | Cloud, OpenAI-based, opt-in; disabled by default |
| Clusters | Groups records by numeric fields | Offline Python; no internet connectivity required |
| Outliers | Flags outliers using the interquartile-range method | Offline Python; no internet connectivity required |
| Sentiment Analysis | Classifies text as positive, negative or neutral; 9.1 added non-English support with “improved algorithms” | Offline Python; no internet connectivity required |
Arbutus’s own data-use statement is the most specific found anywhere in this research: the AI apps “are disabled and non-functional by default, to ensure that no data is sent off premise unless explicitly decided upon.” Once a customer turns Smart Query, Data Categorization or the Assistant on, the data in whatever table the user selects is passed to OpenAI through ChatGPT, and Arbutus recommends getting internal confirmation before doing so. The machine-learning apps instead run fully offline, with no internet connectivity or outside communication required. Arbutus’s privacy policy corroborates the OpenAI relationship company-wide: input, output and personal information are shared with and processed by named AI service providers, with servers based in the United States and EU, UK and Swiss transfers relying on Standard Contractual Clauses.
What is not published anywhere we found: whether OpenAI trains on the data Arbutus’s customers send it, how long that data is retained, or whether Arbutus offers any enterprise or no-training OpenAI tier. A function that is comfortable with the offline Python apps but cautious about sending data to a third-party language model should ask those three questions directly, and should read the site’s guide to AI in internal audit tools for the questions worth asking any vendor about data use before enabling a generative feature.
The scorecard
The 12 areas and four levels are the ones used across every review in this guide. Arbutus is an analytics tool rather than an audit-management platform, so a few areas built for planning, a signed-off engagement workflow, quality-program support and auditee-facing workflow are marked not applicable rather than stretched to fit; the areas built for testing, security and cost carry a full rating.
| Area | Level | Evidence |
|---|---|---|
| 1. Risk assessment and planning | n/a: not what the tool is for | No audit-universe, risk-based scoping or engagement-calendar feature found; the SmartApps library is a menu of ready-made tests, not a planning module |
| 2. Engagement workflow | n/a: not what the tool is for | No planning memo, RCM, test-step workflow or review sign-off object; analysis lives in Arbutus’s own scripting language and the Command Log, an audit trail rather than a built-and-signed-off engagement |
| 3. Workpapers and evidence | Limited | No named workpaper object with sign-off; the Command Log documents user actions for an audit trail, and analysis lives in Arbutus’s own scripting language rather than a reviewable document |
| 4. Issues and follow-up | Adequate | A separate Results Manager module: workflows, task and role assignment, deadlines and budgets, notifications and dashboards; not bundled with Analyzer by default |
| 5. Reporting | Limited | Compare, Classify, Stratify and Aging outputs and drill-down pivot tables since version 8; WebConnect adds browser access and Excel export; no audit-committee report generator found |
| 6. SOX and controls testing | Not offered | No page uses SOX, Sarbanes-Oxley or internal control framework; Fraud and Compliance SmartApps cover sanctioned-party matching and keyword screening, not control testing |
| 7. Analytics and automation | Strong | The core of the product: a 200-plus-function command language, a wizard-driven AI and machine-learning apps menu since version 9, and HUB scheduling |
| 8. AI features | Adequate | Named, dated features split cleanly between opt-in cloud OpenAI apps, off by default, and fully offline Python apps; no enterprise or no-training OpenAI tier stated |
| 9. Quality program support | n/a: not what the tool is for | Nothing purpose-built for QAIP metrics or methodology enforcement; Analyzer is a testing engine, not an audit-department quality system |
| 10. Auditee experience | n/a: not what the tool is for | WebConnect gives stakeholders read access to results, not a request portal, action-plan workflow or notification system built for auditees |
| 11. Administration, integrations and security | Limited | A wide connector list and R, Python, SQL, Power BI and Tableau links, but no SOC 2, ISO 27001, FedRAMP or GovRAMP claim found anywhere, including the privacy policy |
| 12. Cost and contract | Limited | No list price, no published tiers and no Vendr listing; the only public figure is a low-confidence third-party estimate |
| Vendor viability | Stable but opaque | Privately held and founder-led since 2003, with no acquisition or outside funding found, but also no press archive and almost no third-party review coverage to check the company’s trajectory against |
Two ratings deserve a note. Issues and follow-up is Adequate, not n/a, because Results Manager is a real, if separately licensed, findings workflow; Reporting sits at Limited for the opposite reason, since visual outputs exist but no audit-committee report generator does. The gap at area 11 is the one to raise first with the vendor: the site’s audit software due diligence guide has the questionnaire this absence will trigger, and the site’s guide to reading audit software analyst reports explains why a product with almost no analyst or crowd-review coverage is harder to benchmark than the suites reviewed elsewhere in this guide.
Fit by situation
The eight situations are the same across every review and comparison in this guide, and the ratings below are the ones used on the comparison and hub pages.
| Situation | Fit | Why |
|---|---|---|
| First system for a small team (1 to 5 auditors) | Strong fit | A single Analyzer seat and the SmartApps library cover common tests without scripting; pricing is quote-only, so get a number early |
| Mid-size function (6 to 25 auditors) | Strong fit | HUB adds scheduling and centralized results once single-seat use is not enough, and the SmartApps library already spans several business processes |
| Large or global function (25+ auditors) | Strong fit | No stated file-size limit, cloud-warehouse and ERP connectors, and a Mainframe Server module built for systems large organizations still run |
| SOX-heavy public company | Workable | No control library or deficiency-evaluation workflow; useful as a substantive-testing layer feeding a separate ICFR system of record, not a replacement for one |
| Bank or credit union | Strong fit | Named state comptroller and auditor-general customers, Mainframe Server for core banking systems, and Fraud and Compliance SmartApps for sanctioned-party and high-risk-transaction screening |
| Public sector, higher education or nonprofit | Workable | Several U.S. state government customers show public-sector traction, but no SOC 2, ISO 27001 or FedRAMP claim was found for a security review to point to |
| Analytics-heavy team | Strong fit | This is what Analyzer is built for: 200-plus functions, a proprietary command language, R, Python, SQL and Power BI connections and offline machine-learning apps |
| Consolidating GRC across the three lines | n/a | Analyzer has no risk, compliance or audit-management modules; it is a testing engine a GRC consolidation project would sit alongside, not replace |
Read the SOX-heavy and analytics-heavy rows together: they are near opposites, normal for a tool built to test data rather than run a control-testing program. A public company whose search starts and ends with SOX will find Arbutus a supplement, not an answer; a data-heavy function of any size is the audience this product was built for.
Pricing and contract
Arbutus publishes no price list, no tiers and no self-serve checkout anywhere we found. The evidence below is what exists publicly, with its provenance; the site’s internal audit software pricing guide sets it against the rest of the market.
| Source | Date | Figure | What it covered |
|---|---|---|---|
| ITQlick listing | Accessed 27 September 2026 | Starts at $400 per user a year; ITQlick score 77 out of 100 | Third-party estimate for “Arbutus Audit Analytics”; not sourced to Arbutus, a contract or a procurement record |
| Arbutus How to Buy page | September 2026 | No figures | A contact form; sales reachable by phone or email only |
| Arbutus Evaluation page | September 2026 | No figures; a no-cost trial license | Free trial, with contact promised within one business day |
| Vendr marketplace | Checked 27 September 2026 | No listing found | No Arbutus coverage, unlike most SaaS competitors reviewed elsewhere in this guide |
| Public procurement records | — | None found naming Arbutus | Despite several named U.S. state government customers (see What users say, below), no contract value located anywhere we searched |
Two things follow from a record this thin. First, do not repeat the $400-per-user figure to a decision-maker as Arbutus’s price: it is ITQlick’s own estimate, carries that firm’s own 77-out-of-100 confidence score, and is not sourced to Arbutus or any contract; a real quote could land well above or below it. Second, because Arbutus sells every product separately, ask for one quote that itemizes Analyzer and separately prices HUB, Results Manager, WebConnect and Mainframe Server, rather than accepting a bundled number you cannot take apart later. A claim that subscribers get version upgrades free could not be confirmed on Arbutus’s own pages, so verify it in writing. The site’s vendor-neutral RFP method has the questions to ask on a quote like this one.
What users say
Arbutus has essentially no third-party review-site presence at a meaningful volume, which is itself useful information: every suite competitor elsewhere in this guide carries hundreds to low thousands of ratings, and a buyer evaluating Arbutus cannot triangulate the vendor’s claims through crowd review the way they can with Optro, TeamMate or Workiva.
| Site | What we found |
|---|---|
| G2 | 4.3 out of 5 from 2 reviews (one small-business, one mid-market, no enterprise reviewer) — too small a sample to generalize from. Praise: handling large datasets, ease of connecting to business data, useful audit analysis. Complaints: a steep initial learning curve reviewers say becomes intuitive, and unspecified “outdated systems” or technical issues. G2 files the product under “Other GRC Tools,” and its automated alternatives list names no real audit-analytics peer, no ACL and no IDEA |
| Gartner Peer Insights | No Arbutus product page found under the Audit Management Solutions market used elsewhere in this guide; not present, or present with too few reviews to publish — not confirmed either way |
| Capterra | Two plausible listing URLs resolved to an unrelated product and to a category page without Arbutus; no populated listing found |
| TrustRadius | The plausible product-review URL returns a 404; no populated listing found |
The absence itself is a fair basis for one piece of due-diligence advice: ask Arbutus directly for reference customers you can call, since the usual shortcut of reading a few hundred G2 or Gartner Peer Insights reviews is not available here. Arbutus’s own customer list names Starbucks, PayPal, Mayo Clinic and several U.S. state comptroller and auditor-general offices; treat those as vendor-published logos, not independently confirmed references, until you call one yourself.
Implementation and migration
Arbutus offers live virtual training, from introductory through advanced, taught by Arbutus Certified Trainers and carrying NASBA continuing-education credit. On consulting, Arbutus claims its own installation and administration “requires significantly lower resources and costs” than alternative solutions, aiming to deliver on time and on or below budget; that is a vendor self-comparison we could not independently verify, and no implementation timeline is published anywhere we found. There is no public admin-role breakdown, and no migration-tooling description beyond the ACL Projects connector discussed above. A free trial license is available, with contact promised within one business day.
How it compares
Arbutus’s real competitive set is the other desktop CAATs tools, not the enterprise GRC suites reviewed elsewhere in this guide. The IDEA vs Arbutus vs ACL comparison puts the three side by side in detail; the summary below covers the two most relevant plus a third option that is not a packaged tool at all.
ACL Analytics (Diligent). Version 19 shipped 4 December 2025, adding a natural-language AI command and a new Databricks connector, alongside the cloud ACL AI Studio and the Robots automation layer that replaced the retired AX server. ACL is quote-only like Arbutus, and whether its desktop client can be licensed without a Diligent One Platform subscription is not stated anywhere we read. Arbutus’s pitch against ACL is compatibility, through the ACL Projects connector discussed above, but the one-click and percentage claims that circulate about that migration are not ones either vendor states in writing. See the ACL Analytics review.
Caseware IDEA. Hg-owned since late 2020, IDEA is the other classic desktop analytics tool, now on version 13 with the AiDA assistant sold as an add-on and Python available through IDEA Lab. The one public price point, a UK National Highways license renewal of 4,998 British pounds excluding VAT, does not state a seat count, so it is no cleaner a per-seat figure than Arbutus’s ITQlick estimate. Unlike Arbutus, IDEA has no stated ACL-project migration path. See the Caseware IDEA review.
A generalist data stack. Some teams reach a similar result with Alteryx, Power Query and Power BI, or Python directly, instead of a packaged CAATs tool. That path trades Arbutus’s audit-specific SmartApps and Command Log for general-purpose tooling an organization may already license elsewhere; the site’s Alteryx vs Power Query and Power BI comparison and the audit analytics software comparison cover the wider field, including tools this review does not, such as Excel and TeamMate Analytics.
Questions about Arbutus Analyzer
Is Arbutus Analyzer the same company as ACL?
No. They are separate companies with separate ownership: Arbutus is privately held and was founded in 2003 by Grant Brodie, while ACL Analytics is now a Diligent product line, owned by Diligent since its 2021 acquisition of Galvanize. Brodie is widely described in outside commentary as ACL’s former chief architect, but that claim appears on neither company’s own pages, so treat it as background, not something either states in writing.
Can Arbutus really convert ACL projects with one click?
Arbutus supports a named connection for ACL Projects, so migrating test logic from ACL is a real, supported path. What we could not verify, including a targeted re-check, is the specific “one-click” framing or any stated compatibility percentage; a widely repeated 2021 claim that “at least 95 percent” of ACL scripts run unchanged could not be independently located either. Ask to see a real project of yours converted in the demo before relying on either claim.
How much does Arbutus Analyzer cost?
Arbutus does not publish prices, and there is no Vendr marketplace listing to check against. The only public figure is ITQlick’s own estimate of about $400 per user a year, which ITQlick itself scores at 77 out of 100 confidence and which is not sourced to Arbutus or any contract. Expect a custom quote, priced per product, after a sales conversation.
Is Arbutus Analyzer right for a small team?
Generally yes. A team of one to five auditors can run real full-population tests from a single Analyzer seat and the SmartApps library without writing scripts, and version 9’s offline machine-learning apps need no separate infrastructure. The catch is the same one that applies at any size: pricing is quote-only, so get a number before you assume the fit.
Does Arbutus Analyzer send audit data to OpenAI?
Only if you turn that feature on. Smart Query, Data Categorization and the Arbutus Assistant are cloud, OpenAI-based apps Arbutus ships disabled by default; enabling one sends the selected table to OpenAI through ChatGPT. Clusters, Outliers and Sentiment Analysis are offline Python apps that need no internet connection. Arbutus does not state whether OpenAI trains on what customers send it, so get that answer in writing first.
Is Arbutus Analyzer SOC 2 or ISO 27001 certified?
Not that we could find. No SOC 2, ISO 27001, FedRAMP or GovRAMP claim appears anywhere we read, including Arbutus’s privacy policy, which states only generic “appropriate and reasonable technical and organizational security measures.” Treat that as not published rather than as proof the controls do not exist, and ask for a security questionnaire response directly if your organization requires a named framework.
internalauditguide.com has no commercial relationship with Arbutus, ACL, Diligent, Caseware or any other vendor named on this page. We take no vendor money, run no affiliate links and accept no sponsored placements, and no vendor saw this page before publication. Product and company names are the trademarks of their owners. Corrections: desk@internalauditguide.com.
Sources and verification
- Arbutus Software: Arbutus Analyzer — product description, functions, SmartApps count, read-only access, Command Log, connections, version 9 AI names (accessed 27 September 2026).
- Arbutus Software: About Us — founder and CEO Grant Brodie, other named leaders, the “60 countries” claim (accessed 27 September 2026).
- Crunchbase: Arbutus Software — founded 2003, headquarters in Burnaby, British Columbia, 11 to 50 employees, no funding or acquisition data (accessed 27 September 2026).
- Arbutus Software: SmartApps — the “nearly 90 SmartApps” claim and the seven business-process domains (accessed 27 September 2026).
- Arbutus Software: Supported Data Connectors — the full connector inventory used in the analytics and integrations table (accessed 27 September 2026).
- Arbutus Software: Mainframe Server — z/OS, OS/390 and MVS support, and the “Perfect Plug and Play Replacement” claim for ACL Mainframe (accessed 27 September 2026).
- Arbutus Software: Arbutus HUB — scheduling and automation, on-premises or AWS and Azure cloud deployment (accessed 27 September 2026).
- Arbutus Software: Results Manager — the findings and follow-up workflow, dashboards, encryption at rest and in motion (accessed 27 September 2026).
- Arbutus Software: WebConnect — browser-based, multi-device access and Excel export (accessed 27 September 2026).
- Arbutus Software: What’s New in Arbutus 9.1 — the 9.1 feature list used in the timeline table (accessed 27 September 2026).
- Arbutus Software: AI/ML FAQs — the OpenAI-based versus offline-Python split and the data-use statement (accessed 27 September 2026).
- Arbutus Software: Privacy Policy — OpenAI data-sharing, US servers, Standard Contractual Clauses, and the absence of a SOC 2 or ISO claim (accessed 27 September 2026).
- Arbutus Software: Download Software — current build 9.1 (2667) and the separate-installer product list (accessed 27 September 2026).
- Arbutus Software: Training and Consulting — NASBA-CPE training and the implementation-cost claim (accessed 27 September 2026).
- ITQlick: Arbutus — the “starts at $400 per user a year” third-party estimate and 77-out-of-100 score (accessed 27 September 2026).
- G2: Arbutus Analyzer reviews and alternatives — the 4.3-from-2-reviews rating and themes, the “Other GRC Tools” category, and the automated alternatives list with no real audit-analytics peer (accessed 27 September 2026).
Related guides
- Internal audit software: the independent buyer’s guide — every review, comparison and buying guide in one place.
- How we review audit software — the evidence levels, the scorecard and the fit-by-situation method.
- The audit software shortlist finder — eight questions, a shortlist with the reasons from each review.
- The requirements matrix — 156 weighted requirements and vendor scoring in a free Excel workbook.
- ACL Analytics review — version 19, AI Studio, Robots and what replaced the AX server.
- Caseware IDEA review — the other classic desktop analytics tool, and whether it is still the default.
- IDEA vs Arbutus vs ACL — the three desktop analytics tools compared side by side.
- Best internal audit software by use case — all 25 platforms and tools ranked.
- Types of internal audit software — where audit analytics sits among audit management, GRC, SOX and compliance tools.
- Internal audit software pricing — real numbers, pricing models and how to negotiate.
- How to read audit software analyst reports — Gartner, Forrester, G2 and the rest, decoded.
- Selecting an audit management system — the vendor-neutral RFP method, useful against a quote-only vendor like Arbutus.
- The audit software demo script — 25 scenarios, including the ACL-conversion test worth asking for.
- Audit software due diligence — security, data residency, AI data use and vendor stability.
- Audit analytics software compared — IDEA, Arbutus, ACL, Alteryx, Power BI and Python.
- AI in internal audit: tools, use cases and limits — the questions to ask before enabling any AI feature.
- The accounts payable analytics catalog — 40 tests with logic, the kind Arbutus’s AP SmartApp is meant to automate.
Leave a Reply