Diligent One Platform is the internal audit and GRC platform that most auditors still call HighBond. It was built in Vancouver by Galvanize, the company that ACL Services became, and it has belonged to Diligent, the New York board-portal company, since April 2021. It is one of the few internal audit platforms where full-population analytics is native rather than bolted on: the ACL scripting language, the Robots scheduler and the Results exception workflow sit inside the same platform as the workpapers. The one thing a buyer must know in 2026 is that the product is in transition on three fronts at once. The HighBond name and domain are being retired (highbond.com stops working on 16 December 2026), the Reports app reaches end of life on 30 September 2026 in favor of Activity Center, and the audit workflow is being rebuilt around AI agents announced in March and September 2026 that few customers have yet run through a full audit cycle.
This review covers who owns Diligent and what that means for the roadmap, the apps and solutions you actually get, a walkthrough by audit stage from the documentation, SOX and continuous controls, the analytics layer that is the product’s real edge, what is real in its AI, our 12-area scorecard and fit-by-situation table, the thin public price evidence, user-review themes, implementation and migration, and how it compares with Optro (formerly AuditBoard), TeamMate and Workiva. It is part of the site’s independent buyer’s guide to internal audit software; the review method explains the evidence levels and the scorecard, and the guide to the types of internal audit software explains why we class Diligent One as an internal audit platform with analytics rather than a pure GRC suite.
Verdict. A strong choice for analytics-heavy functions, banks and public-sector bodies that want the ACL heritage inside a broad GRC platform: the audit workflow is mature, the ACL analytics are among the strongest in the category, and the AI roadmap is among the most active of the platforms reviewed here. Buy it for the analytics and the platform breadth, not for the dashboards, and get the add-ons and user types priced before you sign.
Best for. Mid-size and large functions (6 auditors and up), banks and credit unions under examiner scrutiny, US federal, state, local and education bodies that need a FedRAMP Moderate environment, teams with an ACL script library, and organizations consolidating risk, compliance, audit and the board on one platform.
Not for. A first system for one to five auditors who want transparent pricing and a light footprint; a SOX-centric public company whose ICFR program is the center of gravity (Optro and Workiva are built around that); anyone who needs polished self-service dashboards today rather than after the Reports app is replaced.
Evidence. Research-based: vendor documentation and release notes, public procurement records, third-party pricing data, verified user reviews on Gartner Peer Insights and G2, and analyst coverage. We have not used the product hands-on for this review.
Price evidence. No public price for the audit modules; quote only. Vendr’s Diligent buyer data, updated February 2026, shows a median of $26,250 a year across 72 purchases, but it is dominated by board-portal deals and does not describe an audit contract.
Last verified. 27 September 2026.
In this guide
- What Diligent One is, and who owns it
- What you get: modules and how audit fits
- Walkthrough by audit stage
- SOX and controls
- Analytics, integrations and automation
- AI: what is real
- The scorecard
- Fit by situation
- Pricing and contract
- What users say
- Implementation and migration
- How it compares
- Questions about Diligent One
- Sources and verification
- Related guides
What Diligent One is, and who owns it
Diligent Corporation is a New York company founded in 1994 that grew up as a board portal. Diligent Boards is still the product most directors know it for, and the company’s own numbers describe that heritage: its website claims 25,000 customers, 1 million users and 700,000 board members and leaders. It listed on the New Zealand stock exchange in 2007 and was taken private by Insight Partners in 2016 for $624 million. Clearlake and Blackstone invested in 2020 (Fortune reported a $500 million round from the two firms in August 2020 at a valuation above $4 billion; Reuters, writing in November 2024, dates Clearlake’s first minority stake to 2018). Brian Stafford has been chief executive since 2015. None of this is audit software. The audit software arrived with Galvanize.
Galvanize was ACL Services Ltd of Vancouver operating under a new name, with the Rsam GRC product folded in and a cloud platform called HighBond. Diligent announced the acquisition on 24 February 2021, at a price Fortune reported as about $1 billion, and completed it on 7 April 2021. At completion Diligent said Galvanize served more than 6,300 organizations in 130 countries and that the combined company had more than 23,000 clients. In February 2021 it had also bought Steele Compliance, for undisclosed terms, which is where much of the compliance and third-party estate comes from. In May 2021 the subscription model changed from editions to a platform subscription plus “solutions”, and the old product names went with it: Audit Management was AuditBond, Internal Controls Management was ControlsBond, and so on down the list.
The names have kept moving since. The platform domain moved from aclgrc.com to highbond.com in June 2019. On 31 January 2024 Diligent HighBond became the Diligent One Platform, with GovCloud tenants following on 5 March 2025. The diligentoneplatform.com domain went live on 31 July 2025, and after one extension highbond.com stops serving logins, SSO and API calls on 16 December 2026. HighBond survives in a few component names (the HighBond robot, the HighBond API, the HighBond mobile app). If a colleague talks about ACL GRC, HighBond or Galvanize, they mean this platform.
Ownership is the viability question. On 14 November 2024 Reuters reported that Insight Partners, Blackstone and Clearlake were interviewing investment banks to prepare a sale that could value Diligent at nearly $7 billion including debt, with a process expected to start in early 2025 and possible buyers including other private-equity firms, LSEG and S&P Global. As of 26 September 2026 we could find no announcement of a completed transaction. Nothing about that is unusual for a private-equity-owned software company, but it belongs in your contract: a change-of-control clause, an assignment clause and a data-export right that does not depend on goodwill. The site’s guide to audit software due diligence covers what to ask. The table sets out the dates that matter.
| Date | Event | Why it matters to a buyer |
|---|---|---|
| June 2019 | Platform domain moves from aclgrc.com to highbond.com | The first of two domain changes in six years |
| 24 February 2021 | Diligent announces the Galvanize acquisition (about $1 billion, per Fortune) | Audit and analytics join a board-portal company |
| 7 April 2021 | Acquisition completes; Galvanize claims 6,300+ organizations | Start of the integration and rebrand program |
| 1 May 2021 | Subscription model changes to platform plus solutions | Older customers may still be on standard or premium editions |
| 1 January 2023 | Support ends for the Analytics Exchange (AX) server | Scheduled analytics move to Robots |
| 31 January 2024 | Diligent HighBond renamed Diligent One Platform | Same product, new name; GovCloud renamed 5 March 2025 |
| 14 November 2024 | Reuters: owners explore a sale at nearly $7 billion | Change-of-control terms belong in the contract |
| 30 June 2025 | Support ends for Direct Link | SAP extraction moves to the SAP connector |
| 15 July 2025 | ACL AI Studio announced; generally available 25 September 2025 | Natural-language analytics on top of ACL |
| 31 July 2025 | diligentoneplatform.com launches | SSO, allowlists and integrations need updating |
| 4 December 2025 | ACL Analytics 19 released; support for version 17 ends | Hard cutover to the new domain and encryption |
| 10 March 2026 | AuditAI launched at the IIA GAM conference | Agentic planning, requests and evidence management |
| 15 September 2026 | Orchestration, risk management and internal audit agents announced | Diligent says select solutions get them from October 2026 |
| 17 September 2026 | ACL AI Studio moves to the Claude 4.6 model | The model behind the analytics assistant is disclosed |
| 30 September 2026 | Reports app end of life (commercial tenants) | Custom reports must be rebuilt in Activity Center |
| 16 December 2026 | highbond.com retired for login, SSO and API | Last date to finish the domain migration |
Two things stand out in that table: how much has been retired in three years (the Analytics Exchange server, Direct Link, the Reports app, the HighBond domain and every version of Analytics before 18), with customers carrying migration work each time; and the pace of AI releases since July 2025, faster than any other product we have reviewed and the reason so much of this page carries a date.
What you get: modules and how audit fits
The commercial structure since May 2021 is a platform subscription, which gives access to most apps, plus one or more solutions layered on top. Diligent’s documentation lists six: Audit Management, Compliance Management, Internal Controls Management (which includes Continuous Monitoring), IT Risk Management, Enterprise Risk Management and Third Party Risk Management. Solutions are delivered mostly as toolkits, curated sets of analytics, frameworks and programs; some toolkits are free to every customer, others need the corresponding solution or are sold separately. Customers whose subscriptions began or were last renewed before 1 May 2021 may still be on the older standard and premium editions, and Diligent’s help center recommends converting at renewal. The product menu on diligent.com groups the audit sale into three items: Internal Audit, ACL Analytics and Internal Controls. The apps behind those items are listed below.
| App | What it does (per Diligent’s platform overview) | Role in an audit function |
|---|---|---|
| Projects | Plan, manage, execute and report work; the working-papers system | The engagement file: objectives, risks, controls, tests, issues |
| Frameworks | Structured master set of objectives, risks, controls and test plans | Methodology and control libraries synced to many projects |
| Assurance Plans | Scope of assurance activities, coverage and resource availability | Audit universe and annual plan |
| Scheduler and Timesheets | Project timelines, resource scheduling, time recording | Resourcing and utilization |
| Issue Tracker and Mission Control | Issues across all projects; bulk control updates | Follow-up and control administration |
| Task Manager (formerly Assessments) | Simplified view for business users to complete risks, controls, requests and actions | The auditee and control-owner portal |
| Results | Organize, track and remediate exceptions from analytics | Exception workflow and continuous monitoring |
| Robots | Automate tasks with scripts built in Analytics or Robots | Scheduled analytics and platform automation |
| Analytics (desktop) | Ad hoc analysis; develop, test and package scripts | ACL Analytics 19, installed on Windows |
| ACL AI Studio | Natural-language analysis of uploaded data | Analytics for auditors who do not script |
| Reports, Storyboards, Activity Center | Report building; visual presentations; dashboards | Reporting (Reports retires 30 September 2026) |
| Risk Manager, Strategy, Compliance Maps, Policy Manager | Enterprise and strategic risk, regulatory mapping, policy lifecycle | Second-line modules audit can read from |
| Asset Inventory, Asset Manager | IT and third-party asset registers | ITGC scoping and IT risk (IT Risk Management solution) |
| Boards, BoardEffect, Community, Entities, ESG | Board portals for corporates, nonprofits and local government; entity records; sustainability | Where audit committee reporting can land |
For an audit function the working set is Projects, Frameworks, Assurance Plans, Scheduler, Timesheets, Issue Tracker and Mission Control on the workflow side, and Results, Robots, Analytics and ACL AI Studio on the data side. Task Manager (renamed from Assessments on 30 October 2025) is the simplified view for business users who own risks, controls, requests and actions and should never have to learn Projects. Everything else in the table is the GRC and board estate a second line or a company secretary would buy, which matters if consolidation is the goal and does not matter at all if it is not.
User types drive cost and access. The documentation distinguishes System Admins, Professional Managers and Professional Users, Oversight Executives and Contributor Testers, and several features are gated by them: Workflow robots require a System Admin with a Professional subscription, AI editing in Projects is available to System Admins and Professional Users once enabled, and an administrator setting decides whether anyone with access to an action can update its status or only licensed users. Ask for the user-type definitions in writing before you count seats, because reviewers on Gartner Peer Insights name restricted user licenses with additional fees as a recurring weakness.
Walkthrough by audit stage
What follows is drawn from Diligent’s solution guides and release notes, not from using the product. Where the documentation describes a feature we say so; where it is a vendor claim we say that too. The site’s audit software demo script gives the scenarios to run when you see it live.
Planning and risk assessment
The Projects app organizes work as projects (engagements) made of objectives, narratives, risks, controls, test plans, walkthroughs, tests, issues and actions; the terms are customizable, and the risk-to-control pairing inside a project is the risk and control matrix. Two workflow types exist: Workplan, which Diligent describes as suited to small and mid-sized functions running procedure-based audits, and Internal Control, for SOX-style reviews. Projects start from scratch, from a template or by rolling forward a prior project, with shipped libraries for operational, financial and internal control audits, SOC engagements and a SOX template built on COSO 2013. Frameworks hold a master set of objectives, risks, controls and test plans that syncs to many projects and back. Assurance Plans scopes coverage and resources, Scheduler shows a Gantt chart of people and phases, and Timesheets records time. For the risk assessment itself, Assessment Drivers link a metric in Results to a risk score in Projects so that inherent risk is populated from data rather than typed, a genuine differentiator for teams that want the annual risk assessment to run on evidence. The AI layer is the Test Planning Agent (19 February 2026), which drafts test plans for controls that lack one, and AI-Generated Requests (9 December 2025), which drafts a request list from planning details, controls and prior requests.
Engagement and fieldwork
Fieldwork runs through sequential tabs for planning, fieldwork, review, reporting and issues. Auditors record walkthroughs (design) and tests (operating effectiveness) per control, with the number of testing rounds locked when the project is created and up to 10 custom test ratings per project type instead of pass or fail. Control X-Ray shows a control’s prior results and attributes so that a tester with little background can proceed. Requests are raised and tracked inside the project, with automatic reminders to the people who owe evidence, and business users answer them in Task Manager rather than in Projects. The HighBond mobile app for iOS and Android and Offline Projects cover fieldwork away from a connection. The documentation of this stage is compact; what you cannot tell from it is how the review queue behaves at 40 open engagements, which is exactly the kind of thing to put in a scripted demo.
Workpapers and review
Sign-off configurations are fully customizable, with up to five sign-off levels per item type and custom role names (May 2023). Files carry version history and can be renamed; PDFs can be annotated inside the platform with an annotation history; a project’s item history and activity log are preserved after archiving, and archived projects are read-only in the Project Library. Rich text fields gained an AI Assistant on 20 February 2026 that can draft, shorten, lengthen, change tone or translate text, restricted to the field it is used in; Diligent states that the assistant does not access other project data, which is reassuring for confidentiality and limiting for usefulness. The Global Internal Audit Standards ask for engagement documentation (Standard 14.6) that supports the conclusions and is protected and retained; version history and the preserved activity log meet the traceability half of that, and retention is whatever you configure. The site’s guide to workpaper best practices sets out what a reviewer should test for.
Issues and follow-up
Issues are raised anywhere in a project, assigned to owners with management responses, action plans, responsible people and dates, and tracked across all projects in Issue Tracker. Action owners can update completion status without a full license if the administrator allows it, and issue owners keep control of closure. Retesting and closure are documented back to the audit committee. Results adds a second channel: exceptions from analytics become records with priority, status and owner, triggers escalate when thresholds are met, and questionnaires collect explanations from the business. Together that covers the monitoring standard (15.2) and the parts of a good issue log that a spreadsheet handles badly: aging, escalation and evidence of validation.
Reporting
Reporting is the weakest stage and is mid-change. Projects produces Impact Reports and project reports in Word or PDF. Custom reporting has lived in the Reports app, with views, computed fields, drill-through and scheduled broadcasts; that app reaches end of life on 30 September 2026 for commercial tenants (28 February 2026 in GovCloud and SLED) and is replaced by Activity Center dashboards. Storyboards presents visualizations and rich text from Results as a single page. An AI Reporting early adopter program opened on 15 June 2026 with template-based and conversational report generation. Reviewers on Gartner Peer Insights say dashboard customization is difficult and delivers limited insight, so treat the audit committee deck as something you will still assemble outside the tool until you have watched Activity Center produce it. The table summarizes the stages.
| Stage | Apps involved | What the documentation describes | What to test in a demo |
|---|---|---|---|
| Planning and risk assessment | Assurance Plans, Frameworks, Projects, Scheduler, Results | Universe and coverage planning; templates and rollforward; Assessment Drivers scoring risks from data; AI-drafted requests and test plans | Build next year’s plan from this year’s results without re-keying; change a framework control and watch it sync |
| Engagement and fieldwork | Projects, Task Manager, mobile and Offline Projects | Walkthroughs and tests per control, locked testing rounds, 10 custom ratings, Control X-Ray, requests with reminders | Run a request from creation to a control owner’s upload in Task Manager; work a section offline and check it back in |
| Workpapers and review | Projects | Up to five sign-off levels, version history, PDF annotation, preserved activity log after archive, field-level AI assistant | Reopen a signed-off test and show what the log records; find every file a departed auditor touched |
| Issues and follow-up | Issue Tracker, Projects, Results, Task Manager | Owner-updated actions, retest and closure, exception records with triggers and questionnaires | Age an issue past due and show who is notified; validate a closed action against evidence |
| Reporting | Projects, Activity Center, Storyboards, Reports (retiring) | Word and PDF project reports, dashboards, scheduled broadcasts, AI reporting in early adoption | Produce your current audit committee pack from live data, then change one filter |
SOX and controls
Diligent sells SOX under Internal Controls, and the platform supports it two ways. In Projects the Internal Control workflow gives each control a walkthrough, a test plan and one or more testing rounds, with sign-off levels and custom test ratings; the SOX template built on COSO 2013 provides a starting control library; Mission Control lets you bulk-update up to 50 controls at a time, which is how you reassign the controls of an owner who has left; and since 18 June 2026 effectiveness can be recorded per scoped asset within a testing round, which matters for ITGC populations spread across many systems. The Internal Controls Management solution adds continuous monitoring: Results metrics and triggers watching control performance, and the Control Performance tables that gained control descriptions and custom attributes in October 2025. The Internal Controls product page claims AI mapping of controls to regulations and AI-drafted descriptions for gaps, and cites 80 percent time saved on testing, evidence collection and reporting; those are vendor figures with no method published.
Where it is weaker than the SOX specialists is the program layer around the controls: deficiency evaluation and aggregation, certification and sub-certification cascades, and the year-end roll-up that an external auditor wants to read. Optro (formerly AuditBoard) began life as SOXHUB, and Workiva relaunched its GRC platform around SOX and reporting on 9 March 2026; both are built around the ICFR program in a way Diligent One is not. That is why the fit table below rates a SOX-heavy public company as workable rather than a strong fit. The site’s guides to SOX 404 and to SOX compliance software cover the requirements and the alternatives, and the risk and control matrix template maps directly onto the risk-control pairing Projects uses.
Analytics, integrations and automation
This is the section that decides whether Diligent One is the right product. Three engines exist. ACL Analytics is the desktop tool, now at version 19 (4 December 2025): it added an AI command for natural-language analysis inside scripts, a Databricks connector, connector fixes for Amazon Athena, Concur, Jira, Oracle and Snowflake, and password support for the Python command. Version 19 also forced a cutover: it talks only to diligentoneplatform.com, encrypts Robots Agent traffic with AES-256 instead of Twofish, dropped the 2016 Access database engine so that old .xls and .mdb files no longer import, and removed ScriptHub, whose scripts moved to the Developer Portal in March 2025. Support for Analytics 17 ended the day version 19 shipped.
Robots is the scheduler and the cloud runtime, and its documentation is unusually candid about limits. Three robot types exist. ACL robots run scripts written in Analytics, in the cloud (60-minute task limit, five concurrent tasks) or on an on-premise Robots Agent with no limit. HighBond robots run Python with Diligent’s HCL library, pandas, NumPy and Requests in a Jupyter-style cell editor, cloud only, with pip installs allowed and no task limit yet (a 12-hour cap is planned). Workflow robots automate platform actions with a 15-minute limit and are restricted to System Admins with a Professional subscription; the event-triggered tasks Diligent intends for them are, in its own words, still being developed. An Ask AI panel helps write scripts. ACL Robotics replaced the Analytics Exchange server when AX support ended on 1 January 2023, and the Robots Agent must be on TLS 1.2 from 3 September 2026.
Results is where analytics meets workflow: collections, analyses and tables hold exceptions; records get priority, status, owner, comments and attachments; triggers act on thresholds; metrics track a column over time; questionnaires gather explanations; and any table can be linked to a walkthrough, test or risk in Projects as evidence. That link is the practical difference between owning an analytics tool and running continuous monitoring: the accounts payable tests or journal entry scoring you run on a schedule land as records someone must clear, and the clearing is evidenced. Connectivity is broad: the vendor claims more than 100 data connectors, and an SAP-certified connector replaced Direct Link when its support ended on 30 June 2025. The HighBond API is documented for integration and gained endpoints for control and test attachments on 9 July 2026; SCIM provisioning arrived in February 2024 and OIDC login in November 2024.
The honest caveat is skills. ACLScript is a domain language from the 1990s, HCL is a Python library that Diligent says will replicate ACLScript commands over time, and its own advice to script writers making the move is to take an introductory Python course. A function whose one ACL expert has retired has a real decision to make between retraining, leaning on ACL AI Studio’s natural-language layer, and the alternatives compared in the site’s guide to audit analytics software. Our separate ACL Analytics review goes deeper on version 19, and Arbutus Analyzer, which converts ACL projects, is the usual escape route for teams that want the language without the platform.
AI: what is real
Diligent has shipped or announced more AI features for auditors than any vendor we reviewed. The table lists them with the dates from Diligent’s release notes and press releases and the status a buyer should assume.
| Feature | Date | What Diligent says it does | Status to assume |
|---|---|---|---|
| ACL AI Studio | Announced 15 July 2025; general availability 25 September 2025 | Natural-language analysis of uploaded data, AI-recommended tests, logged and traceable results, ACL script compatibility | Shipped; agentic mode 2 February 2026; Claude 4.6 model since 17 September 2026; publishes to Results since 23 September 2026 |
| AI-Generated Requests (Projects) | 9 December 2025 | Drafts a document request list from planning details, controls, test plans and existing requests | Shipped; needs AI features enabled by a System Admin |
| Test Planning Agent (Projects) | 19 February 2026 | Generates draft test plans for controls without one; AI fields marked and must be reviewed before saving | Shipped |
| AI Assistant for rich text (Projects) | 20 February 2026 | Drafts, edits, shortens, changes tone and translates inside a field; no access to other project data | Shipped; subject to regional availability |
| AuditAI suite | 10 March 2026 | AI planning and control intelligence, contextualized AI across risks and controls, AI-generated request and evidence management, approvals and traceability | Umbrella brand for the Projects and Task Manager agents; adoption claims are vendor figures |
| Audit agent for Task Manager | 7 April 2026 | AI-powered control summaries for business users | Shipped |
| AI Reporting | 15 June 2026 | Template-based and conversational report generation | Early adopter program |
| Risk Maestro, renamed AI agent | 26 June 2026; renamed 10 September 2026 | Real-time risk intelligence in Task Manager | Shipped; enabled per organization |
| Evidence Hub | 6 August 2026 | Centralized evidence management with AI-assisted review | Early adopter program |
| Orchestration, risk management and internal audit agents | 15 September 2026 | Natural-language coordination that routes work to specialist agents; the audit agent maps risks to objectives, links controls and supports evidence and findings | Announced; Diligent says the underlying GRC brain reaches select solutions in October 2026 |
Three things are real. ACL AI Studio has been generally available since 25 September 2025, took an agentic mode on 2 February 2026 and has run on the Claude 4.6 model since 17 September 2026; it can read unstructured PDFs since 20 August 2026 and publish tables into Results for continuous monitoring since 23 September 2026. The Projects agents for requests and test plans have shipped to every customer that enables AI features. And the governance statements are specific: Diligent’s trust page says the company does not by default use AI models trained on customer data, that any deviation needs customer authorization, that AI-generated content is labeled in its products, and that models run on Amazon Bedrock with the same retention, encryption and residency controls as the rest of the platform. The product page adds that every consequential agent action requires human approval and that every step is captured in a traceable audit trail.
Three things are not yet real for most customers. The orchestration, risk management and internal audit agents announced on 15 September 2026 reach select solutions from October 2026, according to Diligent, so nobody outside early access has run them through a year-end. AI reporting and Evidence Hub are early adopter programs. And availability is regional: AI editing in Projects is subject to regional availability, a cross-region processing option added on 11 March 2026 lets an administrator route AI requests to another region to reach newer models (which moves data), and the GovCloud app table does not list ACL AI Studio at all. The vendor’s outcome claims (early AuditAI adopters cutting audit administration by about 70 percent, from roughly 120 hours of coordination to 35; about $10,000 saved per audit) come with no published method. Gartner’s Market Guide for Audit Management Software (13 April 2026) told buyers to be particularly wary of agent-washing; the right response here is not doubt about whether the features exist, because they do, but insistence on seeing the approval log and the labeled output for one real engagement. The site’s guide to evaluating AI in audit software has the test plan, and the auditor’s prompt library shows what checkable output looks like.
The scorecard
The 12 areas below are the ones we score for every internal audit platform, with one line of evidence each. Strong means the documentation shows depth a demanding function would use; Adequate means it does the job with gaps a buyer should probe; Limited means you will need something else or a hard negotiation.
| Area | Rating | Evidence |
|---|---|---|
| 1. Risk assessment and planning | Strong | Assurance Plans, Scheduler and Frameworks cover universe, coverage and resourcing; Assessment Drivers populate risk scores from Results metrics; Risk Manager and Strategy sit on the same platform |
| 2. Engagement workflow | Strong | Workplan and Internal Control workflows, templates and rollforward, up to five sign-off levels, custom terminology, 500 objectives per project |
| 3. Workpapers and evidence | Strong | File version history, in-platform PDF annotation, activity log preserved after archive, offline and mobile access, requests tracked in the project |
| 4. Issues and follow-up | Strong | Issue Tracker across projects, owner-updated actions, retest and closure, Results triggers for exception aging and escalation |
| 5. Reporting | Adequate | Word and PDF project reports; the Reports app retires on 30 September 2026 for Activity Center; reviewers call dashboards hard to customize; AI reporting still in early adoption |
| 6. SOX and controls testing | Adequate | COSO 2013 SOX template, testing rounds, per-asset effectiveness, Mission Control bulk updates; program-level deficiency aggregation and certification lag the SOX specialists |
| 7. Analytics and automation | Strong | ACL Analytics 19, three robot types with Python and ACLScript, 100+ connectors claimed, Results exception workflow; the category’s reference implementation |
| 8. AI features | Adequate | The broadest roadmap in the market and clear data-use statements, but the 2026 agents are early access or regional, and GovCloud lacks ACL AI Studio |
| 9. Quality program support | Adequate | Configurable sign-offs, methodology enforced through project types and frameworks, Timesheets for utilization; no QAIP metric set documented |
| 10. Auditee experience | Strong | Task Manager for business users, requests with automatic reminders, action status updates without a license, questionnaires; Task Manager is unsupported in GovCloud |
| 11. Administration, integrations and security | Strong | ISO 27001 certification, annual SOC 2 Type II, FedRAMP Moderate and DoD IL5 configurations, nine commercial regions, SAML SSO, SCIM, OIDC, documented API |
| 12. Cost and contract | Limited | No public audit pricing; Vendr data is board-portal deals; reviewers cite paid add-ons and restricted licenses; 30-day extraction window after termination |
| Vendor viability | Stable owner, open sale question | Owned by Insight Partners, Clearlake and Blackstone; a sale at about $7 billion explored from November 2024 with no completion found; heavy retirement schedule (AX, Direct Link, Reports, highbond.com) shows a vendor consolidating, and one that moves customers often |
Seven Strongs, four Adequates and one Limited is a better card than most enterprise GRC suites earn for their audit module and a slightly worse one than the audit-first platforms earn on reporting and cost. The pattern is consistent with the reviews: the workflow and the data layer are deep, the presentation layer and the commercial layer are where buyers get frustrated. If your function will use Results and Robots, the card reads as a buy; if it will never run an analytic, you are paying for the strongest part of the product and living with the weakest.
Fit by situation
The eight situations below are the same on every review and comparison in this guide, so you can read across products. The ratings are ours; the reasons are specific to Diligent One.
| Situation | Fit | Why |
|---|---|---|
| First system for a small team (1 to 5 auditors) | Workable | The Workplan workflow and templates suit a small team, and Diligent markets a four-week Audit Quick Start, but there is no public small-team price and reviewers cite license restrictions; TeamMate has a published two-user quote |
| Mid-size function (6 to 25 auditors) | Strong fit | The core buyer: enough engagements to justify Frameworks, Scheduler and Timesheets, and enough data to use Results and Robots |
| Large or global function (25+ auditors) | Strong fit | Nine hosting regions, SCIM provisioning, Frameworks syncing to many projects, Mission Control bulk updates and an on-premise Robots Agent for data that cannot leave the network |
| SOX-heavy public company | Workable | The Internal Control workflow and COSO template do the testing; program-level SOX (deficiency aggregation, certifications, external auditor packs) is where Optro and Workiva are stronger |
| Bank or credit union | Strong fit | Full-population testing and continuous monitoring built in, ISO 27001 and SOC 2 Type II attestations, an issue lifecycle that stands up to examiners, and analytics that test whole populations rather than samples |
| Public sector, higher education or nonprofit | Strong fit | FedRAMP Moderate and DoD IL5 GovCloud configurations for US federal, state, local and education bodies; the same vendor sells Community and BoardEffect to councils and nonprofits, though neither is supported inside GovCloud, so check the app gaps first |
| Analytics-heavy team | Strong fit | ACL Analytics, Robots with Python and ACLScript, Results triggers and ACL AI Studio; the reference product for this situation |
| Consolidating GRC across the three lines | Strong fit | Risk Manager, Compliance Maps, Policy Manager, IT and third-party risk, board portals and audit on one platform; Diligent says Forrester named it a Leader for GRC platforms in Q2 2026 |
Read the two Workable rows carefully, because they are where the sales conversation will push hardest. A five-person team can run Diligent One well; the question is whether it will pay for the platform it is not using, and the only way to answer it is a written quote for exactly the apps and user types you need. A SOX-heavy company can also run it well, particularly if its SOX team already lives in Results for continuous controls monitoring; the question is whether the external auditor’s year-end pack will be produced by the tool or around it.
Pricing and contract
Diligent does not publish prices for the audit modules, and unlike Optro and TeamMate we found no public procurement record that states an audit contract value. What exists in public is set out below, with the rival figures included only to give a sense of scale.
| Source | Date | Figure | What it covered |
|---|---|---|---|
| Vendr buyer data | Updated February 2026 | Median $26,250 a year; range $5,550 to $48,263; 72 purchases | Diligent contracts generally, dominated by Diligent Boards, Entities and ESG; not an audit benchmark |
| Vendr buyer data | Updated February 2026 | Annual escalations of 3 to 5 percent at renewal; onboarding fees of $5,000 to $25,000 and up, often negotiable | Board-portal deals; useful as a pattern, not as a price |
| Diligent Audit Quick Start page | Accessed 26 September 2026 | “One single yearly cost & no hidden fees”; four-week average implementation claim; no figure | Packaged audit management with an introduction to robotic automation |
| Diligent ACL Analytics page | Accessed 26 September 2026 | Free 30-day trial | ACL Analytics only |
| Diligent help center | Accessed 26 September 2026 | Academy training included at no extra cost; some toolkits free, others tied to a solution or sold separately | Platform subscription and solutions |
| Diligent help center | Accessed 26 September 2026 | Workflow robots need a System Admin with a Professional subscription; AI editing limited to System Admins and Professional Users | Features gated by user type |
| Gartner Peer Insights reviewers | Accessed 26 September 2026 | Restricted user licenses with additional fees named as a weakness | Reviewer theme, not a price |
| City of Norman, Oklahoma (TeamMate quote) | 28 February 2025 | $6,150.88 a year for two TeamMate+ Audit Essentials users, including TeamMate Analytics and hosting; $15,630 implementation | A rival’s public small-team price, for scale |
| West Virginia DOT (AuditBoard bid) | June and November 2023 | $164,000 a year for 25 core users and unlimited stakeholders; $50,000 implementation; a bid response, not an award | A rival’s public mid-size price, for scale |
The pricing model, as far as the documentation shows it, is a platform subscription priced by user type, plus solutions, plus toolkits that are free, bundled or sold separately, plus services. Things likely to cost extra, judging by the documentation and the review themes: solutions beyond Audit Management; toolkits outside your solution; Professional subscriptions for the people who need Workflow robots or AI editing; implementation and consulting, which Diligent says its own consultants deliver for solutions; a secondary commercial instance for GovCloud customers who want features not authorized there; and desktop Analytics licenses. Nothing on Diligent’s site confirms or denies any of these as line items, which is the point: get the order form to name every app, solution, toolkit, user type and instance, with quantities.
Negotiation notes, drawn from public guidance rather than from any deal we have seen. Vendr’s advice for Diligent buyers (multi-year commitments, bundling, quarter-end timing, negotiable onboarding fees) comes from board-portal purchases and may or may not transfer to audit. Our own additions are contract structure rather than price. The exit: the trust page gives 30 days of access after termination to extract data and says the system may be destroyed 90 days after that, so write a longer window and a defined export format into the contract and test the export during the trial. Renewal: cap the uplift in writing; Vendr’s 3 to 5 percent escalation pattern is the vendor’s opening position. Change of control: with a sale explored since November 2024, ask for assignment language that preserves price and service levels. Retirements: the Reports app, Direct Link and AX all reached end of life during customer contracts, so ask for a clause that replacement functionality is included at no charge when Diligent retires something you bought. The site’s guides to internal audit software pricing and to selecting an audit management system give the full negotiation method.
What users say
Diligent One Platform is rated 4.1 out of 5 from 148 reviews in Gartner Peer Insights’ Audit Management Solutions market, third by volume behind Optro (890) and Workiva (597). The product’s overall Peer Insights listing across every market it is reviewed in shows 4.2 from 357 ratings, with 46 percent five-star, 46 percent four-star, 7 percent three-star and 1 percent two-star. On G2 it is rated 4.3 from 154 reviews, where it is listed under enterprise risk management and GRC rather than audit. The themes below are paraphrased from those two sites; the counts are G2’s own tallies of how many reviews raise each point.
| Theme | Praise or complaint | Where seen |
|---|---|---|
| One platform for audit, risk, compliance and the board | Praise | Gartner Peer Insights (consolidates data capture, process automation and dashboards); G2 (flexibility and integration, 6 reviews) |
| Ease of use for auditors | Praise | G2, the most-cited strength (10 reviews) |
| Audit tracking and compliance management | Praise | G2 (6 reviews each) |
| Executives and directors can reach documents without training (a board-portal strength) | Praise | Gartner Peer Insights |
| Support slow to resolve technical issues | Complaint | Gartner Peer Insights |
| Dashboards hard to customize and thin on insight | Complaint | Gartner Peer Insights |
| Restricted user licenses and extra fees for add-ons | Complaint | Gartner Peer Insights |
| Navigation, inflexible modules and a steep learning curve | Complaint | G2 (3 reviews each) |
| Limited or missing features for basic needs | Complaint | G2 (4 and 3 reviews) |
| Slow loading and slow performance | Complaint | G2 (3 reviews each) |
Two readings are fair. The generous one is that the complaints cluster around presentation and commerce (dashboards, licenses, support) rather than the audit work itself, and that a vendor replacing its reporting app and its navigation (a new top navigation shipped on 1 September 2026) is at least responding. The stricter one is that 4.1 in a market where the two larger rivals score 4.5 and 4.3 is a gap, and that support and performance are the complaints a buyer cannot fix by configuration. Reference calls should ask about ticket resolution times and about page load in Projects at the reference’s data volume.
Implementation and migration
Diligent’s Audit Quick Start page claims a four-week average implementation for its packaged audit offer and a 402 percent return on investment; both are vendor figures without a published method, and four weeks describes a templated deployment for a function that accepts the shipped workflow, not a migration of ten years of workpapers. The documentation gives a better picture of the effort. Content comes in through project templates and framework libraries, and through the Bulk Importer, which loads projects, frameworks, objectives, risks, controls, issues, actions, requests and time entries from an Excel template at up to 2,000 records a time. Identity comes through SAML 2.0 single sign-on, SCIM provisioning (available since February 2024, with Ping One and OneLogin added in January 2025) and, since November 2024, OIDC login; just-in-time provisioning of SSO users was withdrawn in January 2025, so plan SCIM. Training is Diligent Academy, included at no extra cost, with named learning paths such as PROJ 100 and REPT 100; peer support is the Diligent Connect community, which GovCloud tenants can reach only through a secondary commercial instance. The site’s guide to implementing audit management software covers the first 120 days for any platform.
Existing HighBond customers have a separate migration to run in 2026, and it is not optional. Every integration, SSO configuration, allowlist and API token that references highbond.com must move to diligentoneplatform.com before 16 December 2026. Analytics 19 speaks only to the new domain and requires the on-premise Robots Agent to be upgraded at the same time; the agent must also be on TLS 1.2 from 3 September 2026. Anything built in the Reports app must be rebuilt in Activity Center by 30 September 2026. Scripts that lived in ScriptHub moved to the Developer Portal in March 2025, and any Analytics workflow that still reads .xls or .mdb files breaks on version 19. None of this is unusual for a platform consolidation, but it is a quarter or two of administrator time, and a buyer arriving now should ask the vendor to confirm the tenant is already on the new domain and Activity Center.
Leaving is documented better than most. The trust page states that customers own their data, can extract it at any time through administrators, get 30 days of access after termination, and can request destruction of the system afterwards. Projects can be archived read-only with their history intact, Impact Reports and project reports export to Word and PDF, and the HighBond API and Results downloads cover the structured data. Test all of that before you sign, not after: the site’s annotated workpaper examples show what a complete exported file has to contain to remain evidence.
How it compares
Optro (formerly AuditBoard) is the product most Diligent One prospects also shortlist. It is rated 4.5 from 890 reviews on Gartner Peer Insights and 4.6 from about 1,613 on G2, Vendr’s buyer data puts its median contract at $45,947 a year (updated February 2026), and its 2023 West Virginia DOT bid response priced 25 core users at $164,000 a year. It wins on ease of use, SOX program depth and the size of its reviewer base; it is weaker on analytics and customization, which is Diligent One’s home ground. Our Optro vs Diligent One comparison works through the choice, and the Optro review covers the March 2026 rebrand and the Midship acquisition.
TeamMate (Wolters Kluwer) is the other audit veteran: 4.2 from 120 reviews on Peer Insights, 4.3 from 597 on G2, a published City of Norman quote of $6,150.88 a year for two users, and strength in the public sector. Its analytics is an Excel add-in with 150-plus tests, which is easier to adopt and far less powerful than ACL and Robots; the FedRAMP Marketplace lists TeamMate Audit and Controls as authorized at the Moderate level since 13 May 2022, level with Diligent One’s own Moderate authorization, though TeamMate’s own product page still says the status is upcoming. The TeamMate vs Diligent One comparison and the TeamMate review go further.
Workiva (4.3 from 597 on Peer Insights) relaunched its GRC platform on 9 March 2026 and prices with unlimited users; it is the choice when SOX and external reporting dominate. On the analytics side, Caseware IDEA and Arbutus Analyzer compete with ACL Analytics for the desktop, and Arbutus converts ACL projects; the IDEA vs Arbutus vs ACL comparison covers that decision. For the whole field by use case, see the guide to the best internal audit software, and for reading the analyst reports Diligent cites, the site’s guide to audit software analyst reports explains what a Forrester Wave Leader placement does and does not tell you.
Questions about Diligent One
Is Diligent One Platform the same as HighBond?
Yes. Diligent HighBond was renamed the Diligent One Platform on 31 January 2024, with GovCloud tenants renamed on 5 March 2025. The domain followed: diligentoneplatform.com launched on 31 July 2025 and highbond.com stops working for login, SSO and API access on 16 December 2026. Some component names keep the old word, including the HighBond robot, the HighBond API and the HighBond mobile app.
Is HighBond the same as ACL or Galvanize?
HighBond was the cloud platform built by Galvanize, which was ACL Services of Vancouver under a new name after it combined with the GRC vendor Rsam. Diligent completed its acquisition of Galvanize on 7 April 2021. ACL Analytics is still sold as the desktop analytics tool, now at version 19, and ACLScript still runs in ACL robots; ACL GRC was the platform’s earlier name before the move to highbond.com in June 2019.
How much does Diligent One cost?
Diligent publishes no price for the audit modules and we found no public procurement record for an audit contract. Vendr’s Diligent data (median $26,250 a year, updated February 2026) is dominated by board-portal purchases and should not be used as an audit benchmark. Expect a quote built from a platform subscription by user type, one or more solutions, toolkits and services, and insist that the order form itemizes all of them.
Is Diligent One right for a small team?
It can be run by a team of one to five, and Diligent’s Workplan workflow and Audit Quick Start package are aimed at that size. We rate it Workable rather than a strong fit because there is no public small-team price, reviewers cite license restrictions and add-on fees, and a small team without an analytics program pays for the platform’s strongest layer without using it. Compare it with TeamMate’s published two-user quote and with the options in the site’s guide to audit software for small teams.
Does Diligent One work in AWS GovCloud, and what is missing there?
Yes. Diligent’s documentation states a FedRAMP Moderate authorization for all agency configurations and DoD IL5 for federal implementations, with separate configurations for state, local and education bodies. The same page lists apps not supported in GovCloud: Task Manager, Boards, BoardEffect, Community, ESG, Equity and Policy Manager. Its regional table lists ACL AI Studio for the nine commercial regions but not for GovCloud, and the authenticated community and Academy are reached through a secondary commercial instance. The Reports app reached end of life in GovCloud on 28 February 2026, earlier than the commercial date.
What happens to old ACL scripts and the Reports app?
ACL scripts written in Analytics continue to run in ACL robots, in the cloud or on an on-premise Robots Agent, and ACL AI Studio is described as compatible with legacy scripts. The Analytics Exchange server that used to schedule them lost support on 1 January 2023, and Analytics 19 requires the new domain and an upgraded agent. The Reports app reaches end of life on 30 September 2026 for commercial tenants; Diligent’s replacement is Activity Center, and any custom report you rely on must be rebuilt there.
internalauditguide.com has no commercial relationship with Diligent, Optro, Wolters Kluwer, Workiva, Caseware, Arbutus Software or any other vendor named on this page. We take no vendor money, run no affiliate links and accept no sponsored placements, and no vendor saw this page before publication. Product and company names are the trademarks of their owners. Corrections: desk@internalauditguide.com.
Sources and verification
- Diligent, Internal Audit product page — the orchestrator, audit agent, board reporter and risk agent; the $10,000-per-audit and 70 percent claims; analyst and customer claims (accessed 26 September 2026).
- Diligent One Platform Trust and Compliance — ISO 27001 certification, annual SOC 2 Type II, hosting regions, AES-256 encryption, recovery objectives, 30-day extraction window, generative AI principles and Amazon Bedrock (accessed 26 September 2026).
- Diligent help center, Commercial and GovCloud regions and limitations — FedRAMP Moderate and DoD IL5 statements, app availability by region, apps unsupported in GovCloud (accessed 26 September 2026).
- Diligent help center, General release notes — the 31 January 2024 rename, the domain moves, SSO, SCIM and OIDC dates, the new navigation (accessed 26 September 2026).
- Diligent help center, End of support announcements — AX, Direct Link, Reports app, Analytics version and TLS 1.2 dates (accessed 26 September 2026).
- Diligent help center, Analytics 19.0 release notes — the 4 December 2025 release, AI command, connectors, domain and encryption cutover (accessed 26 September 2026).
- Diligent help center, ACL AI Studio release notes — general availability on 25 September 2025, agentic mode, cross-region processing, the Claude 4.6 model, Results integration (accessed 26 September 2026).
- Diligent help center, Projects release notes — AI-Generated Requests, Test Planning Agent, AI Assistant, Task Manager rename, Risk Maestro, sign-off levels, test ratings, per-asset effectiveness (accessed 26 September 2026).
- Diligent help center, Executing your audit — Projects workflow, templates, Frameworks sync, Assessment Drivers, requests, issue remediation, Results linking (accessed 26 September 2026).
- Diligent help center, Python and HCL scripting in Robots — the three robot types, task limits, libraries, permissions and the HighBond API (accessed 26 September 2026).
- Diligent newsroom, AuditAI at IIA GAM 2026 — the 10 March 2026 launch, named capabilities and early-adopter claims (accessed 26 September 2026).
- Diligent newsroom, new agentic capabilities in Diligent One — the 15 September 2026 orchestration, risk management and internal audit agents and October 2026 availability (accessed 26 September 2026).
- Reuters via U.S. News, 14 November 2024 — the $7 billion sale exploration, the 2016 take-private and the Clearlake and Blackstone investment dates (accessed 26 September 2026).
- Diligent newsroom, reposting Fortune’s exclusive on the Galvanize deal — the reported $1 billion price for the Galvanize acquisition announced 24 February 2021 (accessed 27 September 2026).
- Gartner Peer Insights, Audit Management Solutions — 4.1 from 148 reviews and the market’s other ratings; review themes from the product page (accessed 26 September 2026).
- G2, Diligent One Platform reviews — 4.3 from 154 reviews and the counted pros and cons (accessed 26 September 2026).
Related guides
- Internal audit software: the independent buyer’s guide — every review, comparison and buying guide in one place.
- How we review audit software — the evidence levels, the scorecard and the fit-by-situation method.
- The audit software shortlist finder — eight questions, a shortlist with the reasons from each review.
- The requirements matrix — 156 weighted requirements and vendor scoring in a free Excel workbook.
- Optro vs Diligent One — GRC breadth against analytics heritage, decided by situation.
- TeamMate vs Diligent One — two audit veterans and two different bets.
- ACL Analytics review — version 19, AI Studio, Robots and what replaced AX.
- Best internal audit software — 25 platforms and tools compared by use case.
- Types of internal audit software — audit management, GRC, SOX, compliance and analytics, and which one you are buying.
- Internal audit software pricing — the public numbers, pricing models and how to negotiate.
- How to read audit software analyst reports — Gartner, Forrester, G2 and the rest, decoded.
- Audit analytics software compared — IDEA, Arbutus, ACL, Alteryx, Power BI and Python.
- The audit software demo script — 25 scenarios that make vendors show, not tell.
- Audit software due diligence — security, data residency, AI data use and vendor stability.
- Selecting an audit management system — a vendor-neutral RFP method.
- Evaluating AI in audit software — what is real and what is agent-washing.
- Implementing audit management software — the first 120 days and migrating off Excel.
- Audit software for banks and credit unions — regulatory issues, exam support and fit.
Leave a Reply