Empowered Systems sells two products under one small company: AutoAudit, a Windows desktop program the vendor says has served internal audit teams for more than 30 years, and Connected Risk, the cloud platform Empowered now treats as its main offering. AutoAudit is the legacy line: the vendor’s own page says it “remains available during limited sales periods,” not as a standard catalog product. Both products carry a customer list heavy with large banks — Citi, RBC, TD, Santander, MUFG, Nomura, SMBC and ADCB are all named on Empowered’s own site — which is exactly the credibility signal a bank or credit union audit function looks for. What a buyer gets to verify that signal against is unusually thin: Empowered Systems publishes no security or trust-center page, no pricing page, no press archive, and its public review base runs to four rating rows across two platforms, several in the single digits — the thinnest public record of any product covered in this guide.
This review covers who owns Empowered Systems, including a founding-date and headquarters discrepancy between the vendor’s own story and Gartner’s profile; what Connected Risk’s eight modules contain; the AI features named on its release-note blog; the security and pricing information that could not be found anywhere; and the four separate rating rows — two products, two platforms — that make up its review record. It is one of the reviews in the site’s independent buyer’s guide to internal audit software and follows the evidence levels set out in how we review audit software. Readers whose shortlist is bank-specific should also see audit software for banks and credit unions.
Verdict. Empowered Systems earns a Strong fit only for a large or global bank, credit union or other regulated financial institution that wants a configurable, “zero-code” workflow across audit, controls, risk, third-party and model-risk work, and that is prepared to get security, pricing and product-direction answers from the vendor directly rather than from anything published; bought on the strength of the logo wall alone, it asks a buyer to accept a thinner public record than any other product in this guide.
Best for. Bank, credit union and insurer audit functions, particularly large or global ones, that want internal audit alongside controls, enterprise risk, third-party risk, model risk and policy management on one configurable platform, and that can get the security and pricing detail Empowered does not publish confirmed in writing before signing.
Not for. A first system for a small team, an analytics-heavy function that wants scripted or full-population testing, a public-sector, higher-education or nonprofit buyer (no such customer is named on Empowered’s site), or anyone who wants a published price, a named AI model provider or a security certification to check before the first call.
Evidence. Research-based: vendor documentation and release notes, public procurement records, third-party pricing data, verified user reviews on Gartner Peer Insights and G2, and analyst coverage. We have not used the product hands-on for this review.
Price evidence. No public price; quote only. Empowered’s own demo page routes pricing interest straight to a contact form, and neither AutoAudit nor Connected Risk could be found on Vendr, Capterra or TrustRadius.
Last verified. 27 September 2026.
In this guide
- What Empowered Systems is, and who owns it
- What you get: modules and how audit fits
- Walkthrough by audit stage
- SOX and controls
- Analytics, integrations and automation
- AI: what is real
- The scorecard
- Fit by situation
- Pricing and contract
- What users say
- Implementation and migration
- How it compares
- Questions about Empowered Systems
- Sources and verification
- Related guides
What Empowered Systems is, and who owns it
Empowered Systems’ own “About” page dates the company to 1995, when it says its story began as “Paisely Consulting” — the site’s own spelling; the more common rendering is “Paisley.” Gartner’s company-profile field, attached to both of Empowered’s Peer Insights listings, disagrees on both counts: founded 2001, headquartered in Dover, United States, against the vendor’s own 1995 start and UK registered office. Neither page reconciles the other, and this review could not either; treat both dates as claims, not fact, and ask Empowered directly which one it stands behind. The operating UK entity is Empowered Systems Ltd., Companies House registration number 13416888, registered at 6 Lloyds Avenue, Suite 4cl, London EC3N 3AX.
The same Gartner field adds a third claim with only itself as a source: that Empowered “was formerly part of Thomson Reuters Risk Management/Refinitiv Enterprise Risk Management Solutions before becoming independent in 2021.” Empowered’s own about page does not mention this history, and no second source corroborates it. Do not confuse it with a live, separate fact: the Regulatory Change Management module currently lists Thomson Reuters, alongside LexisNexis, as a content feed — a current partnership, not evidence for the historical-ownership claim.
No parent company or private-equity sponsor is named anywhere on the site, and Gartner tags the company “Private.” The leadership page names six executives, led by CEO Vincent Celestino and CFO Kyle Fisher. Gartner is the only source for headcount, 51 to 200 employees; the careers page gives no number to check it against.
Scale claims are inconsistent too. The About page states “300,000+ users use our products worldwide,” undated and not attributed to either product. AutoAudit’s own page separately claims “more than 300 organizations worldwide” use that one desktop product — a different, non-additive figure, since Empowered states nowhere how many organizations use Connected Risk.
The fullest customer list, combining the Connected Risk and SOX/ICFR pages, names twelve organizations, eight of them banks: Citi, RBC, TD, Santander, MUFG, Nomura, SMBC and ADCB, the last named only on the platform page. The remaining four are Aegon, an insurer; LSEG, financial-market infrastructure; Alfa Laval, an industrial manufacturer; and Qatar Charity, a nonprofit — worth remembering whenever Empowered’s marketing leans on a built-for-banks framing, since the pitch is real but not quite as clean as the logo wall suggests. No case study, deal size, seat count or go-live date is attached to any of the twelve; each appears only as a static logo.
Analyst recognition is one area where the record is unambiguous: there is none. Optro (formerly AuditBoard), LogicGate, Archer and IBM each claim a Leader placement in Gartner’s Magic Quadrant for GRC Tools, Assurance Leaders (27 October 2025), and Optro, Diligent, LogicGate and Vanta each claim one in the Forrester Wave for GRC Platforms (Q2 2026); Empowered claims neither, and Gartner’s own Market Guide for Audit Management Software (13 April 2026, analyst James Bourke) does not name it at all. The guide to reading audit software analyst reports has the fuller method for weighing a placement most vendors here claim and Empowered does not. The table below covers the dated events this research could locate.
| Date | Event | Why it matters |
|---|---|---|
| 1995 or 2001 (disputed) | Founded, per the vendor’s page or Gartner’s profile field | Both sources cannot be right |
| 2021 (single Gartner source) | Said to become independent of Thomson Reuters/Refinitiv | Unverified; Empowered’s own site says nothing of it |
| 29 Oct 2025 | Connected Risk 25.3.0 ships: My Workspace hub, Empowered AI (the first named AI feature), Quick Edit Panel | First dated release in this window |
| 5 May 2026 | Connected Risk v26.1 ships: AI-Powered Search (hosted clients only), Teams notifications, self-service dashboards | Most recent dated release found |
That is the entire dated record this research could locate: no acquisition, funding round, executive change or rebrand announcement carries a date anywhere on the site, and a guessed news-page URL returned nothing. For a company selling into banks that run vendor-risk programs on every supplier, a quiet public timeline is itself a data point to ask about directly.
What you get: modules and how audit fits
Connected Risk markets six “core” modules on its landing page: Internal Audit, Internal Controls, Enterprise Risk Management, Third-Party Risk Management, Model Risk Management, and Policy and Compliance. Empowered’s own sitemap shows two further module pages built and live but left off that headline list: Regulatory Change Management and Operational Risk Management. The working product surface is therefore at least eight modules, not six, and a buyer comparing Empowered’s marketing page against its own site should notice the gap.
| Module | What it covers | Audit relevance |
|---|---|---|
| Internal Audit | Audit universe, risk-based planning, fieldwork, workpapers, issues, reporting | The module this review is about |
| Internal Controls | Version-controlled control library, testing cycles, evidence, deficiency tracking | The SOX and ICFR module; see SOX and controls below |
| Enterprise Risk Management | Risk register, inherent, residual and target risk scoring, executive dashboards, linkage to controls and audits | Feeds audit planning where both modules are licensed together |
| Third-Party Risk Management | Vendor onboarding and due-diligence workflow, a centralized registry, risk tiering | More relevant to a three-lines buyer than to audit alone |
| Model Risk Management | Model registry, a development, testing, review and approval workflow with version control, recurring reviews | Named against SR 11-7, the Bank of England’s SS1/23 and Canada’s OSFI E-23 — a direct fit signal for banks |
| Policy and Compliance | Versioned policy library, approval cycles, attestation tracking, obligation mapping | Adjacent to audit rather than part of it |
| Regulatory Change Management | Obligation register, change alerts, LexisNexis and Thomson Reuters content feeds | Off the headline list; found only through the sitemap |
| Operational Risk Management | Risk and control self-assessment, key risk indicators, incident and loss tracking | Off the headline list; found only through the sitemap |
No named editions, tiers or free trial were found for either product. AutoAudit is instead sold as a single desktop product with a named feature list — Audit Planning and Programs, Electronic Workpapers, Findings Management — and one G2 reviewer names a reporting sub-feature, “Snap!Report,” that does not appear anywhere on Empowered’s own AutoAudit page. Localization runs further than most competitors here document: a Japanese-language Connected Risk page names a “Japanese subsidiary and partner GRCS” for local implementation, and a French translation of the v26.1 release notes exists, though no non-English pricing was found alongside either.
Whether an eight-module catalog reads as a benefit or a distraction depends on whether an audit function is buying alone or as part of a wider consolidation; the site’s guide to types of internal audit software sets out where a platform like Connected Risk sits next to an audit-native product and a full GRC suite. The site’s guide to the risk register covers the artefact the ERM module is built to hold.
Walkthrough by audit stage
Everything below comes from Connected Risk’s Internal Audit Management page and AutoAudit’s own feature page, not from using either product.
Planning and risk assessment
Connected Risk’s language is brief: “Develop and maintain audit plans that reflect your organization’s top risks, with built-in flexibility to reprioritize.” AutoAudit’s parallel feature carries a plainer name, “Audit Planning and Programs.” Neither page describes a scoring methodology, a rolling-plan mechanic or how resourcing is modeled; the site’s annual internal audit risk assessment playbook sets out what a plan built this way should be able to show.
Engagement and fieldwork
Connected Risk describes real-time collaboration on “workpapers, checklists, and documentation,” with Microsoft Office integration and named data pulls from Oracle and SAP. No staffing, scheduling or budget-tracking detail was found for either product, thinner documentation than several audit-native rivals here publish.
Workpapers and review
Workpapers sit inside the fieldwork description above, with no dedicated heading; AutoAudit instead names a discrete “Electronic Workpapers” feature. For review and sign-off, Connected Risk says centralized oversight lets audit managers and CAEs “monitor activity and maintain visibility across engagements”; AutoAudit’s role model names four parts: CAE for oversight, Audit Manager for planning and review, Auditor for fieldwork, and a stakeholder role for management’s response. Neither page names an explicit sign-off or a lock-and-freeze step once a workpaper is reviewed, worth confirming directly rather than assuming it.
Issues and follow-up
Connected Risk’s description is a single sentence: “Log issues, assign ownership, and track remediation through to closure.” AutoAudit’s equivalent feature is named “Findings Management.” Neither page names an escalation path, an aging report or a management self-reporting mechanic, the detail this guide’s life of a finding walkthrough treats as standard for a mature issues module.
Reporting
Connected Risk names “customizable reports and dashboards built for both leadership and regulators,” with export to Excel, Word and PDF carrying the customer’s own branding. AutoAudit’s reporting is described only as giving management visibility, with no export formats named. The single quantified outcome anywhere on Empowered’s site sits here rather than in a case study: a homepage claim of a “45% reduction in time spent control testing,” with no customer, sample size or methodology given, which this review treats as a marketing figure rather than a benchmark.
All of this comes from marketing copy, not screen-level documentation; no help-center article was reachable without a login, so ask to see each stage in a live demo rather than take the page descriptions as a specification. The site’s audit software demo script has 25 scenarios built for exactly that conversation.
SOX and controls
Internal Controls Management is a distinct module from Internal Audit, and it is where Empowered’s SOX and ICFR-relevant features sit: a version-controlled control library linked to risks, processes and policies; periodic or event-driven testing with automated assignment, deadlines and reminders; evidence upload with a traceable test-result review; and exception and deficiency logging through to closure. A separate SOX/ICFR page restates the same ground under three headings and adds that “SOX 404 requires annual control assessments,” framing non-compliance as a source of fines, audit failures and reputational harm.
Neither page names a sub-certification sign-off chain of the kind a chief executive’s or finance chief’s Section 302 or 404 certification relies on, and both display the same bank-heavy logo set with no case study tying any customer to SOX or ICFR use specifically. A SOX-centric buyer should treat this as thinner documentation than Archer or IBM OpenPages publish, and ask Empowered directly for the certification-chain detail this guide documents for both. The evidence-upload language above maps onto fields already kept in a risk and control matrix; the site’s risk and control matrix template is a useful basis for comparison, and the site’s SOX 404 guide sets out what a program needs from whatever system runs it.
Analytics, integrations and automation
Empowered’s own claim of “100+ apps already available in our directory” does not match what the live integrations page lists: Procreate, GitHub, Slack, Intercom, Google Drive, Jira, InVision, Dropbox, Mailchimp, Asana, WordPress and Figma — generic productivity and design tools with no audit, ERP, GRC or single sign-on relevance. This reads as unmodified website-template content, and the same problem recurs on the separate Features page, which returns generic non-GRC copy about “self-serve product and growth analytics” and “shared team inboxes.” Two under-maintained marketing pages on the same domain is a pattern, and this review treats the “100+” figure and both pages’ feature lists with real caution.
What is actually documented sits inside module pages instead: Microsoft Office plus the Oracle and SAP data pulls named on the Internal Audit page, Microsoft Teams notifications added in the May 2026 release, and named regulatory-content feeds from LexisNexis and Thomson Reuters on the Regulatory Change Management page. No API product or developer portal was found anywhere. No business-intelligence integration is marketed, though the same May 2026 release notes list a bug fix for “Power BI metric column display” — evidence a Power BI connector exists even though Empowered does not market it. A team that wants real audit analytics should plan for a second, dedicated tool; the site’s audit analytics software comparison covers the purpose-built options.
AI: what is real
Two named, dated AI features exist, correcting any assumption that Empowered has published nothing here. “Empowered AI” shipped with Connected Risk 25.3.0 on 29 October 2025: described as “context-aware” functionality that generates “tailored responses,” with automated remediation-plan drafting for audit findings named as a specific use case. “AI-Powered Search” followed in v26.1 on 5 May 2026: natural-language search across application data and attachments, permission-aware, and explicitly scoped to “hosted clients only” — unavailable, in other words, to any customer running Connected Risk outside Empowered’s own hosting.
What is missing matters more than what shipped. No model provider is named for either feature, unlike Optro, TeamMate, Onspring and LogicGate, each of which names one elsewhere in this guide. No data-use statement, training commitment, retention period or human-in-the-loop language was found for either feature, on the release notes or the privacy policy. A separate blog post on an AI governance playbook is thought leadership, not a feature announcement: it markets Connected Risk’s ability to help a customer inventory and risk-tier its own third-party AI — a different thing from Empowered AI or AI-Powered Search running inside the platform, and the two should not be confused in a demo.
Ask before enabling either feature on real workpapers: what model or provider processes the input, whether any of it trains a model Empowered does not fully control, and how “hosted” is defined for a customer never told what the alternative looks like. The site’s guide to evaluating AI in audit software has the fuller list, and the audit software due diligence guide covers the same questions for security more broadly.
The scorecard
The scorecard uses the 12 areas described on the method page. Every level below reflects documentation and reviews, not hands-on use, and several rows are marked thin because Empowered simply has not published enough to rate them with confidence.
| Area | Level | Evidence |
|---|---|---|
| Risk assessment and planning | Adequate | Plans tied to top risks and AutoAudit’s Audit Planning and Programs are both named; no scoring methodology or resourcing detail described |
| Engagement workflow | Limited | Fieldwork collaboration and Office integration are named; no staffing, scheduling or budget-tracking detail found |
| Workpapers and evidence | Adequate | AutoAudit names a discrete Electronic Workpapers feature; Connected Risk folds workpapers into fieldwork with no heading of their own, and neither details version control |
| Issues and follow-up | Limited | Both products name issue logging and remediation tracking in one sentence; no escalation path or aging report found |
| Reporting | Adequate | Connected Risk names export to Excel, Word and PDF with branding; AutoAudit’s reporting is described only as management visibility |
| SOX and controls testing | Limited | A real control library and deficiency workflow exist, but no sub-certification sign-off chain or account-mapping detail found |
| Analytics and automation | Limited | Only Office, Oracle/SAP data pulls, Teams notifications and an inferred Power BI connector are documented; the integrations page reads as generic template content |
| AI features | Limited | Two named, dated features exist, but no model provider, data-use statement or retention period was found for either |
| Quality program support | Not offered | No QAIP-metrics or methodology-enforcement feature was described anywhere |
| Auditee experience | Not offered | No auditee-facing request portal or notification feature specific to audit was found |
| Administration, integrations and security | Limited | No security or trust-center page exists; no SOC 2, ISO 27001 or FedRAMP claim was found |
| Cost and contract | Limited | No price, pricing model, Vendr listing or procurement record was found by any method attempted |
| Vendor viability | Limited | No parent or private-equity sponsor is named, headcount comes from Gartner alone, and the founding date and headquarters conflict with Gartner’s profile |
The pattern across the table is consistent: named features exist at almost every stage, but the second layer of detail a buyer needs to compare Empowered against a rival — methodology, data use, certification, price — is very often the layer that is missing.
Fit by situation
The eight situations are the same on every review in this guide, so ratings can be compared across products. Empowered’s ratings cluster around a clear story: strong only at the large-scale, bank-heavy end, workable through the middle, and poor at both a first system for a small team and any public-sector or nonprofit buyer, sectors it does not name a single customer in.
| Situation | Rating | Reason |
|---|---|---|
| First system for a small team (1 to 5 auditors) | Poor fit | No published price, no self-service path, and eight modules a small team has no reason to buy alongside audit |
| Mid-size function (6 to 25 auditors) | Workable | Internal Audit can run largely on its own at this scale, though the record of how it performs without the wider platform is thin |
| Large or global function (25+ auditors) | Strong fit | The named customer list is entirely large or global banks, and the eight-module catalog fits a function with the capacity to run it |
| SOX-heavy public company | Workable | A real control library exists, but no sub-certification sign-off chain or account-mapping detail was found next to what Archer and IBM OpenPages publish |
| Bank or credit union | Strong fit | Every named customer is a bank, insurer or financial-market infrastructure, and Model Risk Management is named directly against SR 11-7, SS1/23 and OSFI E-23 |
| Public sector, higher education or nonprofit | Poor fit | No public-sector, healthcare, higher-education or credit-union customer was found; Qatar Charity is the only name outside financial services and manufacturing |
| Analytics-heavy team | Workable | Oracle and SAP pulls and an inferred Power BI connector exist, but no scripted-testing or continuous-monitoring engine built for audit was found |
| Consolidating GRC across the three lines | Workable | Eight modules genuinely span the three lines, but no case study documents a customer running more than one together |
Functions consolidating model risk alongside audit should also see the site’s model risk audit guide, since Model Risk Management is one of the two modules — the other is Third-Party Risk Management, covered in the site’s third-party risk management program guide — most likely to sit next to Internal Audit in a Situation 8 deployment.
Pricing and contract
Empowered Systems is the least transparent product on price of anything covered in this guide, and unlike several of its more secretive peers, it does not even offer the usual second-hand proxies. The table below is short because that is the honest state of the evidence.
| Source and date | Figure | What it covered | How to read it |
|---|---|---|---|
| Empowered’s demo page (27 Sep 2026) | No figure; routes to a contact form | — | A funnel, not a price |
| Vendr, Capterra, TrustRadius (guessed product URLs, 27 Sep 2026) | 404 on all three; no listing found | — | Unlike Optro, Workiva, LogicGate and Onspring, all tracked by Vendr, Empowered may not be tracked at all |
| Public procurement records (27 Sep 2026) | None found for either product | — | No RFP, purchase order or contract of the kind found for Optro, TeamMate or Workiva turned up by any method attempted |
No vendor statement describes a licensing structure: not per user, not per module, not unlimited-seat. Put every cost driver in the RFP instead of assuming it from the module list: whether the other seven modules are priced as one contract or seven, what the AI features add to the bill, and what “hosted clients only” means for a bank that wants data kept on its own infrastructure. The site’s vendor-neutral RFP method has the pricing schedule to send, and the internal audit software pricing guide puts what public figures do exist next to every other vendor’s.
What users say
Empowered has four separate rating rows worth keeping apart rather than blended into one number: two products, two platforms, and in one case a displayed figure that does not match its own published breakdown.
On Gartner Peer Insights, AutoAudit sits in the Audit Management Solutions market at 4.4 from 12 ratings, with a displayed breakdown of 8 percent five-star, 50 percent four-star, 33 percent three-star and 8 percent two-star. Recomputed from that breakdown — roughly one, six, four and one review at five, four, three and two stars — the weighted average comes to about 3.6, not the displayed 4.4: a sizeable, unresolved gap. Connected Risk’s Gartner listing, spanning both the Audit Management Solutions and Integrated Risk Management Solutions markets, shows 4.0 from 28 ratings with 21, 43 and 36 percent at five, four and three stars and none lower; the same recomputation lands closer to 3.9, a minor gap by comparison.
Gartner’s vendor page also breaks the combined reviews into four sub-dimensions: Evaluation and Contracting 4.3, Service and Support 4.1, Integration and Deployment 3.7, Product Capabilities 3.7 — the sales cycle outscoring what happens after the contract is signed. G2 rates AutoAudit 2.8 from 3 reviews, segment math that checks out exactly: one Enterprise review at 5.0 and two Small-Business reviews at 1.0 and 2.5 average to 2.83. G2’s Connected Risk listing includes a reviewer identified as the vendor itself, whose self-description calls the product “a mature GRC solution” on a “zero-code platform” — rated 4.7 from 3 reviews, two Enterprise and one Small-Business. No Capterra or TrustRadius rating could be confirmed for either product.
| Theme | Praise or complaint | Where seen |
|---|---|---|
| Fast implementation and deployment | Praise | Gartner Peer Insights; G2 |
| Customization flexibility, including explicit “zero-code” framing | Praise | Gartner Peer Insights; G2 |
| Responsive, high-quality support | Praise | Gartner Peer Insights; G2 |
| Snap!Report and reliable file and version management (AutoAudit) | Praise | G2 |
| Dated technology; “outdated software architecture” cited directly | Complaint | G2 |
| Workflow quirks: inconsistent email-trigger setup, limited automated-email customization, read-only files after closure | Complaint | G2 |
| A Connected Risk interface that “seems old,” improvements said underway | Complaint | G2 |
| Dashboard, alert and initial-integration rough edges (Connected Risk) | Complaint | G2 |
The praise and the complaints line up with the sub-dimension scores above: support and configurability score, and get praised, highest; deployment and product capabilities score, and get complained about, lowest. One pair of reviews makes the point sharply. A Gartner reviewer credits AutoAudit with “keeps pace with technological advancement”; a G2 reviewer of the same desktop product cites “outdated software architecture.” Two people looking at the same code reaching opposite verdicts says as much about a 12-review and a 3-review sample as about the software.
Implementation and migration
No implementation-timeline figure, named methodology, admin-certification program or migration-tooling claim was found anywhere, including the demo page. The only implementation-adjacent signals come from reviewers, not the vendor: G2 describes “quick deployment and migration from older systems” for Connected Risk, and a Gartner reviewer credits AutoAudit with “fast implementation and deployment capabilities.” Neither names a customer, a team size or a system migrated from.
Empowered names five “Platform Partners”: Wolters Kluwer, Dun and Bradstreet, EY, RSM France and GRCS. GRCS is explicitly Empowered’s Japanese subsidiary and implementation partner; RSM France is named alongside a French-translated release note but its exact role is not detailed. Wolters Kluwer and Dun and Bradstreet read more like content or referral partners than implementation ones — worth a direct question, since Wolters Kluwer publishes TeamMate, a competing platform covered elsewhere in this guide. No training curriculum, admin-certification track or user community was found.
How it compares
Archer is the larger, better-documented version of the same bank-heavy pitch: Cinven-owned since 2023, 1,300-plus customers including 37 of the top 50 global banks by its own count, SOC 2 Type 2 and ISO 27001, 27017 and 27701 certifications published, and a Gartner audit-market rating of 4.3 from 36 reviews against AutoAudit’s 12. Neither publishes a price. The Archer review has the full comparison.
IBM OpenPages names Citi as a customer too, “2,500 auditors” by IBM’s own figure, which says less about either vendor than it might seem: a bank that size runs more than one audit or GRC platform. Where OpenPages pulls ahead is publication itself: named AWS and IBM Cloud starting prices, IBM Cloud’s general SOC and ISO certifications (not confirmed as OpenPages-specific, but published all the same), and a release naming eight AI model configurations, none of which Empowered comes close to matching. The IBM OpenPages review covers it in full.
Protecht ERM is the closer size match: a similarly bank, credit union and insurer-focused platform, similarly quiet on price, with a Gartner rating of 4.6 from 10 reviews and a G2 rating of 4.5 from 64, a far larger sample than either Empowered product. Protecht’s named customers lean Australian and New Zealand rather than global-bank, the reverse of Empowered’s logo wall, worth shortlisting together rather than against each other outside either home market. See the Protecht ERM review for the detail.
For a buyer who wants audit-first software with a public record to check, Optro (formerly AuditBoard) is the most-reviewed alternative here: a published Vendr median of $45,947 a year, a Gartner audit-market rating of 4.5 from 890 reviews, and named AI features with a stated provider, none of which Empowered discloses. The Optro review sets out that trade-off, and the best internal audit software roundup has the fuller shortlist against every product here.
Questions about Empowered Systems
What is the difference between AutoAudit and Connected Risk?
AutoAudit is Empowered’s original Windows desktop product, which the vendor’s own page says “remains available during limited sales periods” rather than as a standard catalog item. Connected Risk is the cloud platform Empowered now treats as its main offering, covering internal audit alongside seven other named modules. Assume Connected Risk is the product being sold, and confirm directly whether AutoAudit is even on offer.
Was Empowered Systems founded in 1995 or 2001?
Empowered’s own site says its story began in 1995 as “Paisely Consulting.” Gartner’s company-profile field instead says 2001, headquartered in Dover, United States, against the UK registered office Empowered’s own filings show. Neither source corrects the other, and this review could not resolve it; ask Empowered directly which date and headquarters it stands behind.
How much does Empowered Systems cost?
There is no public price for AutoAudit or Connected Risk. The demo page routes pricing interest to a contact form, and no listing could be found on Vendr, Capterra, TrustRadius or public procurement records. Expect a fully negotiated quote, and put the pricing schedule from the site’s vendor-neutral RFP method in front of Empowered rather than accept a verbal range in a demo.
Is Empowered Systems right for a small audit team?
Generally not as a first system. This review rates a team of one to five auditors a Poor fit: no published entry-level price, no self-service path, and eight modules a small team has little reason to buy alongside audit. The site’s audit software for small teams guide has better-suited, lower-cost options.
Does Empowered Systems’ AI train on our data?
Empowered has not published a data-use, training or retention statement for either named AI feature, Empowered AI or AI-Powered Search, and no model provider is named for either. Ask directly, in writing, before enabling either on real workpapers; the site’s guide to evaluating AI in audit software has the fuller list of questions.
Is Empowered Systems SOC 2 or ISO 27001 certified?
No security, trust-center or certification page could be found anywhere on the site, and its page sitemap lists only a privacy policy and terms of service under legal. That does not prove no certification exists — large banks typically run their own vendor assessment regardless — but a buyer can verify nothing from public sources here and must ask directly. The site’s audit software due diligence guide has the questions worth putting in writing.
internalauditguide.com has no commercial relationship with Empowered Systems or any other vendor named on this page. We take no vendor money, run no affiliate links and accept no sponsored placements, and no vendor saw this page before publication. Product and company names are the trademarks of their owners. Corrections: desk@internalauditguide.com.
Sources and verification
- Empowered Systems: About — the 1995 founding narrative, UK entity registration and address, and the “300,000+ users” claim (accessed 27 September 2026).
- Gartner Peer Insights: AutoAudit by Empowered Systems — the 4.4-from-12 rating, star distribution, and the company profile citing a 2001 founding, Dover headquarters and the Thomson Reuters/Refinitiv claim (accessed 27 September 2026).
- Gartner Peer Insights: Connected Risk by Empowered Systems — the 4.0-from-28 rating and star distribution (accessed 27 September 2026).
- Gartner Peer Insights: Empowered Systems vendor page — the four sub-dimension scores (accessed 27 September 2026).
- G2: AutoAudit reviews — the 2.8-from-3 rating, segment breakdown, Snap!Report and “outdated software architecture” themes (accessed 27 September 2026).
- G2: Connected Risk reviews — the 4.7-from-3 rating, the vendor’s own self-description, segment breakdown and themes (accessed 27 September 2026).
- Empowered Systems: Our Leadership — executive names and titles (accessed 27 September 2026).
- Empowered Systems blog: What’s New in Connected Risk v26.1 — the 5 May 2026 release date, AI-Powered Search, Teams integration and the Power BI bug fix (accessed 27 September 2026).
- Empowered Systems blog: Say Hello to Connected Risk 25.3.0 — the 29 October 2025 release date, My Workspace and Empowered AI (accessed 27 September 2026).
- Empowered Systems: Connected Risk — the six core modules, the twelve-logo customer set and the Platform Partners list (accessed 27 September 2026).
- Empowered Systems: Internal Audit Management — the planning, fieldwork, Oracle/SAP, review, issues and reporting language (accessed 27 September 2026).
- Empowered Systems: AutoAudit — the “limited sales periods” quote, the 30-plus-years and 300-plus-organizations claims, features and role model (accessed 27 September 2026).
- Empowered Systems: Internal Controls Management — the control library, testing, evidence and deficiency-tracking claims (accessed 27 September 2026).
- Empowered Systems: SOX/ICFR page — the SOX feature framing, customer logos and the “SOX 404” language (accessed 27 September 2026).
- Empowered Systems: Model Risk Management — the model registry, validation workflow, and the SR 11-7, SS1/23 and OSFI E-23 references (accessed 27 September 2026).
- Empowered Systems: Integrations — the “100+ apps” claim and the generic named-app list (accessed 27 September 2026).
- Empowered Systems: Privacy Policy — the absence of hosting or certification disclosure and the generic security language (accessed 27 September 2026).
Related guides
- Internal audit software: the independent buyer’s guide — every review, comparison and buying guide in one place.
- How we review audit software — the evidence levels, the scorecard and the fit-by-situation method.
- The audit software shortlist finder — eight questions, a shortlist with the reasons from each review.
- The requirements matrix — 156 weighted requirements and vendor scoring in a free Excel workbook.
- Gartner, Forrester, G2 and the rest — how to read audit software analyst reports in 2026, and why most of them say nothing about Empowered.
- Types of internal audit software — audit management, GRC, SOX, compliance and analytics, and where Connected Risk’s eight modules sit.
- Internal audit software pricing — real numbers, pricing models and how to negotiate, for the products that publish them.
- Best internal audit software — 25 platforms and tools compared by use case.
- Audit software for banks and credit unions — regulatory issues, exam support and fit, for the sector Empowered’s customer list is built around.
- Audit software due diligence — security, data residency, AI data use and vendor stability, the questions Empowered’s own pages leave open.
- The audit software demo script — 25 scenarios worth running against Empowered’s marketing claims specifically.
- Selecting an audit management system — the vendor-neutral RFP method, and the pricing schedule to send when a vendor publishes no price.
- Archer review — the larger, better-documented version of the same bank-heavy pitch.
- IBM OpenPages review — the other platform naming Citi as a customer, with a far longer public record.
- Protecht ERM review — a similarly bank and credit union-focused platform, similarly quiet on price.
- Optro (formerly AuditBoard) review — the audit-first alternative with the public record Empowered lacks.
Leave a Reply