IBM OpenPages and Archer turn up on the same shortlist for a narrower reason than most vendor pairings in this guide: both are audit modules riding inside a much larger enterprise GRC suite built for banks, insurers and other regulated enterprises, and both vendors spent 2024 through 2026 racing to ship AI features onto that same base. Archer built its business on being the independent enterprise GRC specialist that risk, compliance and audit converge onto around one shared data model, and changed ownership three times since 2020 doing it. IBM has never had that kind of drama: it bought a small Massachusetts GRC company in 2010 and has run Internal Audit Management as one of nine modules inside its own product line ever since. Both companies claim a Leader placement in the same Gartner Magic Quadrant, and neither treats internal audit as a product with its own price list, or, in IBM’s case, even a name separate from the module it sits inside.
This comparison covers what each vendor’s own documentation says about ownership, audit workflow depth, SOX and controls, the AI features each shipped from 2024 through 2026 and what they do or do not say about data handling, the pricing evidence standing in place of an actual list price on Archer’s side, and the scorecard and fit-by-situation ratings from the site’s independent buyer’s guide to internal audit software, using the method in how we review audit software. If neither platform already runs elsewhere in your organization, the shorter path for most audit functions is audit-native software; Optro vs Archer and the Archer alternatives page make that case before you read on.
Verdict. Neither product belongs on a shortlist for a team building its first system, and neither wins this comparison outright on audit capability alone. Archer is the stronger audit-management product on paper, with the deeper bank customer base and a Gartner Peer Insights audit rating a full notch above either of IBM’s own listings. IBM counters with the one thing Archer will not publish anywhere: a real starting price, plus a corporate history with no private-equity ownership at all.
Choose IBM OpenPages if. Your organization already runs, or is evaluating, other OpenPages modules for operational, model or third-party risk, you want a published starting price to anchor negotiation, and you would rather avoid a platform with a private-equity ownership clock running.
Choose Archer if. Audit sits inside a broader GRC program already running, or planning to run, Archer for enterprise or operational risk, especially at a bank or credit union, and the deeper regulated-industry customer base and the more explicitly named SOX use case matter more than IBM’s price transparency.
Evidence. Research-based: vendor documentation and release notes, public procurement records, third-party pricing data, verified user reviews on Gartner Peer Insights and G2, and analyst coverage. We have not used either product hands-on for this comparison.
Price evidence. IBM’s own pricing page states ‘starting at’ figures with no billing period given: $3,300 and $6,050 on AWS, $6,250 and $9,000 on IBM Cloud; its AWS Marketplace listing shows real 12-month SaaS contracts running about $7,740 to $8,400 a year before add-ons. Archer publishes no price list at all; its AWS Marketplace listing shows an evident $9,999,999.00 placeholder, and Vendr’s buyer data shows no median, only a $100,000 threshold that triggers its legal review.
Last verified. 27 September 2026.
In this guide
- IBM OpenPages and Archer in one table
- Where they are different
- Head to head: the scorecard
- Fit by situation, side by side
- Total cost of ownership over five years
- Migration between them
- Our recommendation
- Questions about IBM OpenPages and Archer
- Sources and verification
- Related guides
IBM OpenPages and Archer in one table
Put side by side once, in full, the two platforms look more alike than either vendor’s marketing suggests, and the rows where they genuinely diverge are easy to miss in the noise.
| Attribute | IBM OpenPages (Internal Audit Management) | Archer (Audit Management) |
|---|---|---|
| Owner | IBM Corporation, wholly owned since 21 October 2010; no separate OpenPages entity, headquarters or chief executive | Cinven, a private-equity firm, since 10 July 2023; before that, Clearlake Capital and Symphony Technology Group (2021), and STG’s 2020 purchase from Dell’s RSA Security |
| Founded | May 1990, Amherst, Massachusetts, as American Computer Innovators; renamed OpenPages in August 2000 | 2000; headquarters Overland Park, Kansas |
| Category | One of nine modules on the OpenPages GRC platform | One of eight modules on Archer’s platform, spanning classic Archer and the newer Archer Evolv |
| Deployment | SaaS on AWS Marketplace or IBM Cloud, on-premises, or Cloud Pak for Data and Software Hub | On-premises or SaaS; classic Archer and Archer Evolv coexist on the same data |
| Audit module(s) | Internal Audit Management: Annual Planning, Engagement Planning, Workpaper Management, Time and Expense, Audit Reporting and Wrap-Up | Audit Management: Audit Planning and Quality, Audit Engagements and Workpapers, Issues Management |
| SOX and controls | Financial Controls Management, a separate module; 302/404 sign-off depth inside Internal Audit Management itself unverified | Financial Controls Monitoring, inside the separate Regulatory and Corporate Compliance Management module; explicitly names SOX narratives, 302 certifications and PBC lists |
| Named 2024-2026 AI features | watsonx.ai and Bring-Your-Own-Model, an OpenPages MCP Server (experimental Dec 2025, managed cloud-native Mar 2026), eight named AI model configurations by Jul 2026 | Assurance AI and AI Governance, Evolv for Compliance, Evolv Foundation and Workplace, Evolv AI Compliance (Bedrock Guardrails) |
| Pricing model | Tiered by edition and solution, with storage and concurrent-user overage charges on the SaaS listing | Not stated by the vendor; an AWS listing implies a negotiated, solution-plus-user-count structure |
| Price evidence | AWS ‘starting at’ $3,300 and $6,050; IBM Cloud $6,250 and $9,000, no billing period stated; real AWS 12-month contracts around $7,740 to $8,400 a year | None public beyond a $100,000 Vendr legal-review threshold; the AWS listing shows an evident $9,999,999.00 placeholder |
| Gartner Peer Insights, Audit Management Solutions | 4.1 (36 reviews) on the broad ‘IBM OpenPages’ listing; 4.1 (9) on the product-specific ‘OpenPages Internal Audit Management’ listing | 4.3 (36 reviews) |
| G2 | 4.2 (76 reviews) | 3.6 (20 reviews) |
| FedRAMP / GovRAMP | None found specific to OpenPages; IBM Cloud carries FedRAMP at the platform level | None found despite a dedicated Public Sector module; real GSA, NASA SEWP V and ITES-SW2 contract vehicles exist through Carahsoft |
Three rows are worth reading twice. Ownership sits at opposite ends: Archer has changed hands three times since 2020 under Cinven, a private-equity firm, while OpenPages has had exactly one owner, IBM, since 2010. Pricing transparency runs the other way; the vendor with no buyout risk publishes nothing, and the one with a rotating cast of owners states real starting figures. And the two Gartner Peer Insights rows are not measuring quite the same thing the table implies; the reputation subsection below unpacks what that hides.
Where they are different
Everything below comes from each vendor’s own documentation, public procurement and pricing data, and verified user reviews, not from using either product hands-on. The full detail for each product lives in the IBM OpenPages review and the Archer review; what follows is where the two actually pull apart.
Ownership and vendor stability
IBM bought OpenPages, then a small Amherst, Massachusetts company with more than 200 enterprise customers, on 21 October 2010, on undisclosed terms, and has not sold, spun off or renamed the product since. There is no OpenPages-specific chief executive or press office to hold accountable at renewal time, but there is also no private-equity holding period to watch. The trade-off is internal rather than external: Internal Audit Management is one of nine modules competing for IBM’s investment, so a slower audit-specific roadmap is the more realistic risk here than a change of owner.
Archer’s ownership has moved three times in the same period. RSA Security, which Dell sold to Symphony Technology Group in 2020, was spun out as an independent Archer by Clearlake Capital and STG in 2021, roughly doubling its SaaS revenue under that ownership before Cinven agreed to buy it on 13 April 2023 and closed the deal on 10 July 2023. Chief executive Bill Diaz has stayed in place throughout, for management continuity despite the capital changes. A buyer evaluating either platform on a five-year horizon is really choosing between two kinds of roadmap risk: a big-company investment competition at IBM, or a private-equity ownership clock that has already run three times at Archer.
Audit workflow depth
Both platforms scope and risk-assess against a data model shared with other risk disciplines rather than a standalone audit-only engine. IBM’s Annual Planning function supports audit-universe risk assessment and multi-year plan creation through top-down and bottom-up methods with configurable calculations; Engagement Planning covers scope, objectives, resource allocation and work-program creation per audit, backed by a Time and Expense function that tracks auditor hours and cost against the plan, named more explicitly here than in Archer’s documentation. Workpaper Management keeps a centralized electronic library with collaborative authoring and automated review and approval routing, and Audit Reporting and Wrap-Up automates issue closure with at-a-glance reporting on findings.
Archer’s Audit Entity and Audit Plan apps do the equivalent scoping and planning, pitched as risk-based scoping on aggregated data rather than routine procedures, with resource-management apps covering availability, timesheets, certifications and expenses, and seven automated data feeds bundled into Audit Planning and Quality, among them auto-scoping by risk and workpaper generation by program. Workpapers are not a separate product; they live inside the Audit Engagement app alongside testing and reporting. The clearest structural difference is issues management: Archer runs one dedicated app that consolidates findings from audit, risk and compliance into a single register with remediation tracking, while IBM’s issue closure sits inside Audit Reporting and Wrap-Up as an audit-specific feature rather than a cross-functional register. A buyer who wants one issue log spanning all three lines should weight that difference heavily; the site’s finding and issue log template sets out the fields either register needs.
SOX and controls
Neither vendor bundles a standalone SOX product with its audit module, but the two name the gap differently. Archer’s financial-controls work sits in Regulatory and Corporate Compliance Management under a use case Archer itself calls Financial Controls Monitoring, which explicitly names “SOX narratives, 302 certifications, and PBC lists”; controls are authored once against every framework they satisfy, tie to general-ledger accounts and risks, and sit in a versioned repository that scoped external-auditor roles can see without full system access. IBM names a parallel integration point, Financial Controls Management, as a separate module Internal Audit Management shares data with, but IBM’s own module overview does not detail certification workflow, key-control testing or 302/404 sign-off inside the module itself, and that depth could not be verified beyond confirming the integration point exists.
The practical consequence is the same for both: a SOX-driven buyer needs a second module, priced and licensed separately, and should get that scope and price in writing before assuming it is bundled. Archer at least gives that second module concrete, named language to hold the vendor to; IBM’s equivalent is confirmed to exist and nothing more. The site’s SOX 404 guide and control deficiency evaluation method are the reference points for what either module needs to support once licensed.
AI features and data handling
IBM’s AI roadmap is the more densely dated of the two. OpenPages 9.1.3 (26 December 2025) added an experimental, local Model Context Protocol (MCP) Server and Bring-Your-Own-Model connections to watsonx.ai; 9.2 (23 March 2026 on SaaS) productized the MCP Server as a fully managed, open-source-available service, added native watsonx Orchestrate chat, and expanded AI-assisted evidence analysis; 9.2.1 (23 July 2026) shipped eight named AI model configurations, including audit-plan creation and questionnaire-response generation, multi-file analysis compatible with Gemini and OpenAI models, and AI-drafted preliminary questionnaire responses with mandatory human review. No statement was found anywhere in IBM’s published materials on whether OpenPages or watsonx train on, retain, or allow opt-out from, customer data.
Archer’s lineup is denser still and harder to pin down. Assurance AI and AI Governance shipped 18 September 2024; Evolv for Compliance followed 4 February 2025; Evolv Foundation and Evolv Workplace, a marketplace of scoped AI “Operators,” launched 14 September 2026 with two unreconciled training-data claims on two different Archer pages, one citing 492 purpose-built models trained on 22 million documents and 250 million records, the other citing 526 models, 7,000-plus sources and 18 patents. The one Archer AI feature with a genuinely concrete data-handling statement is also its newest: Evolv AI Compliance, launched 15 September 2026, runs native Amazon Bedrock Guardrails inside the customer’s own AWS account and IAM role, keeping prompts and model weights isolated from Archer and covering regulated data classes including HIPAA, PCI DSS and export controls, with human approval gates before enforcement. That is a more concrete AI data-isolation architecture than anything IBM has published. Gartner’s 13 April 2026 caution to be “particularly wary of agent-washing” applies to both equally; the site’s guide to evaluating AI in audit software has the test protocol for either vendor’s claims.
Analytics, integrations and automation
IBM documents a REST API, the GRC REST API in V1 and V2, plus an OpenPages-as-a-Service V2 entry in IBM Cloud’s catalog, though endpoint-level coverage is not independently confirmed behind its JavaScript-gated docs. OpenPages 9.1 added data export to SFTP, IBM Cloud Object Storage and AWS S3, and the MCP Server, managed and cloud-native from 9.2 onward, is built to expose OpenPages objects and actions to external AI agents. Archer’s integration story is a direct data connection instead: Audit Management “pulls pre-existing risk and control data” from the shared model rather than duplicating entry, Audit Planning and Quality ships seven automated data feeds of its own, and a documented web-services API exists, though its authentication and rate-limit detail is unconfirmed.
Neither is a scripting or full-population analytics layer in the sense a dedicated audit-analytics tool is, so a team choosing either for the shared-data advantage should still plan for a second tool for real data analytics from day one; the site’s audit analytics software comparison covers the dedicated options.
Security, hosting and public-sector reach
Neither vendor publishes an OpenPages- or Archer-specific FedRAMP or GovRAMP authorization, and that gap matters more for one of them than the other. IBM’s OAuth 2.0 support and IBM Cloud’s general compliance programs, SOC 1, 2 and 3, the ISO 27001 family, FedRAMP, HIPAA, PCI DSS and HITRUST, all apply at the platform level; none is confirmed as an attestation specific to OpenPages, and no named public-sector customer or US procurement record turned up in the sources checked. Archer’s SaaS Security and Trust page names SOC 2 Type 2, ISO 27001, 27017 and 27701, AES-256 and TLS 1.3 encryption with optional field-level encryption and BYOK, AWS hosting across seven regions, and a 99.5% composite SLA. Archer also has a dedicated Public Sector module, covering POA&M, Assessment and Authorization and Continuous Monitoring, and real contract vehicles through reseller Carahsoft: GSA MAS through 21 August 2028, NASA SEWP V through 31 January 2027, and ITES-SW2 through 30 August 2030.
Neither product is authorized the way a government buyer usually needs, but Archer has a module and a procurement path built for that buyer, and IBM has neither. That asymmetry is why the fit-by-situation table below splits on public sector while agreeing on almost everything else. The site’s audit software due diligence guide has the fuller checklist for data residency and AI data use to run against either vendor before signing.
Pricing transparency and reputation
IBM is one of only a few vendors in this entire program that publishes real starting prices anywhere on its own site, even without stating whether they bill monthly or annually. Archer publishes nothing at all: its AWS Marketplace listing shows a 12-month contract line item priced at an evident $9,999,999.00 placeholder and states outright that pricing is not published on the marketplace, and Vendr’s buyer data shows no median or range for Archer, only a $100,000 threshold that triggers its own legal review.
| Rating source | IBM OpenPages | Archer |
|---|---|---|
| Gartner Peer Insights, Audit Management Solutions | 4.1 (36), broad listing; 4.1 (9), Internal Audit Management-specific listing | 4.3 (36) |
| Gartner Peer Insights, Integrated Risk Management Solutions | Not independently confirmed in the sources checked for this comparison | 4.0 (69) |
| G2 | 4.2 (76) | 3.6 (20) |
| TrustRadius | Not located | 8.4 out of 10 (49) |
The two audit-market ratings run one way and the two G2 ratings run the other: Archer’s audit-specific Gartner Peer Insights rating beats both of IBM’s listings, while IBM’s G2 rating beats Archer’s by a wider margin. Archer also carries a listing in Gartner’s Integrated Risk Management Solutions market, 4.0 from 69 reviews; we could not independently confirm a comparable IBM-specific figure in that market, so none is stated above rather than guessed. Complaint themes overlap heavily on both: cost, a steep learning curve, and customization needing administrator or paid-consultant support; where they diverge, IBM’s reviewers flag Cognos-based reporting needing technical skill, and Archer’s flag a dated interface and, on TrustRadius, an approve-or-reject-only workflow that forces resubmissions.
Head to head: the scorecard
The scorecard uses the same 12 areas as every review in this guide, so the levels below can be read straight off each product’s own review; nothing here has been changed to make the comparison tidier.
| Area | IBM OpenPages | Archer |
|---|---|---|
| Risk assessment and planning | Strong | Strong |
| Engagement workflow | Strong | Strong |
| Workpapers and evidence | Adequate | Adequate |
| Issues and follow-up | Adequate — issue closure sits inside Audit Reporting and Wrap-Up, audit-specific | Strong — a dedicated Issues Management app spans audit, risk and compliance in one register |
| Reporting | Adequate | Adequate |
| SOX and controls testing | Limited — Financial Controls Management exists as an integration point; 302/404 depth unverified | Adequate — Financial Controls Monitoring explicitly names SOX narratives and 302 certifications, still in a second module |
| Analytics and automation | Adequate | Adequate |
| AI features | Strong — eight named model configurations and a managed MCP Server shipped on stated dates | Adequate — a dense lineup including the guide’s most concrete AI data-isolation statement, alongside conflicting model-count claims |
| Quality program support | Limited | Limited |
| Auditee experience | Limited | Limited |
| Administration, integrations and security | Adequate — certifications apply at the general IBM Cloud level, not confirmed OpenPages-specific | Strong — SOC 2 Type 2 and the ISO 27001 family held directly, seven AWS hosting regions, a 99.5% SLA |
| Cost and contract | Adequate — real starting prices published, though with no billing period stated | Limited — no public price list of any kind |
| Vendor viability | Strong — one owner since 2010, though competing internally against eight other modules | Adequate — a steady release cadence under Cinven, but three ownership changes since 2020 |
Six of the 13 rows differ, and they cluster in a pattern: IBM leads on AI breadth, cost transparency and vendor stability; Archer leads on issues management, SOX naming and security certifications held directly rather than inherited from a cloud platform. Nothing here is a tie-break in either direction on its own; the fit-by-situation table below is where that pattern turns into an actual recommendation.
Fit by situation, side by side
The eight situations are the same across every review and comparison in this guide, set centrally so ratings can be compared product to product. The two platforms agree on seven of the eight; the row where they split is the one worth reading twice.
| Situation | IBM OpenPages | Archer | Note |
|---|---|---|---|
| First system for a small team (1 to 5 auditors) | Poor fit | Poor fit | Neither has a self-service, per-seat entry price; both depend on shared enterprise data a team this size has no reason to build first |
| Mid-size function (6 to 25 auditors) | Poor fit | Poor fit | The same dependency at a slightly larger scale |
| Large or global function (25+ auditors) | Strong fit | Strong fit | Both are built for this scale, on a nine-module and an eight-module platform respectively |
| SOX-heavy public company | Workable | Workable | Neither bundles SOX for free; Archer at least names the work explicitly in its second module |
| Bank or credit union | Strong fit | Strong fit | IBM’s Citi and Zurich Insurance Group accounts and a Model Risk Governance module against Archer’s deeper claimed customer base across the sector |
| Public sector, higher education or nonprofit | Poor fit | Workable | The one row that splits: Archer’s Public Sector module and Carahsoft contract vehicles against no public-sector foothold found for IBM at all |
| Analytics-heavy team | Workable | Workable | Both add real automation on top of shared data; neither replaces a dedicated analytics tool |
| Consolidating GRC across the three lines | Strong fit | Strong fit | This is the buyer both platforms are built for |
Only the public-sector row splits, and a buyer in that segment should weight it heavily: Archer rates Workable on the strength of a dedicated module and real federal contract vehicles, where IBM rates Poor fit with no public-sector foothold found anywhere in the sources checked. A bank or a large global function should not read that split as decisive, since both rate the same, Strong fit, on the situations that actually describe those buyers. The site’s audit software for banks and credit unions guide has the regulatory detail behind the bank-and-credit-union row for both platforms and their peers.
Total cost of ownership over five years
Archer publishes no price at all, so a true five-year total cost of ownership cannot be built for this comparison the way it can for a product with an actual list price. What follows uses only the public figures that exist, with every assumption labeled, for a hypothetical: Lakeshore Bancorp, the fictional $9 billion regional bank used across this site for worked examples, with 60 branches and 212 key controls, evaluating either platform for an eight-person audit function that also needs Financial Controls Management or Regulatory and Corporate Compliance Management licensed alongside it for SOX. Treat every figure below as illustrative, not a quote; actual contracts vary by user count, modules and negotiation leverage far more than either vendor’s public data can show.
| Cost driver | IBM OpenPages (illustrative) | Archer (illustrative) |
|---|---|---|
| Base-year SaaS subscription | About $7,740 to $8,400 — IBM’s own AWS Marketplace real 12-month Essentials contract, with a high-availability option, before add-ons | No usable public figure; only a $100,000 Vendr legal-review threshold and an evident $9,999,999.00 AWS placeholder |
| Alternative fixed-unit deployment | $239,280 a year for Cloud Pak for Data, one unit covering deployment across two AWS VPCs — a different deployment model, not comparable to the SaaS figure above | Cannot be modeled |
| 5-year total, SaaS base held flat | About $38,700 to $42,000 — IBM discloses no escalation rate, so this holds the base plan flat for five years, understating any real multi-year contract | Cannot be modeled |
| Add-ons and overages outside the base | AWS add-ons $21,480 to $51,840 a year; per-solution applications $26,520 to $37,080 a year; storage $588 per 200GB, overage $49 per GB; user overage $53 per concurrent user | Not stated; the AWS listing implies a negotiated, solution-plus-user-count structure with no published rate card |
| Still to price via RFP | Whether Financial Controls Management is licensed and priced separately; watsonx.ai, Assistant and Discovery AI usage, stated to cost extra; implementation and training | Regulatory and Corporate Compliance Management if SOX is in scope; Evolv AI features; implementation through the Deloitte or KPMG alliances |
The gap in this table is itself the finding. IBM’s row can be built, even if only as a floor once add-ons and overages are added back in; Archer’s cannot be built at all without a quote in hand, which is a data point about how the two vendors treat pricing transparency, not just a gap in this guide’s research. The internal audit software pricing guide runs the same exercise against every other vendor in this program, several of which do publish a usable base figure the way IBM does.
Migration between them
Neither vendor documents a tooled migration path directly between IBM OpenPages and Archer. IBM’s Zurich Insurance Group story describes a “configuration-first” implementation, UI configuration rather than custom code, but that is IBM’s stated philosophy for a new deployment, not a path off a competitor’s platform. Archer’s Deloitte and KPMG alliances cover strategy, implementation and modernization onto Archer Evolv, which is a migration within Archer’s own product line, not from OpenPages or any other rival.
Treat a real move between the two as a full RFP-scale project, not a lift-and-shift. Both audit modules depend on the same shared risk and control data the losing platform holds, so inventory that data before writing requirements, and budget partner-led implementation on the receiving side either way, since neither vendor names a self-service path. The vendor-neutral RFP method has the requirements structure to run either direction, and the buying mistakes guide covers the migration-specific errors worth avoiding before a contract is signed.
Our recommendation
Strip away the shared-platform argument both vendors lead with, and the honest comparison is narrower than either sales team will admit. If your organization is not already running one of these two platforms, or a close peer, for another risk discipline, this is likely the wrong comparison to be having at all: a team of 1 to 25 auditors rates Poor fit on both, with no usable entry-level price on either side, and an audit-native product will almost always serve that team faster and at a price it can actually see in advance. The Archer alternatives page and the best internal audit software roundup have the better-suited shortlist, and Optro vs Archer makes the audit-native case directly against the enterprise-GRC one.
For the large or global function that does belong here, the decision usually resolves before the RFP does. If risk, compliance or model governance already runs OpenPages, or plans to, keep audit on that same nine-module data model and use the published starting prices to anchor the negotiation Archer will not give you in writing. If those functions already run Archer, or the organization is a bank or credit union with a genuine choice between the two, lean Archer: the deeper named bank base, the audit-specific Gartner rating a full notch higher, and the more explicit SOX language. A public-sector, higher-education or nonprofit buyer should treat the fit table’s one split seriously and start with Archer, whose dedicated module and federal contract vehicles have no OpenPages equivalent we could find. An analytics-heavy team should decide on the other seven situations instead, since neither platform replaces a dedicated analytics tool; the site’s guide to types of internal audit software explains why that separation holds regardless of which suite ends up running audit.
Questions about IBM OpenPages and Archer
Is IBM OpenPages or Archer the stronger audit-management product?
On audit-specific capability alone the two are close, and each leads in a different place. Archer’s dedicated Issues Management app and its more explicitly named SOX use case argue for Archer; IBM’s denser, more precisely dated AI roadmap and its named Time and Expense tracking argue for OpenPages. Archer’s audit-specific Gartner Peer Insights rating, 4.3 from 36 reviews, is a full notch above either of IBM’s two listings, both 4.1; IBM’s G2 rating, 4.2 from 76 reviews, runs the other way against Archer’s 3.6 from 20. The scorecard above has the row-by-row detail behind both ratings.
How much do IBM OpenPages and Archer cost for an audit team?
IBM is one of the few vendors in this program that states an actual number: AWS ‘starting at’ prices of $3,300 and $6,050, IBM Cloud prices of $6,250 and $9,000, with no billing period given, and real AWS Marketplace contracts running $7,740 to $8,400 a year before add-ons. Archer states nothing: no price list, an evident placeholder on its own AWS listing, and no median in Vendr’s buyer data. See the internal audit software pricing guide for how both figures compare with the rest of the market.
Which is the better fit for a bank or credit union?
Both rate Strong fit in this guide’s bank-and-credit-union situation, on real evidence for each: IBM’s Citi (about 2,500 auditors) and Zurich Insurance Group accounts, plus a Model Risk Governance module built for this sector, against Archer’s claimed 37 of the top 50 global banks and a deeper named customer list overall. Archer’s audit-specific Gartner rating and more explicit SOX language give it a slight edge for a bank with no existing platform relationship; one already running OpenPages has little reason to switch on this evidence alone.
Does Archer’s private-equity ownership put the product at risk, or is IBM’s ownership safer?
Archer has changed owners three times since 2020, most recently to Cinven in 2023, though CEO Bill Diaz has stayed in place and the release cadence has stayed steady. IBM has had one owner, itself, since 2010, but Internal Audit Management is one of nine OpenPages modules competing for IBM’s own investment, a different kind of roadmap risk. Neither structure is risk-free; they are just different risks.
Do IBM’s or Archer’s AI features train on our data?
IBM has published no data-use, retention or opt-out statement for any AI feature across OpenPages 9.1 through 9.2.1, including Bring-Your-Own-Model and the eight named model configurations. Archer has one concrete answer, for one feature only: Evolv AI Compliance runs guardrails inside the customer’s own AWS account, keeping prompts and model weights isolated from Archer; every other Archer AI feature has no published data-use statement either. Ask both vendors directly, in writing, before enabling any AI feature on live audit content; the guide to evaluating AI in audit software has the questions to put in that email.
Is there a Gartner Magic Quadrant that ranks IBM OpenPages against Archer for audit management?
No. Gartner does not publish a Magic Quadrant for this narrower audit-management category at all; the document that covers it, the Market Guide for Audit Management Software (13 April 2026), does not rank vendors. Gartner’s Magic Quadrant for GRC Tools, Assurance Leaders, published 27 October 2025, named both IBM and Archer as Leaders among 16 vendors assessed, alongside Optro (formerly AuditBoard) and LogicGate, but that report covers the much broader GRC category, not audit management on its own.
internalauditguide.com has no commercial relationship with IBM, Archer, or any other vendor named on this page. We take no vendor money, run no affiliate links and accept no sponsored placements, and no vendor saw this page before publication. Product and company names are the trademarks of their owners. Corrections: desk@internalauditguide.com.
Sources and verification
- IBM: OpenPages pricing page — the starting prices and the missing billing period (accessed 27 September 2026).
- Wikipedia: OpenPages — the 1990 founding, the 2000 rename and the 2010 IBM acquisition (accessed 27 September 2026).
- IBM: OpenPages product overview — the nine-module list and deployment options (accessed 27 September 2026).
- IBM: Internal Audit Management module overview — the Annual Planning, Engagement Planning, Time and Expense and Workpaper Management detail (accessed 27 September 2026).
- IBM: OpenPages 9.1.3 announcement — the 26 December 2025 release and the first, experimental MCP Server (accessed 27 September 2026).
- IBM: OpenPages 9.2 announcement — the March 2026 release, the managed MCP Server and watsonx Orchestrate chat (accessed 27 September 2026).
- IBM: OpenPages 9.2.1 announcement — the 23 July 2026 release and the eight AI model configurations (accessed 27 September 2026).
- IBM: Citi case study — the approximately 2,500-auditor figure, 30 October 2025 (accessed 27 September 2026).
- IBM: Zurich Insurance Group customer story — the 27 August 2026 account and its configuration-first approach (accessed 27 September 2026).
- IBM: Gartner Magic Quadrant Leader announcement — the 4 November 2025 claim (accessed 27 September 2026).
- IBM: Cloud compliance page — the general SOC, ISO, FedRAMP, HIPAA, PCI DSS and HITRUST programs (accessed 27 September 2026).
- AWS Marketplace: IBM OpenPages (SaaS) listing — the 12-month contract pricing detail (accessed 27 September 2026).
- AWS Marketplace: IBM OpenPages for Cloud Pak for Data listing — the $239,280 figure (accessed 27 September 2026).
- G2: IBM OpenPages reviews — the 4.2-from-76 rating (accessed 27 September 2026).
- Gartner Peer Insights: OpenPages Internal Audit Management — the 4.1-from-9 rating for the audit product specifically (accessed 27 September 2026).
- Gartner Peer Insights: IBM OpenPages — the 4.1-from-36 rating for the broader listing (accessed 27 September 2026).
- Archer: Audit Management product page — modules, workflow claims and customer counts (accessed 27 September 2026).
- PR Newswire: Cinven to acquire Archer — the 13 April 2023 deal, founding and headquarters state (accessed 27 September 2026).
- Archer: Regulatory and Corporate Compliance Management product page — the Financial Controls Monitoring and SOX detail (accessed 27 September 2026).
- BusinessWire: Archer introduces Archer Evolv — the 4 February 2025 launch (accessed 27 September 2026).
- Archer: Evolv AI Compliance press release — the 15 September 2026 Bedrock Guardrails architecture (accessed 27 September 2026).
- Archer: Explore Archer — the two unreconciled AI model-count claims (accessed 27 September 2026).
- Archer: SaaS Security and Trust — certifications, hosting and the absence of a FedRAMP claim (accessed 27 September 2026).
- AWS Marketplace: Archer SaaS listing — the placeholder contract price (accessed 27 September 2026).
- Vendr: Archer marketplace listing — the $100,000 legal-review threshold and the absence of a median (accessed 27 September 2026).
- Gartner Peer Insights: Archer Audit Management — the 4.3-from-36 rating (accessed 27 September 2026).
- Gartner Peer Insights: Archer vendor overview — the per-market rating breakdown, including Integrated Risk Management Solutions (accessed 27 September 2026).
- G2: Archer reviews — the 3.6-from-20 rating (accessed 27 September 2026).
- TrustRadius: Archer Integrated Risk Management Platform reviews — the 8.4-from-49 rating (accessed 27 September 2026).
- Carahsoft: Archer contract vehicles — the GSA MAS, NASA SEWP V and ITES-SW2 vehicles (accessed 27 September 2026).
Related guides
- Internal audit software: the independent buyer’s guide — every review, comparison and buying guide in one place.
- How we review audit software — the evidence levels, the scorecard and the fit-by-situation method.
- The audit software shortlist finder — eight questions, a shortlist with the reasons from each review.
- The requirements matrix — 156 weighted requirements and vendor scoring in a free Excel workbook.
- IBM OpenPages internal audit review — published prices, AI agents and the fit.
- Archer review — audit management on the enterprise GRC platform banks run.
- MetricStream vs Archer — two enterprise GRC suites for audit, risk and compliance.
- Archer vs ServiceNow IRM — the GRC decision most large enterprises face.
- Optro vs Archer — audit-first SaaS against the enterprise GRC platform.
- GRC suite vs standalone audit management software — how to make the call in 2026.
- Archer alternatives — enterprise GRC platforms and lighter options for audit teams.
- Best internal audit software — 25 platforms and tools compared by use case.
- Internal audit software pricing — real numbers, pricing models and how to negotiate.
- Types of internal audit software — audit management, GRC, SOX, compliance and analytics.
- Selecting an audit management system — a vendor-neutral RFP method.
- The audit software demo script — 25 scenarios that make vendors show, not tell.
- 15 mistakes internal audit teams make when buying software — and how to avoid each.
Leave a Reply