Cary, N.C. – October 12, 2026 -- Chartis Research has named SAS a Category Leader for Operational Risk Analytics, rating the vendor best-in-class or leading in seven capability areas of its integrated governance, resilience and compliance (iGRC) assessment for financial services.
The ranking credits the combination of SAS Governance and Compliance Manager (GCM) and the SAS Viya platform. Chartis cited SAS' analytically consistent, governed coverage across multiple risk domains. The assessment and the update to the RiskTech Quadrant for Operational Risk Analytics appear in the report Integrated Governance, Resilience and Compliance Solutions – Financial Services, 2026: Quadrant Update, published in June 2026.
Chartis rates SAS best-in-class or leading across seven capability areas
Chartis rated the SAS platform on the following criteria:
- Risk coverage: GCM spans operational, credit, market, liquidity, fraud, financial crime and model risk, connecting risk signals that are often managed in silos.
- Mapping and transformation: Risk data is mapped into a common taxonomy, supporting faster reporting and stronger audit and regulatory defensibility.
- Data management: GCM draws on Viya's data management capabilities so that risk, compliance and audit decisions rest on reliable data.
- Analytics tools: Fragmented risk, control, incident and audit data feeds continuous operational risk monitoring and earlier intervention.
- Workflows: Risk indicators, alerting and decision logic are built into business workflows to help teams prioritize cases, incidents and remediation.
- Architecture: The cloud-native, service-oriented design can process high-volume event data and run interactive analysis.
- Visualization: A common repository gives risk, compliance and audit staff an enterprise-wide view of internal control performance.
Chartis frames operational risk as an analytics problem, not a reporting exercise
Michael Versace, Research Director at Chartis, said GCM treats operational risk as a data and analytics challenge rather than a workflow, documentation or reporting task. He said this gives risk leaders the context to identify emerging exposure, assess control effectiveness and direct action to areas of greatest potential loss. Chartis also described SAS' ability to link operational and technical risk intelligence to executive decision-making as a distinct competitive advantage.
The recognition comes as iGRC moves beyond traditional compliance and reporting into strategic decision-making. Operational, regulatory, cybersecurity and technology risks are increasingly interconnected, so financial institutions need integrated risk intelligence that lets them act quickly while keeping oversight and control.
SAS ties governance to AI returns, citing a 6.6x ROI likelihood at banks
Stu Bradley, Senior Vice President of Risk, Fraud and Compliance Solutions at SAS, pointed to the company's latest AI study. It found that banks with comprehensive governance programs are 6.6 times more likely to report strong AI ROI. Bradley rejected the view of governance as a brake on innovation, arguing that robust governance gives institutions the confidence to innovate faster.
GCM runs on the cloud-native SAS Viya platform. It consolidates risk, control, compliance, audit and issue-management data in a governed environment and applies AI and advanced analytics to surface emerging threats.
SAS ranks No. 3 in Chartis RiskTech100 and wins a record 12 award categories
SAS recently placed No. 3 overall in the Chartis RiskTech100 2027 ranking of risk technology providers. It topped a company-record 12 solution award categories, including ALM Analytics, Balance Sheet Risk Management, Behavioral Modeling, Capital Optimization, Credit Risk and Model Risk Management.
Beyond GCM, the SAS risk portfolio includes Asset & Liability Management, Credit Risk Management, Enterprise Stress Testing, Expected Credit Loss, Risk Governance and Insurance Risk.