On 26 August 2008, FRSGlobal, a provider of software for regulatory reporting software and qualitative operational risk management, announced it plans to acquire Iris Integrated Risk Management, a Swiss provider of Basel-II-specific credit risk management software. Belgium-based FRS has been owned by the Carlyle Group and Kennet Partners investment firms since 2006. Terms of the deal were not disclosed. The deal is subject to European Union approval.

This deal reflects a trend toward consolidation in the risk management software market to improve scale, broaden functionality and achieve a wider market presence.

FRS's RiskResolve product is a pure-play, risk-qualitative self-assessment tool that supports the Basic and Standard Basel II approaches, as well as other frameworks, such as the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and International Organization for Standardization (ISO) 5229 for operational risk. The tool includes regulatory reporting capabilities specific to a variety of national regulations, as well as for International Finance Reporting Standards (IFRS) and Pillar II of Basel II.

The acquisition will combine FRS capabilities with Iris RiskPro, which supports standard through advanced Basel II approaches for credit and market risk, including a range of capital calculations and a Basel-II-specific data management capability not available with RiskResolve. The combined entity will offer risk management capabilities across credit, market and operational risk disciplines.

Although FRS has not stated what its timing will be, it plans to extend the capabilities of Iris' calculation engine to deliver quantitative analytics and capital calculations for the Basel II advanced approach to operational risk management. This could give FRS a competitive edge in the financial services market over its direct competitors in the compliance and reporting markets. Customers seek a consistent, holistic view across risk disciplines — a necessity for meeting Basel II reporting requirements. Market adoption of the combined FRS-Iris suite will depend on how quickly and effectively overlapping FRS and Iris architectures and unique data models are integrated into a single application and data structure. FRS expects to achieve a single data model and therefore full integration by year-end 2009, but its path toward that objective remains unclear, as the company has said that, initially, it will maintain separate research and development activities for each product group.

Though the two companies have a complementary geographical presence, neither has developed a significant customer base within financial services for its risk management applications comparable to the market leaders SAS Institute, Oracle Financial Services and Algorithmics. Iris' professional services staff (about 30 people) will help fill a gap in FRS' delivery model, but Gartner does not expect this combination to drive an immediate increase in market acceptance or adoption of the new FRS product suite. In the near term, FRS' strong regulatory reporting capabilities will likely continue to be a primary driver of FRS business.

Enterprises:

• Select risk management software that is extensible beyond qualitative self-assessment and basic regulatory compliance needs. Or as an alternative, select software that can be integrated with best-of-breed applications to meet future quantitative risk and performance management and advanced regulatory requirements.
• If evaluating a combined FRS/Iris offering, consider how and when FRS will integrate the RiskResolve and RiskPro products. A merger of vendors does not by itself guarantee that their technology and data can be easily and effectively integrated at an acceptable cost.

Banks:

• Consider how the multiple regulatory reporting formats of FRS Global combined with a single version of data across risk types from Iris could help to reduce the costs of compliance.

• "A Risk Hierarchy for Enterprise and IT Risk Managers” — Use Gartner's guidance to develop a clear, enterprise-specific risk hierarchy that will facilitate decision-making about risk controls, processes and tools. By Paul Proctor, Douglas McKibben and Vincent Oliva
• "The Fallacy of GRC in Financial Services” — Use corporate performance management priorities as the basis for implementing governance, risk and compliance initiatives. By Douglas McKibben and David Furlonger

(You may need to sign in or be a Gartner client to access the documents referenced in this First Take.)