What do you like best about Scrut Automation?
The Scrut GRC platform helps streamline compliance activities by providing a centralised platform to manage tasks, policies, evidence and compliance requirements.
1. Task assignment and ownership: Tasks can be assigned to individual team members across departments, with clear ownership of the activities they need to complete. This helps ensure that responsibilities are distributed across teams rather than leaving all compliance activities to the IT or Security team. It also helps track pending activities and follow up with the respective owners.
2. Automated draft policy generation: The platform can generate draft policies by providing basic organisational information, such as the company name. This helps teams get started with policy documentation without having to write every document from scratch.
3. Policy customisation and review: The generated policies should be reviewed and customised based on the organisation's actual business operations, technology environment, security controls and compliance requirements. They should not be adopted as-is simply because they have been generated by the platform.
4. Centralised compliance management: The platform helps bring compliance tasks and policy documentation into one place, making it easier to monitor progress, identify pending activities and coordinate with different teams.
5. Improved accountability: By assigning tasks to specific team members, the organisation can establish clear responsibility for completing compliance activities and providing the required evidence.
Overall, Scrut GRC can reduce the manual effort involved in compliance management, accelerate initial policy drafting and improve coordination across departments. However, the quality of the final policies and the effectiveness of the compliance programme still depend on proper review, validation and ownership by the respective teams. Review collected by and hosted on G2.com.
What do you dislike about Scrut Automation?
### My Experience with Scrut GRC, SOC 2 and ISO 27001
My experience with Scrut and its implementation support has been disappointing. The primary issues were lack of clarity, lack of project management, no clear ownership of deliverables and very limited practical assistance throughout the engagement.
**1. Lack of clarity and ownership**
There was no clear ownership of the deliverables or a structured plan to drive the engagement to completion. When we signed up, the sales representative indicated that the team would support us throughout the process. However, the actual experience was very different. There was no clear accountability for ensuring that the required activities were completed on time.
**2. No proper project management**
There was no effective project management or tracking of progress. Although weekly calls were scheduled, there was no clear agenda, no structured review of pending activities and no proper tracking of deliverables. The Scrut team did not proactively identify what needed to be discussed or what actions were required from each team.
Even when team members were on leave, meetings were not cancelled or properly managed. The calls did not provide the visibility or direction needed to move the engagement forward.
**3. No practical assistance with evidence preparation**
One of the biggest gaps was the lack of practical guidance on how to prepare and submit evidence for SOC 2 and ISO 27001. Compliance is not just about assigning tasks through a GRC platform. Teams need to understand what evidence is required, how it should be prepared, what it needs to demonstrate and how it maps to the relevant control requirements.
Despite repeated follow-ups and escalations, we did not receive the level of assistance that had been promised. Multiple escalations did not resolve the underlying issues.
**4. Lack of understanding of SOC 2 and ISO 27001**
The people supporting the engagement did not appear to have a sufficient understanding of what SOC 2 and ISO 27001 actually involve. These are not simply documentation exercises where policies are generated, tasks are marked complete and certificates or reports are issued.
They require an understanding of the organisation's actual environment, implementation of appropriate controls, collection and validation of evidence, and assessment against the applicable requirements.
**5. No clarity on auditor selection or changes**
We also faced a lack of clarity regarding the auditor arrangements. We could not change the auditor for either ISO 27001 or SOC 2, which raised concerns about the flexibility available to us and the clarity of the engagement from the beginning.
**6. Concerns about the quality of the SOC 2 report**
The quality and accuracy of the SOC 2 report were particularly concerning. The report referred to controls and infrastructure, including a WAF and DMZ, that we did not have in our environment. There were also multiple inconsistencies that I identified during my review.
What concerned me further was that these issues were neither adequately corrected nor proactively questioned during the process. As someone responsible for security and compliance, I expected the report to accurately reflect the actual environment and the controls that had been implemented and assessed.
A SOC 2 report must be based on the organisation's actual system description, relevant controls and audit evidence. Incorrectly describing infrastructure that does not exist raises serious questions about the quality of the review and the reliability of the report.
**7. Concerns about the ISO 27001 and SOC 2 outcomes**
I was also surprised by the lack of observations reported across the ISO 27001 and SOC 2 engagements, particularly given the inconsistencies and gaps I identified myself.
I would have expected a rigorous assessment, clear identification of gaps, appropriate corrective actions and transparent reporting of the results. Instead, the overall experience left me questioning how thoroughly the actual environment and evidence had been assessed.
**My overall assessment**
The fundamental issue is that the engagement felt more like a process of paying for and obtaining a certification or report than a properly managed exercise to assess and improve the organisation's security and compliance posture.
A GRC platform can help automate workflows, assign tasks and generate draft policies. However, the platform itself cannot replace competent compliance guidance, effective project management, proper evidence validation or a rigorous independent audit.
When there is no clear ownership, no meaningful progress tracking, inadequate support and a report containing descriptions of controls that do not exist, it undermines confidence in the entire process.
My expectation was not simply to obtain a certificate or report. It was to ensure that the organisation's security controls were properly assessed, the documentation accurately reflected reality, and the resulting certification or report could withstand scrutiny from customers, partners and auditors.
Based on my experience, Scrut needs to significantly improve its engagement management, practical support, technical understanding and quality assurance if it wants to deliver that outcome consistently. Review collected by and hosted on G2.com.
