Another Nail in ACL’s Coffin

Diligent’s acquisition of Galvanize (ACL) is another nail in the ACL analytics coffin.

First, ACL acquired another company and created Galvanize. And we were told governance, risk, and compliance (GRC) would never be the same.

And I told you that ACL analytics would never be the same. In fact, I predicted that this acquisition meant that ACL analytics was dying (when I say ACL analytics, I’m referring to the Windows desktop version that they built the original company on).

For more on this, see ACL Officially Changes Name & Spots  and Is ACL Analytics Dying?

Well, the latest merger is just another nail in the coffin that was carved out (pardon the audit pun) a while back. Again, the press releases emphasized GRC, GRC, GRC.

Was really anything mentioned about ACL analytics? Not really. And when was the last time you got an email promoting a seminar or a video about ACL analytics?

It’s all GRC and (fake) robotics. For my analysis of robotics, see ACL Robotics is NOT Robotics.

My other concern about robotics is whether you can keep your data on premise. ACL techs have told me you can, but the diagrams they showed me weren’t convincing. And if I wasn’t convinced, how do I convince my audit peers and the security team? If any of you have robotics and keep your data on premise, and you have TESTED that it doesn’t get uploaded to ACL, please post in the comments. I’m also open to hearing from ACL staff on this. That’s my challenge, so please convince me!

The other thing that is killing ACL analytics is the inability to deal with huge data files. I don’t know if the so-called robotics configuration adds more processing power. If you have run huge data files through robotics successfully, please post in the comments. By huge I mean AT LEAST 25 million or more records containing at least 25 columns.

Anyone who has tried to process huge data files in ACL analytics desktop knows that the software just chokes.

The larger the company becomes, the more likely management will start looking for cost cutting. Standalone ACL on the desktop will be on the chopping block. Why maintain a standalone version apart from ACL robotics? Especially if ACL sales and persistency are decreasing?

Like I’ve said before, if you haven’t started looking for other tools to replace ACL yet, you better start looking. The more you have running on ACL, the sooner you need to get started.

As always, I’m interested in what others think.

Are you still using ACL on the desktop? Do you have any automated ACL scripts running? Or is your group still using ACL predominately in menu driven mode without any scripting?

Do you think ACL desktop is dying? Why or why not?




Filed under ACL, Audit, Data Analytics, Scripting (ACL), Technology, Written by Skyyler

11 responses to “Another Nail in ACL’s Coffin

  1. Grant Brodie here. Full disclosure I am a vendor, representing Arbutus Software (, but I was also one of the co-founders of ACL, and in that regard responsible for most of the cool desktop technology you love.

    I disagree that ACL Analytics is dead. Certainly the ACL company is going in a different direction, but ACL Analytics can be considered an ecosystem. In that regard, not just the company that bears the name. Arbutus supports that ecosystem. Arbutus supports exactly the same desktop architecture, your existing projects will auto convert (literally just open them with Arbutus Analyzer), the UI is almost the same, and scripts will at least 95% run out of the box. Not only that, but we have a wealth of additional features, and we’re faster.

    The conversion is just a click, so I ask you not to give up on the ACL ecosystem before checking out the alternatives within the same space, as switching to another platform will inevitably be a real pain.



    • Good to see you back, Grant. Always appreciate your input. Appreciate your disclosure, which is pretty classy in this day and age.

      skyyler was going to check out your product, and I’ve been waiting for him to do it, and see what he thinks.

      I know he has concerns that Arbutus can’t handle the huge data files he processes, but again, he hasn’t tried your software yet. I’ll give him another nudge, as I’d really like to know also.

      So for the record, Arbutus can handle files with 25 million records and 25 columns? What’s the upper limit? I’ve talked with one of your reps and was told there’s no limit, but I find that hard to believe, especially for a desktop product.

      If your architecture is anything like ACL’s (text based), I find that hard to believe. But then I haven’t test it either…

      But you bring up a good point, which is converting to Arbutus would be much easier than a total rewrite in power bi, nifi, SASeg, and a host of other products, some which would NOT be able to do all that ACL does.

      The one concern I have with Arbutus is one of the big problems skyyler and I have had with ACL: it’s not an enterprise tool like power bi or SAS which my company already uses. Management does not like one-offs in either of the groups we belong to. That not only means that I can’t get support on it internally, but more importantly, I can’t share any scripts or logic built in the tool with others in the enterprise (so they can plug them into their own tools).

      One other question: How can you automate and schedule Arbutus scripts? Can you create a .bat file like you can with ACL? Any other methods available?

      Once we do a test run of Arbutus, we’ll do some writeups. I don’t see any in-depth reviews of your product. Can you point me to any? The ones I’ve found are rather limited.

      Finally, I find your disagreement that ACL is dying interesting. While you may not want to diss a competitor (again, classy), you stand to profit if ACL dies and companies want a product where you don’t have to rewrite everything or convert to their pseudo-robotics. Makes me wonder if you know something I don’t know…. :)

      We’ll see what skyyler thinks…


      • Regarding being back, I -am- following your posts here, I guess I didn’t want to be a pain, given my obvious self-interest. That said, the recent events at Galvanize are causing concerns for many, and I felt compelled to ensure that everyone at least knew there’s a plug-compatible alternative that is a painless switch; before they go off and make a rash and expensive decision regarding switching.

        As to your questions, you may or may not know this, but when I say I was a co-founder of ACL, I was the technical half. My partner was the marketing half. While there (and subsequently at Arbutus), I was all about performance, and all about analytics, so it shouldn’t be a surprise that performance is king.

        For the record, 25 Million records with 25 columns would be absolutely no problem. In fact, 10 times that would be no problem. There really are no limits on records or columns. As long as the file fits on disk we will process it, typically at a million or more records/second. Beyond 2 billion records there are a few visual glitches, but it still processes and produces the correct result with any size file.

        I can’t speak for ACL’s current architecture, but we are not typically text-based. We do read text-based data, but then we read pretty much any other data as well.

        As for the compatibility issue you bring up (can’t share with others), there are a couple of dimensions to that discussion. While Galvanize may have been primarily a -desktop- tool (and more recently a cloud tool), Arbutus is architected as an -enterprise- tool. We offer a server-centric solution (that supports shared analytics, scheduling, results management, browser access, universal data access and more), but also continue to support the desktop model. You are using the term ‘enterprise’ in the sense of every department uses it. Unfortunately, it’s very hard for any company to occupy that niche (Galvanize didn’t). Only the very largest companies get there. But that doesn’t mean our architecture isn’t ready for that, when the time comes.

        As for sharing scripts, Arbutus does share a scripting language with ACL. This means the scripts themselves wouldn’t be easily portable to other tools. The only viable candidate for such script sharing would be SQL, and I think that language is inadequate for the kinds of analytics we do (without getting super arcane). Instead of making the -scripts- portable, we make the -data- portable. through a tool called “ConnectPlus”. This is an ODBC driver that allows any organizational user to share the “results” of any of your work with any other Windows user, via ODBC. Every table in your project is exposed, including those on other platforms like the mainframe. We also offer built-in technology that will allow these ODBC users to launch queries (without actually seeing the script). Not the same, I get it, but short of crippling the language, I can’t see an alternative.

        Another (somewhat related) topic is that with our next major release we will be offering visual workflow development (kind of like Alteryx and other similar tools). You will be able to create workflows in a flowchart-like style, using drag and drop. This hides the actual scripting language, and relies instead on a very familiar visual interface. This still won’t be portable, but then I don’t think any of the offerings in this space are.

        As for scripts in general, we still rely heavily on the model that ACL desktop uses. Our script extensions are .pro (for procedure) instead of .bat, but otherwise are pretty much the same. They are so similar that, as I mentioned in my last post, any existing scripts are auto-converted when you open the ACL project.

        When it comes specifically to automating scripts, we differ significantly from ACL. Rather than the AX model requiring you to upload a script into a different product and convert it into an analytic there, our scheduling architecture uses the same script, and it is directly accessible from the Analyzer desktop (just right-click/schedule from the Overview). You do require an Arbutus Hub server to be available, but this just ensures there is a machine up at 2AM (or whenever) to run the job.

        As for write-ups, there used to be a number of comparisons available on-line, but they were just about all pulled, I believe due to pressure from ACL, but that’s just a guess. We did a comparison ourselves a few years back (, but as it’s produced by Arbutus, it is less than independent (though every effort was made to be so). With all the goings on at Galvanize right now we are getting a lot more interaction with ACL influencers (most of the names you would know), so I expect more such reports in the near future. By far the best approach is to try it out for yourself.

        As for diss-ing ACL, I don’t know anything you don’t (really). I just find that it’s not good business to slag a competitor. ACL is still a great product, compared to many alternatives, although their current emphasis on GRC -is- causing some concern. As I said, I believe the environment we find ourselves in to have evolved into an ecosystem, rather than just a product from a single company. Kind of like SQL evolved from a product only offered by IBM (as DB2) to what we see today. Not quite as many suppliers, but certainly two. Regardless of what the future holds for Galvanize, we intend to continue supporting the ecosystem, and I want the community to know this.

        I look forward to any reviews you care to share, and am available at any time should you have further questions.


        Liked by 1 person

        • I am not in an audit role at the moment, but I always wanted to try Arbutus, it was easily the top of my list of platform to check out if/when the department I was in moved away from ACL. I am excited to see what you all can do in that space.


  2. Louis Entsi

    Grant Brodie the link you shared isn’t available ‘SORRY! PAGE NOT FOUND’. any reason for that?


    • Louis, I’m sorry but we are in the process of updating our website and this page had been de-activated in the process. With ACL’s well-documented move away from analytics, we tend to focus on them less these days, and so some of the “vs. ACL” content was removed. That said, information like this is clearly important to existing ACL users, so I have had the page re-activated. The link now works again.



      • Devin Self

        Grant, the link to view the commands isn’t working on that page. I’m intrigued by just how much faster Arbutus is compared to “the competition” and would like to see what commands you issued.


        • Grant

          The extra page link showing the actual commands has now been restored.

          Sorry for any inconvenience.



  3. I just want to thanks you guys about your discussion on this subject.
    It echoes both my worries and hopes regarding the future of ACL.
    Very informative, thanks!

    Liked by 1 person

  4. Pingback: Master List of ACL Articles and Tips | ITauditSecurity

Leave a Comment

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.