Speaking about the room for improvement in the solution, I mainly feel that it is not a GRC tool. So, I think that it is more of an IT risk management tool. Basically, it's very good at IT business management. It's not a good tool for governance risk and compliance beyond IT risk management. If you want to use it for business, financial, reputational, health and safety risks, or any other type of risk relevant to your industry or your organization, it's not ideal, and you probably have to get a different system. In short, it does risk management better than most generic GRP tools. However, most of the good GRC tools that are business focused also do IT risk management well enough, which is why OneTrust GRC is not a good enough solution by itself. In future releases, the solution should work over its ability to manage business risks by incorporating something like an enterprise risk management module.
