Specify an integration as a supported business process, not as a connector name.
Archer’s current IT Security Risk Management integration guide distinguishes REST APIs, scheduled data feeds and one-time imports. It explains that API integrations require an intermediary to handle functions such as authentication, transformation and scheduling, while the one-time importer is not the mechanism for ongoing automated integration. (help.archerirm.cloud)
What belongs in the integration dependency register?
Use one row per interface:
| Field | Required decision |
|---|---|
| Purpose | Which control, report or workflow depends on the interface? |
| Source of truth | Which system owns each relevant field? |
| Direction | Read-only, write-back or explicitly governed bidirectional flow? |
| Scope | Which objects, fields, attachments and populations are included? |
| Identity | Which service identity and permissions are required? |
| Frequency | Scheduled, event-driven or manual? |
| Freshness | When should data become visibly stale? |
| Matching | Which stable keys prevent duplicate creation? |
| Failure handling | Who receives an alert and how is work recovered? |
| Reconciliation | How are missing, changed and rejected records detected? |
| Change ownership | Who maintains the interface when either endpoint changes? |
| Commercial boundary | Which licences, middleware or services are additional? |
Which failure tests should you run?
In an authorised test environment:
- Remove or expire a test credential.
- Interrupt a transfer part-way through.
- Replay the same batch.
- Change a source field or enumeration.
- Supply an unexpected null or oversized attachment.
- Remove a source record.
- Revoke access to an evidence item.
- Restore the interface and reconcile the result.
Require observable outcomes: alerting, controlled retry, duplicate prevention, exception handling and evidence of recovery.
For ticketing integration, decide whether ticket closure means only that engineering work is finished or that the GRC action is verified. Do not allow a status synchronisation to bypass the agreed closure reviewer.
For automated evidence, require source, collection time, covered period, completeness checks and review outcome. Treat successful collection and successful control performance as separate acceptance questions.
Exit gate: the source-system owner and operating team accept the interface, its failure behaviour and its support responsibilities.
Sources cited on this page
- help.archerirm.cloud ↗help.archerirm.cloud