Skip to content
SPECIFICTION
Get listed

OpenWorkpaper

openworkpaper.com

Free plan Open source WebAPISelf-hosted
Visit openworkpaper.com
Spec score 8.4 #3 of 32 in Audit Management Software

What it is

OpenWorkpaper is an open-source web application for documenting audits from planning through fieldwork and reporting. Its task dashboard lists active audits, assigned procedures, and pending reviews. A centralized request area handles client information requests and master PBC spreadsheet uploads and downloads. Procedures can record purpose, source, scope, methodology, results, conclusions, and reviewer comments, with PDF, Word, Excel, and PowerPoint attachments. Audit programs export to Word, and automatic numbering organizes groups, procedures, and attachments hierarchically. Collaboration includes assignments, team management, discussions, and preparer and reviewer sign-offs. Role-based access combines system roles with audit-specific teams. OpenID Connect works with Microsoft Entra ID, Okta, and Keycloak. The project documents HTTPS through Nginx and SSL/TLS certificates and records sensitive actions in audit logs. It supports local, private-network, and cloud deployment with a portable SQLite database. The free open-source plan is free.

Spec sheet

What it does
OpenWorkpaper is an open-source web application for documenting audits through planning, fieldwork and reporting.Read 15 Oct 2026 · github.com
Purpose
OpenWorkpaper is an open-source web application for auditors to document audit programs and procedures across planning, fieldwork, and reporting.Read 8 Oct 2026 · github.com
Intended users
The project describes itself as built for CPA firms and internal audit departments.Read 8 Oct 2026 · github.com
Deployment
Docker or Podman Compose deployment is recommended, with a manual Node.js installation also documented.Read 15 Oct 2026 · github.com
Security
The project documents HTTPS deployment using an Nginx reverse proxy and SSL/TLS certificates.Read 8 Oct 2026 · github.com
Access control
Role-based access combines system roles with audit-specific team assignments.Read 15 Oct 2026 · github.com
Access controls
OpenWorkpaper supports role-based access control, with system roles and audit-specific team assignments.Read 8 Oct 2026 · github.com
Attachments
Procedures accept PDF, Word, Excel and PowerPoint files.Read 15 Oct 2026 · github.com
Audit documentation
Each procedure records purpose, source, scope, methodology, results, conclusions and reviewer comments.Read 15 Oct 2026 · github.com
Audit logging
Logins, deletions, procedure unlocking and user changes are recorded in audit logs.Read 15 Oct 2026 · github.com
Audit logs
The system tracks sensitive actions such as logins, deletions, procedure unlocking, and user changes in audit logs.Read 8 Oct 2026 · github.com
Capacity guidance
For up to 200 concurrent auditors, the project recommends 2 to 4 vCPUs, 4GB to 8GB RAM, and 20GB or more of SSD storage.Read 8 Oct 2026 · github.com
Collaboration
Teams can assign procedures, manage engagement members, discuss work and record preparer and reviewer sign-offs.Read 15 Oct 2026 · github.com
Database portability
The database is a portable SQLite file and uploaded documents are stored in a separate persistent volume.Read 15 Oct 2026 · github.com
Deployment and data
The project supports local, private-network, and cloud deployment, and uses a portable SQLite database.Read 8 Oct 2026 · github.com
Document support
Procedures support PDF, Word, Excel, and PowerPoint attachments, and audit programs can be exported to Word format.Read 8 Oct 2026 · github.com
HTTPS deployment
A supplied Nginx configuration can terminate TLS on port 443 using certificates placed in the certs directory.Read 15 Oct 2026 · github.com
Identity integrations
OpenID Connect support includes Microsoft Entra ID, Okta and Keycloak.Read 15 Oct 2026 · github.com
Licence
The repository is distributed under the MIT License, with copyright attributed to Robert Sandidge in 2026.Read 15 Oct 2026 · github.com
Limit: community code
The project does not guarantee the accuracy, safety or effectiveness of community-contributed code.Read 15 Oct 2026 · github.com
Limit: deployment burden
The project requires users to provide and maintain the hosting environment, certificates, secrets, backups and network security.Read 15 Oct 2026 · github.com
Limit: maintainer capacity
The disclaimer says the project was developed personally and future issues or pull requests are handled using personal time and resources.Read 15 Oct 2026 · github.com
Limit: warranty
The disclaimer provides the software as-is and disclaims responsibility for security incidents, data loss, system failures and audit failures.Read 15 Oct 2026 · github.com
Maker identity
The repository license names Robert Sandidge as copyright holder; no separate corporate legal entity is identified on the official site or repository.Read 15 Oct 2026 · github.com
Management insights
The management view tracks review lag, procedures older than 30 days and auditor workload.Read 15 Oct 2026 · github.com
Numbering
Automatic numbering formats groups, procedures, and attachments hierarchically, such as 1.1, 1.1.a, and 1.1.a.1.Read 8 Oct 2026 · github.com
PBC tracking
The system centralizes client information requests and supports master PBC spreadsheet upload and download.Read 15 Oct 2026 · github.com
Procedure locking
Reviewed procedures become read-only until an authorized user unlocks them, which clears existing sign-offs.Read 15 Oct 2026 · github.com
Procedure workspace
Procedures provide rich-text editing and integrated discussions.Read 15 Oct 2026 · github.com
Release status
GitHub currently shows no published releases for the repository.Read 15 Oct 2026 · github.com
Repository activity
GitHub shows 5 stars, 1 fork and 311 commits for the public repository.Read 15 Oct 2026 · github.com
Security controls
The security policy describes HSTS, TLS 1.2+, secure HttpOnly SameSite cookies, DOMPurify sanitization, CSP guidance and SAST/DAST scanning.Read 15 Oct 2026 · github.com
Self-healing API
The application includes database-repair logic intended to detect and fix schema mismatches during migrations.Read 15 Oct 2026 · github.com
Smart numbering
Groups, procedures and attachments receive hierarchical numbering such as 1.1, 1.1.a and 1.1.a.1.Read 15 Oct 2026 · github.com
System requirements
For up to 200 concurrent auditors, the project recommends 2–4 vCPUs, 4–8 GB RAM and at least 20 GB SSD storage.Read 15 Oct 2026 · github.com
Task engine
A dashboard shows active audits, assigned procedures and pending reviews.Read 15 Oct 2026 · github.com
Task management
Its task engine provides a dashboard of active audits, assigned procedures, and pending reviews.Read 8 Oct 2026 · github.com
Technology stack
The project uses Next.js with React, SQLite through Prisma, Tailwind CSS, JWT sessions, OIDC, bcryptjs and docx.js.Read 15 Oct 2026 · github.com
Templates
Users can maintain audit-program templates and import procedure sets into audit phases.Read 15 Oct 2026 · github.com
Three-phase workflow
Audits are organized into Planning, Fieldwork and Reporting sections.Read 15 Oct 2026 · github.com
Word export
An audit program can be exported as a Word .docx document.Read 15 Oct 2026 · github.com

Plans and prices

Free / open source Free self-host on your infrastructure Read 15 Oct 2026 · openworkpaper.com

Every OpenWorkpaper plan and price →

Strong points and limits

Strong points

  • Dashboard for audits, procedures, and pending reviews
  • Structured procedure fields and common office attachments
  • Hierarchical automatic numbering
  • OpenID Connect identity-provider support
  • Portable SQLite with flexible deployment

Limits

  • Capacity guidance requires infrastructure planning
  • Free plan is self-hosted
  • Supported audit type listed is internal audit

Who it suits

It is built for CPA firms and internal audit departments documenting audit work and evidence. Organizations can deploy it locally, privately, or in the cloud.

Verdict

OpenWorkpaper provides a structured audit workpaper workflow with evidence, review, access control, and logging features. Its open-source, self-hosted model offers deployment flexibility, provided the organization supplies and manages the infrastructure.

Where Specifiction places it

Alternatives to OpenWorkpaperAll alternatives →