Archer Audit Engagements & Workpapers vs ControlVista

Archer Audit Engagements & Workpapers tracks the audit universe, engagements, workpaper documentation, testing, and results. It provides review and approval workflows for engagement and workpaper records, plus a centralized Audit Program Library and workpaper repository. Audit report and planning memo templates support documentation, while teams can manage findings and remediation plans with comment review. The product supports offline audit engagements and shares data with Archer risk and compliance functions, using existing risk and control data to help scope audits. Archer describes its broader Audit Management offering as combining audit planning, engagements, workpapers, and issues in one system. Archer Issues Management is a prerequisite for this product. It is positioned for enterprise audit teams, including heads of internal audit. Archer says its SaaS runs on AWS and has a 99.5% composite SLA; listed SaaS certifications include ISO 27001, ISO 27017, and ISO 27701, with encryption at rest and in transit. SaaS environments are commonly multi-tenant, while dedicated database infrastructure and single-tenant environments are available at additional cost. Pricing is on request.

ControlVista is an internal audit management system covering risk-based planning, fieldwork, reporting, and remediation. VistaPlan scores auditable entities by weighted risk and supports capacity-matched annual plans, scheduling, and board approval. VistaField handles walkthroughs, control testing, evidence capture, working papers, and preparer-reviewer-approver sign-off. VistaResolve tracks management responses and remediation with ageing, overdue tracking, and threshold-based escalation. VistaReport drafts engagement reports and audit opinions and provides live assurance dashboards and committee packs. VistaAssist uses AI to draft procedures, workpaper summaries, findings, reports, and committee materials; auditors review and own the editable drafts. ControlVista connects to in-house systems and an organisation’s SSO or identity provider. It runs in a customer-controlled data centre or private cloud, with no outbound telemetry of engagement content and no vendor access to audit evidence, according to the maker. Source-code escrow is available, while the customer controls backups, recovery, and update timing. English and Arabic are supported, with alignment to IIA Standards 2024, COSO Internal Control, and ISO 19011. On-premise pricing is a fixed annual fee quoted during procurement.