Archer Audit Engagements & Workpapers vs OrviQ

Archer Audit Engagements & Workpapers tracks the audit universe, engagements, workpaper documentation, testing, and results. It provides review and approval workflows for engagement and workpaper records, plus a centralized Audit Program Library and workpaper repository. Audit report and planning memo templates support documentation, while teams can manage findings and remediation plans with comment review. The product supports offline audit engagements and shares data with Archer risk and compliance functions, using existing risk and control data to help scope audits. Archer describes its broader Audit Management offering as combining audit planning, engagements, workpapers, and issues in one system. Archer Issues Management is a prerequisite for this product. It is positioned for enterprise audit teams, including heads of internal audit. Archer says its SaaS runs on AWS and has a 99.5% composite SLA; listed SaaS certifications include ISO 27001, ISO 27017, and ISO 27701, with encryption at rest and in transit. SaaS environments are commonly multi-tenant, while dedicated database infrastructure and single-tenant environments are available at additional cost. Pricing is on request.

OrviQ is an API and web enterprise governance, risk, and compliance platform linking regulatory requirements with internal controls and verified evidence. Its workflow moves from regulatory document ingestion and AI-assisted obligation extraction through requirement structuring, control mapping, assessment, evidence, findings, remediation, monitoring, and reporting. AI extraction remains advisory until a human reviewer accepts it. Control Assurance covers design and operating-effectiveness assessments, RCSA campaign waves, and second-line validation. Residual risk can be linked to assurance conclusions, KRI threshold breaches, and open audit findings. Modules cover regulatory compliance, risk management, findings and remediation, policy governance, audit, inspections, operational resilience, and third-party risk. The catalogue documents 20 available integrations, including Microsoft Entra ID, Okta, Azure, Microsoft 365, AWS, Google Cloud, VMware, ServiceNow, Jira, and GitHub or GitLab; Splunk and Microsoft Sentinel are planned only. Tenant isolation, centrally enforced permissions, append-only audit logs, encrypted credential storage, malware scanning, rate limiting, CSRF protection, and health checks are described. Pricing is on request and modules are licensed per tenant.