OpenWorkpaper vs Quantivate Internal Audit

OpenWorkpaper is an open-source web application for documenting audits from planning through fieldwork and reporting. Its task dashboard lists active audits, assigned procedures, and pending reviews. A centralized request area handles client information requests and master PBC spreadsheet uploads and downloads. Procedures can record purpose, source, scope, methodology, results, conclusions, and reviewer comments, with PDF, Word, Excel, and PowerPoint attachments. Audit programs export to Word, and automatic numbering organizes groups, procedures, and attachments hierarchically. Collaboration includes assignments, team management, discussions, and preparer and reviewer sign-offs. Role-based access combines system roles with audit-specific teams. OpenID Connect works with Microsoft Entra ID, Okta, and Keycloak. The project documents HTTPS through Nginx and SSL/TLS certificates and records sensitive actions in audit logs. It supports local, private-network, and cloud deployment with a portable SQLite database. The free open-source plan is free.

Quantivate Internal Audit manages the internal audit lifecycle, including risk assessment, planning, workpapers, findings, management responses, status, and follow-up. A centralized digital library stores audit plans, reports, findings, and related materials. Teams can configure workflows and automatic alerts for scheduling and task assignments, then track corrective actions. Resource tools include an auditor skillset database, resource planning, and time tracking for hours and costs. Report Builder supports customized reports, data visualizations, and exports, while dashboards, built-in templates, and document management support daily audit work. Quantivate describes the SaaS interface as customizable to an organization’s processes without requiring a predetermined workflow. The product is described as aligned with Institute of Internal Auditors standards. It supports web access, single sign-on, and user provisioning that creates an account at first login. Data can be shared with enterprise risk-management data and controls. Quantivate states that its controls meet AICPA Trust Services Criteria and describes the platform as SOC 2 Type 2 compliant. Pricing is on request, with a demo offered.