—Planning & Scheduling
VistaPlan — risk-based audit planning software.
Turn risk into a defensible annual plan — and keep it current. VistaPlan scores the audit universe, builds the risk-based plan, and matches it to the capacity and calendar you actually have.
—The Pain
What you're living with today.
A static universe
Your audit universe is a spreadsheet of departments, not risks — and it was last refreshed a year ago. By the time the plan is approved, the business has already moved.
Capacity you can't see
Who is free in March? Is the plan even deliverable with the team you have? Workload-versus-capacity lives in someone's head, so plans slip and people burn out.
Budgets with no yardstick
Planned-versus-actual hours surface at the post-mortem, not while there's still time to act. Without live time tracking, every overrun is a surprise.
IIA 9.4
requires the risk assessment to be documented and refreshed at least annually (effective Jan 2025) — a living universe, not a once-a-year file
—In the Product
From risk universe to approved plan.
The planning cycle as it runs inside VistaPlan. Screens from ControlVista, shown with demo data.
01
A plan sized to the team you have.
Available capacity against planned days and utilisation, plus readiness checks — universe, risk factors, scoring, effort estimates, capacity — before the plan goes to the audit committee.
Open full size
02
Every change, on the record.
Amend the plan with a stated reason, enter the auditor days available, and VistaPlan suggests the highest-risk entities that fit. Each engagement carries its risk score and day allotment.
Open full size
03
Programmes you build once.
Reusable RACM audit programmes — credit, AML/CFT, treasury, IFRS 9 and more — saved from one engagement, approved and versioned, and applied to the next.
Open full size
—The Audit Universe
More than a list of departments.
An audit universe should mirror how the organisation creates and controls risk. Depending on the business, it can be built from any of these:
- Business units
- Legal entities
- Products
- Processes
- Branches & locations
- Technology platforms
- Regulatory obligations
- Risk domains
- Third-party relationships
- Strategic initiatives
A bank's audit universe
Not this
- HR
- Finance
- IT
- Operations
But this
- Retail Banking
- Corporate Banking
- Treasury
- AML
- Credit
- Market Risk
- Cybersecurity
- Digital Banking
- Branch Network
- Regulatory Compliance
- Third Parties
In VistaPlan, each auditable entity is scored on weighted risk factors — so the plan follows the risk, not the org chart.
—The Risk Model
Build a risk model your CAE can defend.
Configure the factors that matter to your organisation, weight them, and let the score drive the plan. For example:
- 1Weighted score
- 2Risk rating
- 3Audit frequency
- 4Plan priority
Each step is recorded, so the committee can see exactly how risk drove every line of the plan.
| Risk factor | Example scale |
|---|---|
| Financial impact | High / Medium / Low |
| Regulatory exposure | High / Medium / Low |
| Control maturity | 1–5 |
| Prior audit results | 1–5 |
| Fraud exposure | 1–5 |
| Business change | 1–5 |
| Management concerns | 1–5 |
| Time since last audit | 1–5 |
Illustrative factors and scales — configure your own.
—Capacity
A plan is only good if your team can deliver it.
VistaPlan matches the plan to auditor availability in days and skills, so overload shows up before it becomes a missed engagement.
- Available capacity
- 320 auditor days
- Committed engagements
- 286 days
- Unallocated
- 34 days
| Auditor | Capacity | Planned | Utilisation |
|---|---|---|---|
| Auditor A | 120d | 114d | 95% |
| Auditor B | 110d | 106d | 96% |
| Auditor C | 90d | 66d | 73% |
Example figures.
—Scheduling
See the year before the year happens.
Place every engagement against the actual calendar, auditor capacity and required milestones — with conflicts flagged and plan-versus-actual variance tracked as the year runs.
- Treasury & Liquidity
- IT General Controls
- AML & Sanctions
- Procurement⚠ Overlaps year-end close
- Credit Risk
- Cybersecurity
Illustrative schedule.
—Plan Changes
When the plan changes, the audit trail remains.
Risk changes. Management requests an audit. A regulatory issue appears. An engagement is deferred. VistaPlan keeps full version history of every change, so the plan the committee approved and the plan you're running are always reconcilable.
- Risk changes
- Management request
- Regulatory issue
- Engagement deferred
Plan change record
v1.3- Original approved plan
- FY2026 plan v1.0 — approved by the audit committee
- Change requested
- Add “Sanctions screening” engagement
- Reason for change
- New regulatory requirement
- Impact on coverage
- +1 high-risk entity covered this year
- Replacement / deferred
- Procurement deferred to FY2027 Q1
- Approver
- Audit committee chair
- Date and time
- 12 May 2026 · 10:42
- Current plan version
- v1.3
Illustrative record.
—What VistaPlan Does
Planning & Scheduling.
VistaPlan keeps the universe alive, turns it into a board-approved plan, and matches that plan to real capacity.
Risk-ranked audit universe
Auditable entities with weighted risk factors, category overrides, and inherent / residual scoring — reassessed continuously, not once a year.
Risk-based annual plan
Coverage rotation, capacity-matched scheduling and a board-approval workflow, with full version history of every change.
Resourcing & capacity
Auditor availability in days, skill-matched assignment, and a live view of planned versus actual utilisation — so you see overload before it becomes burnout.
Scheduling & variance
Engagement Gantt, milestones, calendar-conflict detection and plan-versus-actual variance, in one place.
—What Changes
The outcome.
A plan you can defend
Show the committee exactly how risk drove every line of the plan.
Deliverable, not aspirational
Match the plan to real capacity so it survives contact with the year.
No post-mortem surprises
Spot the overrun while you can still do something about it.
—Request a demo
See ControlVista run your audit lifecycle, end to end.
A 30-minute walkthrough with the team that built it — from the audit universe to the board-ready committee pack, in English and Arabic.
A product of Vantage Technologies.