إنتقل إلى المحتوى الرئيسي

Reporting

Everything Vantage reports is computed once, in one place, and read by every surface: the engagement page, the organisation dashboard, the in-app report, the Excel workbook and the document packs all state the same numbers. Progress is signed-off ÷ applicable; the compliance rate is compliant ÷ judged; average maturity is over graded controls only. A control nobody has graded is shown as not graded, never as a zero.

Report packs​

Two documents are built for people who do not log in — a board, an audit committee, a regulator. Each renders to PDF and Word (DOCX), in English or Arabic (the pack follows the language you are working in), and every download is recorded in the audit trail.

The engagement pack​

From Reports, pick an engagement and choose PDF or Word next to the Excel export. Exporting is an analyst-or-above action and every download — Excel, PDF or Word — is recorded in the audit trail. The pack contains:

  • Executive summary — framework and version, project, status, period, progress, compliance rate, average maturity with the design and operating averages, evidence coverage and the findings headline.
  • Posture by domain — one line per top-level domain: compliance, maturity, the two effectiveness averages and the compliant / partial / non-compliant / not-applicable split.
  • Design vs operating effectiveness — the distribution of each axis and the controls that are designed but not operating (design at structured or above while operation is below it) — the list a reviewer looks for.
  • Findings — by severity and status, the aging of open findings (days past due), repeat findings, root-cause categories, on-time closure and mean time to remediate, then the open findings with owner and due date.
  • Sign-off attestation — how many workpapers were prepared, reviewed and approved, who signed most recently, the engagement team, and a statement that the document was produced from the signed-off workpapers.
  • Evidence coverage.

The control workbook (Excel)​

Six sheets, for the reviewer who works offline: a summary, every workpaper, every finding, the gap analysis against a target profile, the evidence inventory and the sign-off matrix.

The workpaper sheet carries both effectiveness axes, the conclusion, the observation in both languages and — for a control scoped out — the N/A justification the platform required before it accepted the judgement. The findings sheet carries the governance around each one: root-cause category, repeat count, the original due date and how many extensions moved it, who verified the close and when, and — where a finding was accepted rather than fixed — who accepted it, why, and when the acceptance expires.

A control that has not been graded reads Not graded on every sheet, and has no score and no gap. It is not a zero.

The organisation posture pack​

At the top of Reports, Organisation posture pack renders the whole programme: one line per standard — the latest engagement on any edition of it and its posture — the organisation's remediation analytics, and the compliance trend from gap-analysis snapshots. Archived editions are not listed. The same data is shown on the page underneath.

Issued reports — the copy that does not move​

Everything described above is built from today's data. That is right while you are working and wrong for a document you have already handed to somebody: reopening a completed engagement, carrying one of its findings into next year, or a platform correction can all change what a closed engagement says about itself afterwards.

Issue a report and the platform stores the built document — every figure and sentence, in both languages — together with a SHA-256 fingerprint of it. From the engagement's ⋯ menu, Issued reports lists what has been issued, and any version can be downloaded again as PDF or Word. Re-rendering an issued version reads the stored copy and no live data at all, so it says the same thing in two years as it did on the day.

What the fingerprint is, and what it is not​

It is taken over the stored record — the figures and sentences of the frozen document — and it is recomputed every time the list of issued versions is drawn and every time a version is opened. If the two ever disagree, the stored record has been changed by something that went around the platform: the version is marked in the list, its downloads are withdrawn, and the platform refuses to render it as a report at all. It is not handed over with a warning attached; a document nobody can vouch for is not a document to file.

It is not a checksum of the PDF or Word file you downloaded. Those are rendered on demand: two downloads of the same version carry the same words and figures but are not guaranteed to be byte-identical, so a recipient who hashed their own file would get a different number and conclude, wrongly, that their genuine document had been tampered with. To confirm a document someone holds, download that version again and compare what it says — the record it is rendered from cannot have moved.

Completing an engagement issues its closing record. You do not have to remember: the moment an engagement is completed, the platform freezes the report of the completed engagement in the same step, and the list marks that version Closing record. Reopening the engagement and completing it again issues another one beside it, so the record of what the period said the first time survives the second.

  • Issuing needs a manager. Reading the issued reports — the list or any one of them — is an export, so it needs an analyst or above, and every reading is recorded. A draft engagement has nothing to issue; start it first.
  • View opens the PDF of that version in your browser; PDF and Word save it.
  • What is frozen is the report — every figure and sentence of it, in both languages. The control workbook (the Excel export) is a working export built from today's workpapers and is not part of an issued version; if you need the workbook as it stood, export it before you reopen the engagement.
  • Re-issuing writes a new version. Nothing is overwritten and nothing is deleted: v1 stays exactly as it was beside v2, with the reason you gave for each.
  • Withdrawing one. Completing an engagement issues its closing record, and an engagement that holds an issued record cannot be deleted — so an engagement created by mistake would otherwise be permanent. A super administrator can withdraw an issued version, with a written reason. The version goes; the audit trail keeps its number, its fingerprint, its figures and your reason, so the record of what was withdrawn survives the withdrawal.
  • A completed engagement is the usual thing to issue from, but you can issue at any point — the version records the engagement's status at the moment of issue, so a reader can see it was in progress.

Dashboard analytics​

The dashboard now shows two more views of findings:

  • Open findings by age — how many are not yet due, 1–30, 31–90 and more than 90 days late, or have no due date, with on-time closure, mean days to remediate and the repeat count alongside.
  • Compliance trend — the monthly average of gap-analysis snapshots taken against a target profile over the last twelve months. Snapshots taken without a target are excluded, because their figures would read as 0%.