I am using excel. I have a series of sheets for all of the areas that I audit that I use to evaluate controls. It feeds into a summary sheet where I also assign a value for inherent risk and whether the risk is increasing, stable or decreasing. The score that is calculated for each area is how I assign the audit frequency.
If you are interested, send me a PM with your e-mail address and I can share. Of course, you would have to modify it to fit your institution.
Just my 2 cents worth--for what its worth!!