Does an internal audit use the controls we already track?

Yes. An audit's work programme is generated from the controls you track for the standards in scope, with each control's latest recorded verdict and evidence shown beside the auditor's own conclusion — which is never written back.

How are audit workpapers reviewed?

Each workpaper — a file, a note or a link — is prepared by one auditor and reviewed by another; nobody reviews their own. Fieldwork completes only when every test is concluded and every workpaper reviewed.

What happens to audit findings after the report is issued?

Every finding that needs a corrective action becomes an issue in Issue & Remediation when the report is issued, assigned to the person management named and due on their date. It closes only when the lead auditor validates the fix.

Audit Management · Internal audit management software

Internal audit management, from the annual plan to a validated fix

The audit function's own workspace: the annual plan, fieldwork against the controls you already track, workpapers a second auditor reviews, findings answered by management, a report that never changes once issued, and every corrective action followed to a validated fix.

Start free See pricing

Included in Small business, Mid business, Large business, Dedicated Hosting

What Audit Management does

Planning

The year's audits in one plan, approved by an audit lead — anything added afterwards is marked unplanned until the plan is approved again
Each audit with its criteria (standards from your applicability register or your own), scope units, lead auditor, team, auditee contacts and dates
Late audits called out: fieldwork not started, a report past its due date

Fieldwork

A work programme generated from the controls you track for the standards in scope — with each control's latest recorded verdict and evidence beside the auditor's own conclusion, never written back
Workpapers as files, notes or links, indexed and prepared by one auditor and reviewed by another; nobody reviews their own
Fieldwork completes only when every test is concluded and every workpaper reviewed

Findings and the report

Findings written as condition, criteria, cause, effect and recommendation, rated on your own scale, with a link to the earlier finding they repeat
The auditee's management response — agree or dispute, who will fix it and by when — written by named contacts who need no more than Staff Access
The issued report is a snapshot: re-issued only as a new version with a reason, the earlier one kept

Corrective actions

Every finding that needs one becomes an issue in Issue & Remediation the moment the report is issued — assigned to the person management named, due on their date
Closed only when the lead auditor validates the fix; the finding and the audit read the issue's standing live
A dashboard of the plan, findings by rating, actions overdue and coverage by standard and unit; six printable reports with CSV

Audit Management: questions and answers

Does an internal audit use the controls we already track?: Yes. An audit's work programme is generated from the controls you track for the standards in scope, with each control's latest recorded verdict and evidence shown beside the auditor's own conclusion — which is never written back.
How are audit workpapers reviewed?: Each workpaper — a file, a note or a link — is prepared by one auditor and reviewed by another; nobody reviews their own. Fieldwork completes only when every test is concluded and every workpaper reviewed.
What happens to audit findings after the report is issued?: Every finding that needs a corrective action becomes an issue in Issue & Remediation when the report is issued, assigned to the person management named and due on their date. It closes only when the lead auditor validates the fix.

Works with

Every plan

Compliance management software

Compliance Tracker

Track recurring compliance obligations, assign owners and record the evidence, cycle by cycle.

Adopt controls from the Compliance Library — ISO 27001, SOC 2, GDPR, Sri Lanka PDPA and more — as your own editable copies
Cycles and assessments whose scope is fixed the moment they open
Coverage and maturity scoring, withheld below a coverage floor you set

More about Compliance Tracker

Small business and up

Issue and remediation tracking software

Issue & Remediation

Log what is wrong — gaps, findings, incidents — assign it to whoever has to put it right, and see it closed with evidence and a second pair of eyes.

Anyone can open a register and run it: its own severities with target days, categories, custom attributes and visibility
A due date from the severity, moved only with a reason that is logged
A ladder per register: overdue by so many days, escalate to the administrator, the Module Admins or a named person — worked out live, never stale

More about Issue & Remediation