About

Audits is where you run a formal review of how well a framework, or a set of controls, is working. Each audit becomes a list of data requests, one for each framework requirement or control. You gather evidence for each request, evaluate it, and send it to the auditor when it's ready.

Super Admins and Compliance Managers create audits, edit them and manage their data requests. Contributors can't open Audits.

Open the audits list

To see your audits:

1. Pick a framework in the framework switcher, or leave All Frameworks selected.
2. In the framework section of the sidebar, select Audits. It sits between Evidence and Reports.

With All Frameworks selected, the page lists every audit. With one framework selected, it lists only that framework's audits and shows a Program filter chip with a Clear All option.

The list has these parts:

• All, Active and Completed tabs. Active and Completed split audits by whether they have been marked completed.
• A count of audits, such as "Showing 4 audits", and a Search audits box. Search matches the audit name, owner, type, status and framework name.
• Columns: Audit, Framework, Owner, Audit progress and Date (start and end).
• A row menu (the three dots) for managers, with Edit audit, Mark completed, Upload data requests and Delete.

Audit progress is a bar. Point at it to see "N% tested · N open", or "Tests not started · N open" before any test result is recorded. Open counts data requests that are Not Started, In Progress, In Review or With Auditor.

If nothing matches, the page shows "No audits found".

Create an audit

You can start an audit in three ways, shown as cards in the "Start an audit" window:

• Audit a framework: one data request for each requirement of the framework.
• Audit a control set: one data request for each control.
• Third party audit: an audit built from your auditor's own list of requests, which you upload as a CSV file.

To create an audit:

1. On the Audits page, select Create Audit.
2. Select a card. A side panel opens, titled with the card's name.
3. Fill in the fields: Audit name (up to 150 characters), Frameworks (or Control sets for a control set audit), Owner, optionally Auditors, and Start date and End date. The owner must be a Super Admin or a Compliance Manager.
4. For a framework audit, a Scope section lists each framework's scope levels. Select Only include in scope requirements for the framework, or pick specific levels.
5. Optionally, tick Include all linked evidence documents uploaded during the audit period and Include all linked action items. Both need a start date and an end date.
6. Select Create audit.

A framework or control set audit gets its data requests straight away and opens once it's created. For a third party audit, the "Upload data requests" window opens next: choose the CSV file of your auditor's request list and select Upload requests.

If you have one framework selected in the switcher, the audit is created for that framework. A framework that already has an unfinished audit can't be chosen. Complete the existing audit first.

Change an audit

To change an audit's details:

1. On the Audits page, open the row menu for the audit and select Edit audit.
2. Change the name, audit period, the two Include options, scope, auditors or owner.
3. Save your changes.

If you change the scope, the "Update audit scope?" window asks you to confirm first. Changing scope adds some data requests and removes others, and it permanently deletes what was linked to the removed ones.

Open an audit and find your data requests

Select an audit's name in the list to open it. The page shows the audit's name, a summary strip and two tabs.

The summary strip shows:

• Owner
• Start date and End date
• Data requests, the total number
• Approved
• With auditor

Data Requests tab

This tab lists every data request in the audit. The toolbar has:

• Search data requests
• Filter, with Owner, Auditor, Status, Audit status, Is mapped (Mapped or Unmapped), Class and Categories
• Display, to choose which columns show
• Export All, which downloads the audit's data requests as a spreadsheet
• New data request

The table shows these columns: Request (the code and description, such as "ER-1-GV.OC-01: ..."), Owner, Auditors, Requirements, Status, Audit status and Test result. Class and Category are hidden until you choose them in Display, and both can be sorted.

Tick one or more rows to change many requests at once. A bar appears with Owner, Auditors and Delete for the selected rows.

Additional Artifacts tab

This tab holds files and reports attached to the whole audit, and it shows how many there are. It has:

• Upload Artifacts, for pdf, doc, docx, xls, xlsx, csv, png, jpg, jpeg and zip files
• Link Generated Reports, to attach a report you've already generated in Reports

Each item in the table has a delete action.

Add a data request

Framework and control set audits already include one data request per requirement or control. To add another:

1. On the Data Requests tab, select New data request.
2. Enter a Request description. This is required.
3. Optionally set the Owner and Auditors, and choose the Framework Objectives to map it to.
4. Select Create request.

For a third party audit, you can also bring in requests from a CSV file: on the Audits page, open the audit's row menu and select Upload data requests.

Work a data request

Select a request's code to open it in a side panel. Use Prev and Next at the top to move between requests. The panel has five tabs.

The tabs are:

• Properties: Status, the Submit to auditor button, Owner, Auditors, Audit status, Class and Category.
• Quick evaluation: your assessment of the request (details below).
• Evidence & mappings: the evidence for the request.
• Comments: a comment thread on the request.
• Activity: the request's history.

Set the status

On the Properties tab, use Status to show where the request is. The choices are Not Applicable, Not Started, In Progress, In Review and Completed. A request shows With Auditor after you submit it to the auditor.

Add evidence

On the Evidence & mappings tab you can:

• Select Upload files as evidence to add new files.
• Select Attach existing evidence to use evidence you already have.
• Review the mapped requirement ("Framework objective details") or the mapped controls ("Control evidence and documents").

If the request isn't mapped to anything, the tab shows "No mapped requirements". Evidence linked to the objective can also come in automatically when you tick the Include options on the audit.

Complete a quick evaluation

The Quick evaluation tab asks "Does the company meet all objectives of this control/framework requirement?" and has these parts:

• Three answers: Not met, Met with exceptions and Met.
• Automated test, which shows the result of the automated test.
• Design and implementation: Not acceptable, Acceptable with recommendations or Acceptable.
• Operational status: Not functional, Functional with exceptions or Functional.
• Quality of evidence: Not adequate, Partially adequate or Adequate.
• Text boxes for the interview, examine and test approach, notes and corrective actions, and findings.

Select Reset Answers to clear the evaluation. You're asked to confirm in the "Reset evaluation" window first.

Preview as auditor

Preview as auditor lets you see the audit with the manager controls hidden. It's a read-only look and doesn't sign you in as an auditor.

To preview an audit:

1. Open the audit and select Preview as auditor.
2. Look through the Data Requests and Additional Artifacts tabs. The summary strip, Filter, Export All and New data request are hidden.
3. Select Exit auditor preview to go back to the manager view.

In the preview, the Audit status and Send to customer controls are shown but disabled. They display "Only an auditor can change the audit status or send this request to the customer."

Submit a data request to the auditor

When the evidence for a request is ready, send it to the auditor. Before you can, a request needs two things:

• Its Status is set to Completed.
• At least one auditor is assigned to it.

To submit a request:

1. Open the data request and go to the Properties tab.
2. Set Status to Completed.
3. In Auditors, choose at least one auditor. Super Admins, Compliance Managers and users with the Auditor role can be chosen. Without an auditor the button is disabled and reads "Assign an auditor before submitting".
4. Select Submit to auditor. Until the status is Completed, the hint beside the button reads "Update status to Completed to submit to auditor." Once it's ready, the hint reads "Ready to submit to auditor."

A message confirms "Request sent to auditor." The request's Status changes to With Auditor and its Audit status changes to Submitted. The With auditor number in the audit's summary strip counts requests in this state.

Complete an audit

When the audit is finished:

1. On the Audits page, open the audit's row menu and select Mark completed.
2. In the "Complete audit?" window, select Complete audit. The window tells you the audit will appear under the Completed filter.

The audit moves to the Completed tab.

Delete an audit

To remove an audit, open its row menu, select Delete and confirm in the "Delete audit?" window. This can't be undone.