Internal audit

The register at /audit/internal lists audits by name, framework, status, lead auditor, and audit date. Search and filter by framework or status; summary information also shows relevant calendar events.

Create an audit

Choose a framework and one of these audit types:

• Full audit: broad review of the selected framework and program.
• Focused audit: a deliberately narrowed scope for selected areas or concerns.
• Follow-up: verification that earlier findings or corrective actions were addressed.

Provide a clear name, instructions/scope, date, and lead auditor. The lead auditor can be an organization member or a named external person. Preserve independence appropriate to the program: assigning the control owner to audit their own work weakens assurance even if the software permits it.

Creating an audit can generate a draft report from available program context. Treat generated language as a starting structure. Verify every assertion against actual evidence and record sampling, interviews, exceptions, and conclusions explicitly.

Audit detail (/audit/internal/[id])

The report page lets authorized users edit audit metadata and report content, save work, download a PDF, and finalise the audit. Finalisation makes the report read-only and changes the audit to completed. Use Reopen to edit only through a controlled correction process; explain why a final report changed.

A defensible report normally identifies:

• objective, scope, criteria, period, and methodology
• auditor and participants
• evidence and samples reviewed
• findings, nonconformities, observations, and strengths
• owners, corrective actions, and due dates
• conclusion and approval/finalisation context

Create linked risks, findings, treatments, or tasks in their source registers so follow-up is operational, not trapped in report prose.