Audit Management Module

Import from Master List

Start with industry best-practice lists. Click "Import from Master List" to import standard auditable items for each category. This ensures comprehensive coverage.

Add Custom Items

Add organization-specific items unique to your business. Click "Add Custom Item" and specify the category (People/Process/Technology).

Link to KPIs

For each universe item, link relevant KPIs. This enables automated risk calculation - when KPIs breach thresholds, the linked universe items receive higher risk scores.

Calculate Risk Scores

Click "Calculate Risk" for each item. The system considers:

• Linked KPI performance (variance from targets)
• Inherent risk factors
• Control effectiveness (if controls are mapped)
• Recent audit findings

Create New Plan

Click "Create New Plan". Enter the plan year (e.g., 2024) and a descriptive title (e.g., "2024 Internal Audit Plan").

Add Audit Projects

Click "Add Project to Plan". For each project:

• Select Universe Item: Choose the auditable entity
• Project Name: Descriptive title for the audit
• Risk Assessment: Based on universe item risk score
• Timeline: Planned start and end dates
• Resource Allocation: Assigned auditors

Balance the Plan

Ensure your plan covers:

• High-risk areas: Priority coverage
• Regulatory requirements: Mandatory audits
• Management requests: Special investigations
• Rotation: Ensure all areas audited over 3-year cycle

Review and Approve

Submit the plan to Audit Committee for approval. Update plan status from "Draft" to "Approved" once ratified.

Define Checklist Header

Enter checklist title (e.g., "IT General Controls Audit Program"), category, and description.

Add Checklist Items

For each audit step:

• Item Text: Clear instruction (e.g., "Verify user access reviews are conducted quarterly")
• Audit Questions: Detailed questions to ask
• Control Link: Map to specific control if applicable
• Expected Evidence: What to collect

Set Response Options

Define how auditors will respond:

• Passed: Control operating effectively
• Failed: Control deficiency identified
• Not Testable: Cannot test (document reason)
• Exception: Exception noted
• Pending: Awaiting evidence

Review and Publish

Review checklist for completeness. Set as "Latest Version" to make it available for engagements.

Link to Annual Plan

Select the annual plan this engagement belongs to. This maintains traceability from plan to execution.

Define Engagement Details

Enter:

• Title: Clear engagement name
• Auditable Unit: From audit universe
• Objectives: What the audit aims to achieve
• Scope: Boundaries and coverage
• Dates: Start and end dates
• Lead Auditor: Engagement owner

Select Audit Approach

Choose one:

• Framework-Based: Use pre-defined framework (e.g., COBIT, ISO 27001)
• Checklist-Based: Use existing checklist from library
• Custom: Create engagement-specific procedures

Assign Audit Team

Add team members to the engagement. Multiple auditors can work on the same engagement with different responsibilities.

Set Engagement Phase

Initial phase is typically Planning. Update as engagement progresses through fieldwork, review, and reporting.

Access Audit Checklist

Navigate to the engagement and open the assigned checklist. Each checklist item represents an audit procedure to perform.

Perform Testing

For each checklist item:

• Execute the audit procedure as described
• Ask the audit questions listed
• Review the evidence requested
• Document your work in auditor notes

Record Test Results

Select the appropriate result:

• Passed: Control operating effectively, no issues
• Failed: Control deficiency identified
• Not Testable: Cannot perform test (document why)
• Exception: Exception noted but not necessarily a failure
• Pending: Awaiting additional evidence

Upload Evidence

Attach supporting documentation:

• Screenshots
• Policy documents
• Process flows
• Interview notes
• System reports

Create Findings (if needed)

When a control fails or deficiency is identified:

• Click "Create Finding" from the failed checklist item
• Document using 5 C's (Condition, Criteria, Cause, Consequence, Corrective Action)
• Assign risk score (Impact × Likelihood)
• Assign to auditee for response

Select Report Type

Navigate to Reporting and choose the report type: Engagement Report, Audit Committee Report, Findings Summary, or Custom Report.

Choose Template

Select from available report templates. Templates define the structure, sections, and formatting of the report.

Set Filters

Apply filters such as:

• Date range
• Engagement(s) to include
• Finding status (Open/Closed)
• Risk level (High/Medium/Low)
• Business unit or department

Preview and Export

Preview the report, make any necessary edits, then export to:

• PDF: For distribution and printing
• Word: For further editing
• Excel: For data analysis

Risk-Based Planning

Prioritize audits based on risk scores from the audit universe. High-risk items should be audited annually, medium-risk every 2 years, low-risk every 3 years.

Standardized Programs

Develop comprehensive checklists for recurring audit types. This ensures consistency and reduces planning time for repeat engagements.

Quality Review

Implement supervisor review for all findings before sending to auditees. This ensures findings are well-documented, fair, and actionable.

Timely Reporting

Issue draft reports within 5 business days of fieldwork completion. Final reports should be issued within 10 business days of management response.

Follow-Up Tracking

Monitor finding remediation progress monthly. Escalate overdue findings to senior management. Close findings only after verification of implemented controls.

Continuous Improvement

Conduct post-audit reviews to identify lessons learned. Update checklists and methodologies based on feedback. Track audit cycle time and efficiency metrics.