Internal audit

• Pick the module you are auditing (SAMA, PCI DSS, ISO 27001…) using the module switcher at the top.
• Press “Draft audit universe” to let the engine group the module’s measures into auditable entities, or add entities yourself.
• Review each entity, adjust the risk scores (1–5) and the owning department, and delete anything that does not apply.

Result: A scored, deduplicated list of auditable entities for the year.

• Enter the audit days you have available for the year.
• Press “Draft annual plan” — the engine schedules the riskiest entities across quarters within that capacity.
• Edit titles, objectives, scope, out-of-scope, quarter and lead auditor, then save the plan.

Result: Approved engagements, each with objective, scope and a quarter.

• Select the engagement.
• Press “Draft evidence requests” to generate the prepared-by-client list, or add requests manually.
• Give every request an owner and a due date, upload the documents received, and mark each one sufficient or insufficient.

Result: A complete evidence file with owners, dates and sufficiency decisions.

• Select the engagement and press “Draft risk & control matrix”.
• For every line, read the test procedure and the evidence required, then record the test result (effective, partial, exception).
• Add tester notes — these become the workpaper record and feed the report.

Result: Tested controls. The report cannot be written until this step is done.

• Press “Draft findings” to convert failed and partial tests into structured findings, or add findings manually.
• Check the condition, cause, effect and recommendation, and set the rating.
• Assign an action owner, a target date and record the management response.

Result: Rated findings with agreed management actions.

• Select the engagement — the list shows how many tested controls and findings each one has.
• Press “Draft audit report”. If nothing happens, the engagement has no tested controls yet: go back to Execute.
• Review the opinion and every section on screen, then download it as PDF or Markdown.

Result: An audit-ready report, drafted by the engine and approved by you.

• Track outstanding, overdue, closed and risk-accepted actions.
• Update owners, target dates and status as the business responds.
• Draft a follow-up memo for escalations, owner reminders and the committee update.

Result: Evidence that findings were tracked to closure.

• Maturity is calculated from your test results and open findings — nothing to enter.
• Use the weakest-engagement list to shape next year’s universe scoring.

Result: A 1–5 maturity picture per engagement and overall.

• Run the regulation parser, control de-duplicator, evidence classifier, maturity scorer or workpaper writer on a chosen engagement.
• Every run is recorded with its inputs, outputs and who triggered it, so the trail stays auditable.

Result: Drafted content you review before using — never applied automatically.