← All capabilities

6 capabilities

Internal Audit

The full engagement lifecycle, from a risk-based plan to a closed finding

The problem

The audit lifecycle is where methodology either holds or quietly erodes. Plans drift from the risk register, engagements close without the evidence that justified their conclusions, findings are agreed and then never verified. None of that shows up until a quality assessment or a regulator goes looking.

How it works

01

Audit Universe & Planning

A scored auditable-entity universe that generates the annual plan from the risk register

  • Auditable entities are scored and maintained as a universe, not rebuilt each planning cycle
  • The annual plan generates from that scoring, so coverage decisions are defensible against risk rather than habit
  • Cycles and methodologies are held against entities, which is what lets you answer how long it has been since an area was last looked at
02

Engagements & Fieldwork

Lifecycle gates, audit programmes from a template library, sampling, and PBC evidence requests

  • Status moves through a defined transition matrix rather than a free-text field, so an engagement cannot jump from planning to closed
  • Closing requires a minimum evidence threshold. A zero-work engagement used to be able to close clean; it cannot now
  • A closed engagement is write-guarded, so the record of what was concluded stays what was concluded
  • Programmes come from a template library, and sampling captures method, confidence level and tolerable misstatement or error rate on the plan itself
  • Evidence requests function as a PBC list with an assignee and a status per item, rather than a chased email thread
03

Working Papers

Versioned papers with attachments, preparer and reviewer sign-off, and a locked vault on close

  • Papers are versioned with attachments held against the version they belong to
  • Preparer and reviewer sign-off are separate acts by separate people
  • On close, papers move to a locked vault, which is what makes the file defensible months later
04

Findings & Actions

Findings with management responses, action tracking, follow-up verification and aging escalation

  • Findings carry a management response, an agreed action with an owner and a due date, and the decision trail behind them
  • Follow-up is a verification step, not a status change, so closure means someone checked
  • Ageing drives escalation automatically against rules you configure, rather than depending on someone noticing
05

Quality Assurance (QAIP)

IIA 1300-series conformance ratings with gap evidence and improvement actions

  • Built against the IIA 1300 series, with conformance rated at the standard level
  • Gaps carry their evidence and generate improvement actions that are tracked like any other action
  • Assessment types cover both internal self-assessment and external quality assessment
06

Time, Budget & Scheduling

Timesheets, expenses, engagement budgets against actuals, and team resource allocation

  • Time entries roll into timesheets, and expenses are captured against the engagement that incurred them
  • Engagement budgets are tracked against actuals, which is what turns a resourcing conversation into a numbers conversation
  • Resource allocation across the team shows who is committed where before you commit them again

What it produces when someone asks for proof

An annual plan traceable back to the risk register that produced it

Engagements that cannot close without meeting a minimum evidence threshold

Working papers with preparer and reviewer sign-off, locked on close

Findings with management responses, owners, dates and verified closure

The rest of the platform

GRC

6

The risk register, the obligations that bind it, and the controls that answer them

Resilience & Conduct

5

What happens when a risk materialises, and the conduct obligations around it

Intelligence & Monitoring

7

Continuous assurance over live operational data, not a point-in-time sample

Workflow & Governance

7

How work gets routed, approved and proven across every module

Reporting & Analytics

3

What the work produces, for the people who have to act on it

Want this mapped against your terms of reference? We will go through it line by line, and tell you plainly where it does not yet reach.

Request a demo