Privileged access remained active 6 days after exit.
Applications · Audits & compliance
Evidence gathered all year. Not the week the auditor lands.
A control library mapped to your own hierarchy, tests that run on a schedule, field and process audits captured on mobile with proof, and findings that carry an owner, a due date and a closure someone verified. The trail is the product.
control library · frameworksScheduled testing & samplingMobile audit with proofFindings with verified closure
One control · objective to verified closurePopulation, sample, evidence, finding and CAPA retain lineage before an assurance opinion changes.CTL-118 · S-03 · FND-203 · CAPA-118-1
Population248→Eligible236→Sample24→Exceptions2
14:22•••
Source matched · sample seed retained.
CTL-118 remains open; opinion unsigned.
CAPA-118-1 remains proposed.
The assurance opinion is the end of an evidence chain, not the start of a report.
CTL-118 carries its objective, population, sample method, evidence, exceptions and CAPA in one trail, so a committee number can always reach its source.
State the control objective.
CTL-118 retains owner, frequency, scope and mapping before any sample is drawn.
Preserve population and method.
Eligibility, strata, sample seed and evidence lineage remain attributable.
Keep the finding open.
FND-203 carries risk, owner, due date and prepared response without closing by workflow.
Close only on later evidence.
CAPA-118-1 needs Meera’s independent verification before the assurance opinion changes.
What changes
Move from audit-season chasing to continuous evidence discipline.
Every organisation has the checklist. What it usually lacks is the evidence at the moment it is asked for, and a finding that closed because something changed rather than because a quarter ended.
Control library
The SaaS playbook
→A framework spreadsheet, mapped once.
Rebuilt agentic
Controls mapped to your entities, processes and owners, with one control satisfying several frameworks: tested once, reported many times.
Evidence collection
The SaaS playbook
→An email to twelve people, three weeks before the audit.
Rebuilt agentic
The collector agent requests evidence on the control's own schedule and takes it from the system of record where it can: so the ask is smaller and earlier.
Testing
The SaaS playbook
→A sample pulled by hand and tested in a workbook.
Rebuilt agentic
Sampling rules per control, automated tests where the data allows, and manual test steps with working papers: the sample and the method are both recorded.
Field & process audit
The SaaS playbook
→A paper checklist, typed up on return.
Rebuilt agentic
Audit checklists on mobile with geo-verified visits, photographs and scoring, so a store or plant audit arrives scored and evidenced before the auditor is home.
Findings & remediation
The SaaS playbook
→An observation log, chased by the audit team.
Rebuilt agentic
Findings carry a rating, an owner, a due date and an agreed action; overdue ones escalate the hierarchy and closure needs verified evidence.
Reporting
The SaaS playbook
→A committee pack, assembled manually.
Rebuilt agentic
The audit committee view is live: control health, open findings by ageing and risk, with every number drilling to its evidence.
Every conclusion can drill back to its population, sample and source.
The response and CAPA are prepared against retained evidence. Devika owns the response; Meera owns the assurance opinion and later closure verification.
Control 360
2 exceptionsQuarterly privileged-access recertification
01 Jul–30 Sep · ERP production · CRM admin · Identity platform
EV-772 · Access active 6 days after exit
EV-775 · Review attestation 9 days late
EV-781 · Role and approval align
EV-786 · Quarterly attestation retained
EV-790 · Owner and vault log align
EV-793 · Access still role-appropriate
Current · 248 privileged identities before exclusions
Current · 12 non-interactive accounts separately tested
Source matched · Deprovisioned 6 days after recorded exit
9 days late · Reviewer attested after due date
Pinned · Request, role and owner approval align
High · Owner response · 08 Oct
Moderate · Response due · 10 Oct
Ishan Mehta · Evidence attached
Nandita Bose · HRIS · Drafted
Meera Joshi · Assurance · Awaiting period
A finding response that retains the evidence and the assurance boundary.
Devika sees the control record, exception, source, consequence, prepared response and named assurance action at working scale.
Privileged-access recertification
Leaver access revoked six days late.
Closure requires later evidence verification.
No finding closes automatically.
14:225G
Access active 6 days after exit.
Source matched · Q3-14 sample retained.
Control and assurance opinion remain open.
Meera Joshi remains assurance authority.
The audit function, generated.
Internal audit, quality, statutory compliance, franchise and vendor audits run the same machinery with different libraries. Control, request, working paper, finding, CAPA and board view remain joined by evidence lineage.
Control library
Controls with owners, frequency, risk rating and multi-framework mapping: one control answering ISO, SOC 2 and internal policy at once.
map once · report manyCompliance calendar
Statutory and internal obligations with due dates, responsible owners, escalation on overdue, and filing evidence attached.
obligation · due · evidenceAudit planning
Annual plan by risk, auditable entity and coverage, with resource allocation and a scope document per engagement.
risk-based · scope · coverageEvidence requests
Scheduled requests to named owners with reminders, acceptance or rejection with a reason, and re-request on rejection.
schedule · remind · acceptTesting & working papers
Sampling rules, test steps, working-paper attachment and reviewer sign-off with the four-eyes rule enforced.
sample · paper · four eyesMobile field audit
Checklists with scoring, geo-verified visits, photographic evidence and offline-tolerant capture for stores, plants and branches.
score · geo · photoFindings & CAPA
Ratings, agreed actions, owners and due dates; corrective and preventive actions tracked to verified closure.
capa · verify · re-openCommittee reporting
Live control health, findings ageing, repeat-finding detection and a board pack that drills to the underlying evidence.
ageing · repeat · drillGoverned assurance lane
A finding that closes on evidence, or does not close.
The collector can request and the tester can prepare. The auditor rates the finding, the owner responds, and closure waits for independent evidence verification.
“show findings overdue by more than 30 days, by owner and by control”
Three agents on the trail. The opinion stays the auditor's.
Agents collect, test, chase and connect. The control response, finding rating and assurance opinion stay human.
Requests evidence on schedule, pulls what the system already holds, and chases only what is genuinely missing.
auditor accepts or rejects each itemRuns automated tests where data allows, draws the sample where it does not, and records the method used.
method and sample both recordedTracks agreed actions to their due dates and escalates the overdue up the real hierarchy.
closure needs verified evidenceSpots findings that have been raised before, across entities and years, and links them for the committee.
repeats are flagged, not merged
Bring one control. Watch a year of evidence get scheduled.
A 90-minute working session: your control library, testing calendar and finding workflow drafted as an FRS, approved, and generated to a staging tenant with the mobile audit checklist live.
For your technical team
Audit is meta on the platform: controls reference the same processes your operational applications run, evidence is retained under your residency policy, and every test is attributable to the policy version in force at the time.