Book a demo
Audit & assurance

Audit week, without the panic.

Plan the cycle years ahead, send a professional agenda, record findings by severity, show how you sampled, keep every piece of proof in one library and answer requests without the email chase. Each card below holds still while its steps play, then the next one takes its place.

Book a demo Watch the tour
92% audit-ready
Stage 2 audit starts in14 daysISO 27001 recertification
Evidence on file412 items38 collected automatically this week
Open findings3 NCRsAll with owners and due dates
Auditor requests18 / 18Answered, none by email
Before the audit · 1 of 6
Audit Programme

Plan three years of audits in one view

A multi-year audit calendar.

  1. Start an audit cycle (usually 3 years).
  2. Add entries: a quarter, a scope (for example "Access Control"), the assigned auditor, and an independence declaration confirming no conflict of interest.
  3. When a real audit happens, link it to the planned entry. One entry can link to several audits.
  4. An entry can only be marked completed once a linked audit is itself completed.
Q1
Q2
Q3
Q4
2026
Access controlDone
SuppliersDone
PhysicalIn progress
SurveillancePlanned
2027
IncidentsPlanned
CryptographyPlanned
SurveillancePlanned
2028
HR securityPlanned
RecertificationPlanned
Before the audit · 2 of 6
Audit Plan

Send a professional audit plan in minutes

The formal written agenda sent out before an audit.

  1. Open an audit's Audit Plan tab.
  2. Fill in the header (lead auditor, technical expert, interpreter, observer, your representative).
  3. Add sessions day by day: time, topic, attendees and auditors.
  4. Hours are totalled automatically per day and overall.
  5. Click Save, then Download PDF to send it.
09:00–09:30Opening meeting
All auditors1.0 h
09:30–12:30Clauses 4–6
Lead auditor3.0 h
09:30–12:30Annex A 8 · technology
Technical expert3.0 h
13:30–16:30Annex A 5 · organisation
Lead auditor3.0 h
Day 1 total10 auditor-hours
During the audit · 3 of 6
Audits & NCRs

Every finding tracked to closure

The place to record audits and the problems they find.

  1. Create an audit: type (internal, external, certification, surveillance), dates, scope, team. Assign a lead auditor and auditees.
  2. During the audit, raise NCRs: each with severity (Major, Minor, Observation), description, linked control, risk, vendor or asset.
  3. Assign an owner and due date. Record root cause and corrective action. When closed, the close date is stamped automatically.
  4. An Observation is a suggestion for improvement, not a failure, and is excluded from compliance counts.
  5. Overdue NCRs are flagged automatically. NCRs can also come from vendor evaluations, vendor document checks, integration findings or customer feedback, so you can always see where each one came from.
Majorcounts against scores

A requirement is not met at all, or the failure is systemic.

Minortracked to closure

An isolated lapse against a requirement.

Observationexcluded from NC counts

Not a failure: an opportunity to improve.

During the audit · 4 of 6
Audit Sampling Log

Show auditors exactly how you sampled

A record of how an auditor chose what to examine.

  1. In an audit's Sampling Log tab, add an entry: the population (for example "all NCRs raised in Q1–Q3"), its size, the sample size, the specific records examined, and findings.
  2. A suggested sample size button gives a quick starting figure that the auditor can override.
Suggested sample from 306
All year · 5 of 6
Evidence Repository

Every piece of proof, one search away

One searchable library of all proof across the platform.

  1. Evidence is uploaded from the record it supports (a control, risk, vendor, asset, policy, NCR…).
  2. Open the Evidence Repository to see everything in one place.
  3. Search, filter by module, download or delete.
  4. Each row shows what record it is attached to.
app / evidence
FileAttached toUploaded
backup-restore-q3.pdfControl 8.132 days ago
mfa-report.csvControl 5.17 · Oktatoday
dr-002-report.pdfBCP drill DR-0023 weeks ago
nda-cloudspan.pdfVendor documentlast month
During the audit · 6 of 6
Evidence Requests (Auditor Collaboration)

Answer auditor requests without the email chase

A structured "please send me proof of X" workflow between auditors and your team.

  1. An auditor (or manager) clicks New Request: title, what is needed, due date, who should respond, and optionally the related audit, NCR or control.
  2. The assignee gets an instant notification.
  3. They upload the proof and mark the request Fulfilled with notes, or Reject it with a reason.
  4. The requester is notified immediately. When satisfied, the request is Closed.
  5. If Jira or Slack is connected, requests can be pushed there too.
AuditorRequests evidenceLinked to an audit, NCR or control
OwnerNotified at onceIn the app and in Slack
OwnerUploads proofStored with the request
AuditorAccepts or rejectsRequester notified

Auditors stop asking where something is. Every finding, sample, request and file is one search away, linked to the control it proves.