Audit Engagements

Manage compliance audits from preparation to completion.

Overview

Audit Engagements helps you:

• Plan and track audit activities
• Manage auditor access and requests
• Collect and organize evidence
• Track audit findings and remediation
• Generate audit-ready reports

Navigate to Audits in the sidebar.

Audit Types

Internal Audits

Self-assessments and internal reviews:

• Security assessments
• Policy compliance checks
• Control effectiveness testing
• Gap analysis

External Audits

Third-party auditor engagements:

• SOC 2 Type I/II
• ISO 27001 certification
• PCI-DSS assessment
• HIPAA audits
• Regulatory examinations

Creating an Audit

New Audit Engagement

1. Go to Audits → Create Engagement
2. Enter audit details:
   • Audit name
   • Type (Internal/External)
   • Framework (SOC 2, ISO, etc.)
   • Audit period start/end
   • Auditor/firm name
3. Set key milestones
4. Click Create

Audit Details

Field	Description
Name	Audit engagement name
Type	Internal or External
Framework	Compliance framework
Period	Audit period dates
Status	Planning, In Progress, Complete
Lead	Internal audit lead
Auditor	External auditor/firm

Audit Workflow

Phases

Planning → Fieldwork → Reporting → Remediation → Close

1. Planning Phase

Prepare for the audit:

• Define scope and objectives
• Identify key controls
• Gather preliminary evidence
• Schedule auditor meetings
• Assign internal resources

Checklist:

• [ ] Confirm audit scope
• [ ] Identify in-scope systems
• [ ] Assign control owners
• [ ] Prepare evidence inventory
• [ ] Schedule kickoff meeting

2. Fieldwork Phase

Active audit period:

• Respond to auditor requests
• Provide evidence
• Facilitate testing
• Address preliminary findings

Auditor Activities:

• Control testing
• Evidence review
• Walkthroughs
• Interviews

3. Reporting Phase

Receive and review results:

• Draft report review
• Management response preparation
• Final report delivery

4. Remediation Phase

Address audit findings:

• Create remediation tasks
• Assign owners
• Track progress
• Provide evidence of remediation

5. Close Phase

Complete the engagement:

• Final report accepted
• Remediation verified
• Lessons learned documented
• Archive engagement

Evidence Requests

Managing Requests

When auditors request evidence:

1. Go to Audits → [Engagement] → Requests
2. View pending requests
3. Click request to see details
4. Upload or link evidence
5. Submit for auditor review

Request Status

Status	Description
Pending	Awaiting response
Submitted	Evidence provided
Accepted	Auditor approved
Rejected	Auditor needs more info
Closed	Request complete

Request List

Open Requests: 8

Due Today (2):
- CC6.1: Access control policy
- CC6.3: User access review

Due This Week (4):
- CC7.1: Vulnerability scan results
- CC7.2: Incident response plan
- CC8.1: Change management process
- CC9.1: Risk assessment

Due Later (2):
- CC1.1: Board meeting minutes
- CC2.1: Communication policy

Bulk Response

Respond to multiple requests:

1. Select related requests
2. Click Bulk Response
3. Upload evidence covering multiple requests
4. Map evidence to requests
5. Submit all

Auditor Portal

Professional Feature

Auditor Portal requires Professional or Enterprise plan.

Portal Access

Grant auditors read-only access:

1. Go to Audits → [Engagement] → Access
2. Click Invite Auditor
3. Enter auditor email
4. Set permissions
5. Send invitation

Portal Features

Auditors can:

• View assigned controls
• Submit evidence requests
• Review submitted evidence
• Add comments/questions
• Mark requests complete

Access Levels

Level	Capabilities
Viewer	View evidence only
Reviewer	View + comment
Requester	View + comment + request

Audit Findings

Finding Types

Type	Description
Observation	Minor issue, informational
Finding	Control deficiency
Exception	Instance of non-compliance
Material Weakness	Significant control failure

Tracking Findings

1. Go to Audits → [Engagement] → Findings
2. View all identified findings
3. Click finding for details
4. Assign remediation owner
5. Track to resolution

Management Response

Document your response to findings:

1. Open finding
2. Click Management Response
3. Add response:
   • Root cause
   • Remediation plan
   • Target date
   • Responsible party
4. Submit response

Remediation Tracking

Finding: Access Review Frequency

Status: In Remediation
Owner: Jane Smith
Target: Feb 15, 2026

Progress:
[✓] Root cause identified
[✓] Remediation plan approved
[ ] Technical implementation
[ ] Documentation update
[ ] Verification testing

Reporting

Audit Dashboard

View audit status at a glance:

SOC 2 Type II Audit 2026

Status: Fieldwork (65% complete)
████████████████████████░░░░░░░░░░░░░░ 65%

Timeline:
Jan 15 - Kickoff ✓
Feb 1  - Fieldwork Start ✓
Mar 1  - Fieldwork End (in progress)
Mar 15 - Draft Report
Apr 1  - Final Report

Requests: 45 total
├── Accepted: 30 (67%)
├── Submitted: 10 (22%)
└── Pending: 5 (11%)

Status Report

Generate status report:

1. Click Reports → Audit Status
2. Select engagement
3. Choose sections
4. Generate PDF

Evidence Package

Create comprehensive evidence package:

1. Go to Audits → [Engagement] → Package
2. Select controls and evidence
3. Add table of contents
4. Include metadata
5. Generate package

Package includes:

• Cover page
• Control matrix
• Evidence documents
• Collection metadata
• Chain of custody

Audit Calendar

Timeline View

View all audit activities:

January 2026
─────────────────────────────────────────────────
Week 1: SOC 2 - Kickoff meeting
Week 2: SOC 2 - Control testing begins
Week 3: ISO 27001 - Pre-assessment
Week 4: PCI-DSS - SAQ completion due

Milestones

Track key dates:

Milestone	Date	Status
Audit Kickoff	Jan 15	Complete
Evidence Request Deadline	Feb 15	Pending
Fieldwork Complete	Mar 1	Upcoming
Draft Report	Mar 15	Upcoming
Final Report	Apr 1	Upcoming

Reminders

Receive notifications for:

• Upcoming milestones
• Overdue requests
• Response deadlines
• Finding due dates

Multi-Framework Audits

Combined Audits

Manage audits covering multiple frameworks:

1. Create engagement
2. Select multiple frameworks
3. Map shared controls
4. Evidence used for all frameworks

Efficiency Benefits

Control: Access Reviews

Maps to:
- SOC 2 CC6.2 ✓
- ISO 27001 A.9.2.5 ✓
- PCI-DSS 8.1.4 ✓

One evidence set, three frameworks!

API Access

# List audit engagements
GET /api/v1/audits?status=in_progress

# Get engagement details
GET /api/v1/audits/{audit_id}

# Create engagement
POST /api/v1/audits
{
  "name": "SOC 2 Type II 2026",
  "type": "external",
  "framework": "soc2",
  "period_start": "2025-01-01",
  "period_end": "2025-12-31",
  "auditor": "Example CPA Firm"
}

# List evidence requests
GET /api/v1/audits/{audit_id}/requests

# Respond to request
POST /api/v1/audits/{audit_id}/requests/{request_id}/respond
{
  "evidence_ids": ["evidence_123", "evidence_456"],
  "notes": "Please see attached documents"
}

See API Reference for full documentation.

Best Practices

1. Start Early: Begin preparation 2-3 months ahead
2. Assign Owners: Each control needs an owner
3. Organize Evidence: Keep evidence organized year-round
4. Communicate Clearly: Regular updates to auditors
5. Track Everything: Document all interactions
6. Learn from Findings: Address root causes
7. Automate Collection: Use automated evidence where possible