These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- Audit Management
- Who it's for
- IT control assurance teams
IT control assurance teams
An IT control assurance team needs to connect the control being examined with the sample work and any corrective response. Audit Management provides engagement tests, findings and retest workpapers for that conversation. The Control Owner explains the operational change, while the Independent Assurance Reviewer records the evidence examined after the response.
How Audit Management is set up for you
Control description
Keep the description specific to the activity being reviewed, such as supplier account access changes. The Auditor selects that control when recording the sample under an engagement.
Evidence handling
Link a test workpaper or control policy to the record it supports. Confirm that the reviewer can open documents stored in the team's chosen repository before relying on those links during review.
Follow-up work
A corrective response names the finding or engagement it addresses. Retest evidence links back to the finding and control so the reviewer can explain what was examined after the change.
An IT control assurance team needs to connect the control being examined with the sample work and any corrective response. Audit Management provides engagement tests, findings and retest workpapers for that conversation. The Control Owner explains the operational change, while the Independent Assurance Reviewer records the evidence examined after the response.
Choose a bounded access review with evidence that the IT team can provide without exporting an entire identity directory. Define the assessment period and explain the sample in the engagement test. Prepare a finding that identifies a concrete issue, with a response date agreed by the participants.
Ask the Control Owner to prepare a Scheduled response with a reference to the operational change. The Audit Manager reviews the evidence before authorizing release. The Independent Assurance Reviewer then records a follow-up sample and a reasoned decision about the related finding or response.
Rehearse a document access failure and an inconclusive retest explanation. Agree how each is handled before broadening the pilot. Any connection to an identity platform or service desk belongs in the [integration setup](/audit-management/integrations); use [corrective response and retest](/audit-management/processes/response-and-retest) to practice the audit handoff.
Features to start with
Roles on the team
- Admin
- Maintains access configuration and the organization directories used during audit setup.
- Auditor
- Prepares assessment scopes, engagement tests and findings with linked evidence.
- Audit Manager
- Reviews finding support and authorizes corrective response release within the agreed audit scope.
- Control Owner
- Maintains control descriptions and prepares corrective responses for review.
- Independent Assurance Reviewer
- Examines retest evidence and records an independent review of the related finding or response.
Set up Audit Management your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.