Audits and findings

An audit records its scope, planned date, assigned auditor and reporting status. Findings under the audit identify the requirement, describe the issue, classify severity, assign an owner and carry a due date. The audit may progress from Planned to in progress, Reporting and Closed while the findings retain their own dates and closure information.

• Plan the audit. Auditor records the scope, planned date and assigned auditor.
• Describe the requirement. Record the finding text, severity, owner and due date under the right audit.
• Check closure separately. The audit status and a finding’s close date answer different questions; inspect both during reporting.

Agree how auditors state the requirement being assessed and how the finding text distinguishes an observation from a Major issue. An owner should be able to understand what has to be addressed and when. The auditor should review outstanding finding due dates before treating the audit report as complete.

Auditor should compare the finding’s audit reference with the planned scope before assigning follow-up. A finding due today may already have a close date, so inspect that date before calling it outstanding. Agree when the audit itself enters Reporting and when its completed date is recorded. The finding owner needs a clear requirement and a due date to act.

Plan an audit for a named scope and assign an auditor. Record a requirement finding with a Major severity, a person owner and a due date. Move the audit to Reporting, then inspect the finding as the due date approaches. Open the linked audit to check its number and scope, then use the finding’s close date to trace its outcome.

Ask the person receiving the work to open the record without extra explanation. They should be able to tell what the current state means, which evidence supports it, and what decision they are expected to make. If they cannot, revise the entry and repeat the handoff with the same case.

When a finding has a close date, open the audit reference before treating it as resolved for reporting. The due-date screen includes dated findings even when that close date is present. Auditor should use the finding and its linked audit together to explain what was assessed, who owned the follow-up and when it ended.

• Audit findings due — Auditors can inspect findings whose due dates have arrived, including ones with a close date.
• Draft documents for review — Admin can prepare document versions for a separate review.

See the related process for the handoff, decision and rehearsal. Review roles before granting access and the data model when preparing records.