Solution · Internal audit engagements
09

Internal audit on the same graph, behind its own wall.

The audit universe, annual plan, engagements, and workpapers sit on the same graph as the controls being audited, and the auditee never sees past the independence wall.

ForInternal audit
SurfacesUniverse & plan · Engagements · Workpapers · Findings
The shape of the problem · 01

What this actually feels like.

  • 01The audit universe is a spreadsheet that drifted away from the control library years ago.
  • 02Workpapers sit on a shared drive with no link to the controls they test.
  • 03Auditors work in the same tools as the people they audit, so independence rests on trust.
  • 04Drafting the findings and the risk-and-control matrix eats the week after fieldwork.
How Zovos handles it · 02

Five steps, one graph.

Every step writes back to the same controls, policies, and issues your team already owns. There is no second source of truth.

  1. 01
    Plan
    Build the audit universe and the annual plan on the same graph as the controls, risks, and programs they cover, so coverage is derived instead of kept in a parallel spreadsheet.
  2. 02
    Request
    Send PBC audit requests to auditees. They see only the requests addressed to them and their own management responses, never the workspace, plan, or workpapers.
  3. 03
    Fieldwork
    Work each engagement in one workbench, with workpapers linked to the controls being audited and aligned to IIA GIAS 2024.
  4. 04
    Draft
    Workpaper, finding, and RCM drafters do the first pass, proposing findings, root causes, and control mappings. The auditor reviews and signs every draft.
  5. 05
    Report
    Findings flow into the governed findings queue for remediation. Sign-off independence is enforced, so an internal-audit principal cannot approve a decision it may later audit.
What changes · 03

What the product does instead.

Coverage
The annual plan shows coverage derived from the real control and risk estate.
Independence
It is enforced at sign-off and by the wall, not by policy alone.
Drafting
Agents draft workpapers, findings, and the RCM. An auditor signs.
Standards
Engagements map to IIA GIAS 2024, one of the 54 frameworks in the corpus.
Related scenarios · 04

If this is your Friday, these are too.

03

Audit prep & evidence

Continuous evidence with paragraph-level citations, owner attestations, and an exportable packet for every framework you have to answer to.

Read the scenario→
06

Issue & finding management

Every gap, exam finding, failed test, and self-identified issue lands in one governed queue with its citation, owner, SLA, and the evidence it needs to close.

Read the scenario→

Want to see this on your library?

Bring a control library, a policy, and one regulator paragraph that gives you trouble. We target two-week onboarding.

Talk to the team →All solutions