Audit Hub: running an audit from start to finish

Interactive tutorial

Follow the course step by step in the interactive player.

Lessons

1. 1Find your way around the Audit HubThis lesson is for the person who runs audits. You will open the Audit Hub, read what it shows before any audit exists, and find the three places you will use most: the list of audits, the New Audit button and My requests.3 min
2. 2See who can work on audits, and give one more person read accessThis lesson is for the administrator who manages access. You will open the Access section of the Audit Hub, read who can view, create, edit and approve audits for this entity, and give the legal counsel read-only access to audits until the fieldwork is over.5 min
3. 3Put evidence you already hold into the Evidence VaultThis lesson is for the person who prepares the audit. Before the audit starts, you will store two documents you already hold in the Evidence Vault, so that they are sealed, dated and ready to be reused when the audit asks for them.6 min
4. 4Create an audit: every field of the Scope stepThis lesson is for the person who runs the audit. You will start a new audit and fill in the Scope step field by field: the name, the type, the department, the period, how often it repeats, and notes for the team.5 min
5. 5Add your policy and checklist, then start the AI mappingThis lesson is for the person who runs the audit. You will open the draft audit, add the policy that is being audited and the checklist you already use, remove a file added by mistake, and select Finish setup so that ComplianceOS reads the documents and builds the list of auditable points.6 min
6. 6Review what the AI found, correct it and confirm the checklistThis lesson is for the person who runs the audit. You will review the auditable points the AI mapper took from the policy, change a risk level, reword, confirm and dismiss points, tidy the checklist, read the gaps, and then confirm the mapping so the checklist is locked and the requests can be assigned.8 min
7. 7Assign each request to a person and send the requests outThis lesson is for the person who runs the audit. You will give each request for proof to the person who holds the evidence, across finance, human resources and compliance, set due dates, assign the rest in one go, and dispatch the requests so that everyone is notified and the audit starts.7 min
8. 8As an assignee: answer an audit request and attach a fileThis lesson is for anyone who is asked for audit evidence. As Rashid Karim, the finance manager, you will find the request in your notifications and in My Actions, open it, write your answer, attach the file that proves it, submit, and read the result of the automatic check.6 min
9. 9Review answers: accept good proof and ask for changesThis lesson is for the person who runs the audit. On the Validate step you will read the numbers and filters, open an answer, download its file, read the AI assessment, accept good proof so that it is sealed in the Evidence Vault, and send a weak answer back with a note that tells the assignee what to fix.8 min
10. 10As an assignee: add what the reviewer asked forThis lesson is for an assignee whose answer was sent back. As Khalid Mansoor, the human resources director, you will open the notification, read the reviewer's note and the AI comments, add the missing file and a fuller answer, and submit again.4 min
11. 11Accept an improved answer, try platform data, and waive or reopen a requestThis lesson is for the person who runs the audit. You will accept the answer that was improved after you sent it back, try to answer an open request from data ComplianceOS already holds, for one request and for all of them, and waive a request and reopen it.8 min
12. 12Answer a request with evidence that is already in the Evidence VaultThis lesson is for an assignee who can also open the Audit Hub, such as the compliance officer. One request is assigned to you, and the proof is already sealed in the Evidence Vault. You will write your answer, then attach the vault record to the request instead of uploading the file a second time. Finally you will accept the request on the Validate step, which, because you wrote the answer yourself, the approval policy allows only with a written reason.6 min
13. 13Test a control on a sample and record the resultsThis lesson is for the person who tests controls. On the Samples tab of the Validate step you will draw a random sample from a list of records, linked to the check it tests, and record for each item whether it passed, failed or does not apply.6 min
14. 14Raise findings: from inside a request and on the Readiness stepThis lesson is for the person who runs the audit. A finding records something an auditor would write up, with an owner and a date to fix it by. You will raise one finding directly from a request whose evidence is incomplete, and a second one by hand on the Readiness step, filling in the title, the severity, the owner and the date.7 min
15. 15As the owner of a finding: record what you did and mark it resolvedThis lesson is for anyone who is made the owner of an audit finding. As Ahmed Saleh, the accountant, you will find the finding in My Actions, open it, record the corrective action, save it, and mark the finding resolved.4 min
16. 16Read the readiness score, close a finding and download the evidence packThis lesson is for the person who runs the audit. On the Readiness step you will read the score and what it is made of, recompute it, see what still needs attention, close a finding its owner has resolved, and download the evidence pack, the ZIP file you hand to the auditor.6 min
17. 17Invite an external auditor to one audit with a linkThis lesson is for the person who runs the audit. You will invite an outside auditor to read this one audit and its evidence, without giving her an account. You will fill in every field of the invitation, take the link to send yourself, and set the longest access the entity allows.6 min
18. 18As the invited auditor: read the audit in the Auditor PortalThis lesson is for an outside auditor who has received an invitation link. Without signing in, you will open the Auditor Portal, read the audit's status, checklist and findings, download a piece of evidence, and send the company a finding of your own.6 min
19. 19Follow what the auditor did, answer her finding and revoke her accessThis lesson is for the person who runs the audit. On the Auditor Portal page you will see the invitation and when it was last used, read the auditor's access log, acknowledge the finding she submitted, and, when the fieldwork is over, revoke her access so that the link stops working.6 min
20. 20Share one piece of evidence by a time-limited link, and take the link backThis lesson is for the person who looks after evidence. Sometimes an outside party needs one file and nothing else. You will create a share link for one record in the Evidence Vault, limit how long and how often it works, see the page the receiver gets, check that the download was counted, and revoke the link.7 min
21. 21As an auditor with an account: read an audit without being able to change itThis lesson is for an internal auditor or reviewer who has the Auditor (read-only) role. As Daniel Brooks you will open the Audit Hub, walk through each step of an audit, see which controls are missing or switched off for a read-only role, and download the evidence pack.5 min
22. 22Complete the auditThis lesson is for the person who runs the audit. When the fieldwork is over you will recompute the score one last time, complete the audit, and see what completion leaves behind: the final score on the list, the wizard in a finished state, and a sealed record of the completed audit in the Evidence Vault.4 min
23. 23Roll an audit forward, cancel an audit and delete itThis lesson is for the person who runs audits. You will roll the completed audit forward to start next year's cycle from this year's checklist, then cancel that new audit with a reason, read how a cancelled audit looks, and delete it.6 min
24. 24What a person without Audit Hub access seesThis lesson is for everyone who does not run audits. As Aisha Farouk, an employee with the self-service role, you will see that the Audit Hub is not in your menu, what happens if you follow a link to it, who can give you access, and where your own audit requests would appear.3 min
25. 25How the Audit Hub connects to the rest of ComplianceOSThis lesson is for everyone who took part in the audit. You will follow the audit's traces through three other parts of ComplianceOS: the Evidence Vault, where its proof is sealed, My Actions, where requests and findings reach their owners, and the Audit log, which records who did what. The next lesson follows the other two: the Risk Register and the Compliance Calendar.6 min
26. 26Audit findings in the Risk Register, audit dates in the CalendarThis lesson is for the person who runs the audit and for whoever keeps the Risk Register and the Compliance Calendar. The Audit Hub feeds both by itself: every finding is listed as a risk while it is open, and the end of the audit period and each finding's due date are listed as deadlines. You will find them, read where they came from, and see how they follow the finding.5 min

How this connects to the rest of ComplianceOS

• Evidence Vault

  Confirming the checklist seals each policy document, accepting an answer seals its proof (by default a person other than the one who answered accepts it, unless the approval policy allows self-acceptance with a written reason), and completing the audit seals the audit record. Evidence already in the vault can be attached to a request instead of being uploaded again, and one file can be shared outside by a time-limited link.

• My Actions and My audit requests

  Every request and every finding appears in its owner's My Actions and on the page My audit requests. No Audit Hub role is needed to answer a request or to follow up a finding.

• Risk Register

  Every open finding of an audit that is not cancelled is listed as a risk with the source Audit Hub finding, scored from the finding's severity, with its corrective action as the first treatment plan. When the finding is resolved, accepted as a risk or closed, the risk is closed at the next sync.

• Compliance Calendar

  The end of each audit's period and each finding's due date are listed as deadlines. They are marked completed when the audit is completed or the finding is no longer open, and cancelled with a cancelled audit.

• Notifications

  Dispatching requests notifies each assignee, and sending an answer back notifies the assignee with the reviewer's note.

• Access control

  The Access section of the Audit Hub shows who can view, create, edit and approve audits for the entity and lets an administrator grant a role. An invitation to an external auditor is a read-only, expiring access to one audit.

• Auditor Portal

  An invited auditor reads the audit and its evidence in the portal without an account and can send findings back. The company follows the auditor's access log and findings on its Auditor Portal page.

• Audit log

  Each step of the audit is recorded with the person and the time: requests sent, responses submitted, accepted or sent back, findings, exports, invitations and completion.