Business management · Internal Audit and GRC
The GRC layer on top of Compliance Control: an audit universe prioritized by risk, an annual plan approved by the committee, engagements with an audit program and reviewed working papers, findings with a management action plan and follow-up, three lines of defense declared, key risk indicators with risk appetite thresholds read from the real operating modules, and the ISO 27001, COSO and SOX libraries mapped onto the controls the company already has.
The problem and the fix
If any of these situations sounds familiar, it is because they happen in almost every graduation company, until the right system comes in.
Internal audit is a spreadsheet of loose findings, and nobody knows whether the annual plan was carried out.
An audit universe with risk by process, an annual plan that is versioned and approved, engagements with status and plan execution measured on the dashboard.
The finding is written down, the manager agrees in the meeting and six months later nothing has changed.
A finding with a recommendation, a management action plan, a deadline and an owner, turning into an action in the same remediation flow Compliance already uses, with automatic follow-up and overdue alerts.
The person testing the control belongs to the same area that performs the control.
Independence checked through the segregation of duties that already exists: an auditor does not run procedures over controls in their own area, and any exception has to be recorded.
The board asks for risk indicators and gets opinions painted in traffic-light colors.
Indicators calculated from named formulas in code, reading overdue receivables, chargebacks, serious incidents, turnover, accidents and critical nonconformities, with risk appetite and tolerance declared.
Certification asks for the Statement of Applicability, and it gets assembled by hand every time.
ISO 27001, COSO and SOX libraries loaded per company and mapped to the internal controls, with the statement generated from the matrix and an explicit exception for any item excluded without justification.
In practice
Everyday situations at graduation companies, from the problem to the result, using the modules on this page.
The company has to decide what to audit this year with the team it has.
The audit universe is scored for inherent risk by process and business unit. The plan is built from that prioritization, versioned and approved on the committee agenda.
The choice of what to audit is documented, and plan execution becomes a metric for the period.
The auditor has to prove what was tested, with the sample and the evidence.
The engagement has an audit program with procedures, working papers with the sample, attached evidence, a conclusion and review by someone else. A finding becomes an action with an owner and a deadline.
The report comes out with a complete trail, and follow-up chases on its own once the deadline passes.
Overdue receivables go past the limit the board accepted.
The daily measurement compares the value against appetite and tolerance. Out of range, continuous monitoring raises an alert and the board dashboard shows the trend.
The conversation in the meeting starts from the number and the time series, not from this month's impression.
How it works
Every step is a real module, and what comes out of one goes into the next without anyone typing it again.
Module by module
7 modules and 35 features on this page, all running on the same class, graduate and event records.
What can be audited, and what will be audited this year.
The test that happened, with the proof that it happened.
What was found turns into change, with a deadline.
Who performs, who monitors and who audits, declared.
Risk measured with data from the system itself.
The standard tied to the control you already have.
The snapshot that goes to the meeting, with its date and its source.
Compare the modules and choose the setup that fits your operation.