Audit Management
Quick answer
Plan audits, run engagements, gather evidence and track findings to closure inside the platform.
Key takeaways
- Engagements link to entities and controls
- Continuous control testing reduces fieldwork
- Findings need owners, dates and evidence to close
- Trend findings by control to spot systemic weakness
Audit lifecycle
Audit management covers planning, scoping, fieldwork, findings and reporting. Engagements link to entities and to the controls being tested, which means evidence gathered for compliance can be reused rather than requested again.
Evidence reuse
When control tests already run continuously, an audit becomes a review of existing results plus targeted sampling. That is the biggest efficiency gain available to a GRC programme.
Findings
Findings are the output that matters.
- Assign each finding an owner, a due date and an agreed action
- Link findings to the control that failed so trend analysis works
- Track overdue findings on a dashboard the audit committee sees
- Close findings on evidence, not on assurance from the owner
Want to learn this properly?
Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.
Check your understanding
What should close a finding?
- A. Owner confirmation
- B. Evidence of the action taken
- C. Time elapsed
- D. A new audit
Show answer
B. Evidence of the action taken
Evidence based closure is what survives external review.
Which reuse makes audits cheaper?
- A. Copying last year report
- B. Continuous control test results
- C. More sampling
- D. Longer engagements
Show answer
B. Continuous control test results
Automated control tests provide standing evidence.