An internal audit is your own review of how your company works. You plan a few tests, record what you find and fix it. It is an internal working record. It is not a statutory audit, it gives no opinion or certificate, and nothing is filed with the NDPC.
Who can do this
Only your company's own members. A practice working under an engagement cannot run your internal audits.
- An owner or editor plans audits, plans tests and findings, moves the audit between states, reviews the work and verifies corrections.
- A contributor records results and corrections on the work assigned to them.
- Anyone in the workspace can read the audits.
Nobody can review or verify work they recorded themselves.
Plan an audit
Open Internal audits under Risk & audit on the rail and press Plan an audit.
- Define the audit: the Audit name, the Purpose and the Scope.
- Set ownership and timing: what is Outside this review, the Accountable owner and the Start date.
- Link the programme: the Target date, and if you want, Programme (optional) and Reporting period (optional).
- Write the Reason for change and press Create audit.
The audit starts as Draft. To change the plan later, press Edit scope, then Save scope.
The stages of an audit
An audit is Draft, Fieldwork, Awaiting review, Reviewed or Archived. Inside the audit the tabs are Tests, Findings, Review and History. The buttons that move it between stages are on the Review tab.
Plan the tests
On the Tests tab, press Plan a test:
- Define the test: the Test name, the Criterion and the Procedure.
- Choose the sample: the Population size, the Sample size and How the sample was chosen. The sample cannot be larger than the population.
- Assign the work: choose who it is Assigned to.
When at least one test is planned, press Start fieldwork.
Record results
Press Record result on a test. Choose a Result: Supported by evidence, Gap found or Insufficient evidence, and write the Rationale. Tick the evidence versions you relied on. The saved result pins those exact versions. A supported result needs at least one.
Record findings
Every gap and every test with insufficient evidence needs a finding. Press Record finding on the test, or Record a finding on the Findings tab:
- Describe the finding: the Related test, the Finding and the Cause.
- Set severity and ownership: the Severity (Minor, Major or Critical), the Correction owner and the Due date.
Correct and verify
The owner presses Record correction, writes the Corrective action and ticks the evidence of the fix. A correction needs evidence. The finding then shows Awaiting verification.
Someone else presses Verify correction and chooses a Decision: "Verified correction — close finding" or Return for more work, with a Rationale. A verified finding shows Verified closed.
Independent review
When every test has a result and every gap has a finding, press Submit for review. The audit is then Awaiting review.
A reviewer who did not record the work presses Review fieldwork and chooses Accept recorded fieldwork or Return for more work, with a Rationale. Accepting makes the audit Reviewed. Review confirms the fieldwork. It does not close findings. Each one stays open until its correction is verified.
Archive and restore
Press Archive audit to retire it. Archiving keeps its history and does not resolve open findings. They stay open, and visible, on the archived audit. An archived audit is read-only. To carry a finding forward, record it in a current internal audit and say where it came from in its cause.
If it was archived too early, an owner or editor presses Restore audit. It returns to the stage it was in.
The record
Every change needs a Reason for change and makes a new revision. The History tab shows each revision. Nothing is deleted. Press Download record (JSON) to export the audit.
Common questions
"Is an internal audit the same as our statutory audit?" No. A statutory audit is done by a licensed DPCO firm and ends in a signed opinion. An internal audit is your own working record.
"Can our DPO run it for us?" Not as a practice under an engagement. Only your company's own members can.
"Does a reviewed audit mean our findings are closed?" No. Each finding closes only when its correction is verified.