Audit Reports

In any organization, maintaining compliance, efficiency, and security is crucial for long-term success. Internal and external audits serve as essential tools to assess whether policies, procedures, and operations adhere to both internal standards and external regulatory or certification requirements. Internal audits help organizations identify gaps, improve processes, and ensure continuous compliance before undergoing external evaluations. 

Many compliance frameworks mandate regular internal audits as part of their requirements, ensuring that organizations maintain effectiveness, accountability, and ongoing improvement. Below are some key frameworks that require internal audits: 

• ISO 27001 and ISO 27701: Requires regular internal audits to assess compliance with the standard and internal policies. 

• NIST Cybersecurity Framework (CSF): Encourages self-assessments and internal reviews to improve security controls. 

• SOC 2 (Service Organization Control 2): Internal audits help maintain security, availability, processing integrity, confidentiality, and privacy controls. 

• GDPR (General Data Protection Regulation) “While not explicitly requiring internal audits, organizations must regularly assess and document their compliance with data protection policies. 

• ISO 9001 (Quality Management System – QMS): Mandates internal audits to evaluate the effectiveness of quality management processes. 

• ISO 13485 (Medical Devices): Requires internal audits to ensure compliance with regulatory and quality standards in the medical device industry. 

• HIPAA (Health Insurance Portability and Accountability Act): Requires periodic internal audits to ensure compliance with privacy and security rules. 

By conducting internal audits at planned intervals, your organization can: 

• Verify compliance with internal policies and external regulatory or certification requirements. 

• Assess the effectiveness of processes and controls to ensure they are properly implemented and maintained. 

• Identify areas for improvement and mitigate potential risks before they become critical. 

• Strengthen accountability and transparency across departments. 

External audits, typically conducted by independent certification bodies or regulators, serve as an objective validation of an organization’s adherence to industry standards and legal obligations. They ensure that organizations meet compliance benchmarks and help maintain certifications over time. 

A well-structured audit program ensures that both internal and external audits are conducted with a clearly defined scope, criteria, and reporting mechanisms. By systematically reviewing operations, documenting findings, and implementing corrective actions, your organization can enhance governance, drive continuous improvement, and maintain trust with stakeholders. 

Before undergoing any external audit, it is crucial for organizations to first focus on internal audits. Internal audits serve as the foundation for ensuring that policies, procedures, and controls are effectively implemented and align with both internal requirements and external compliance frameworks. However, to ensure the integrity and effectiveness of an internal audit, it is crucial that the process is conducted by an independent party. This can be either an appointed internal auditor or an external service provider, both of whom bring objectivity and expertise to the internal audit process. Compleye Online has developed a structured audit approach based on clearly defined criteria, designed to assess compliance against the standards of relevant compliance frameworks. Our methodology ensures that all criteria are thoroughly assessed against documented records and evidence maintained within Compleye Online, providing a transparent and objective assessment process. 

The audit template we use includes predefined criteria aligned with industry best practices, combined with the ‘Audit Report Section’ allowing for a thorough assessment of compliance, process effectiveness, and risk management. 

To better understand the ‘Audit Report Section’ and the processes involved, refer to the following 2 key steps: 

Step 1:Perform the Internal Audit 

It is recommended to begin performing the internal audit 2 to 3 months prior to the scheduled external audit. This early start is crucial, especially for the first time, as it can be time-consuming. You’ll need to audit every aspect of your compliance framework to ensure that all areas are covered. 

The Internal Audit Template, along with predefined criteria and gathered findings, serves as a crucial tool in this process. It includes an integrated internal audit procedure, which references the internal audit program and outlines key responsibilities, roles, and steps involved in the process. This structured approach ensures that audits are comprehensive, objective, and aligned with compliance standards, enabling the identification of areas that may need improvement before the external audit takes place. 

All findings from the internal auditor will need to be addressed by the Compliance Team, so it’s important to involve the right individuals, including C-level management, in the process. This is why the investigation step is integrated into the process, if evidence cannot be found during the audit, it can be provided during the investigation meeting. The final internal audit report will highlight findings that should be used to drive improvements, similar to the process followed in assessments. 

The standard, in particular ISO 27001, 9001 or ISO 27701 requires an audit plan covering the entire certification period (typically three years). Therefore, before the external audit, all parts of the compliance framework should be audited, with the requirements distributed across the years. The primary distinction between assessments and audits is that an assessment provides a snapshot of the current state of your organization, whereas an audit is specifically focused on measuring compliance. While an audit also evaluates the current state, it compares it against a defined standard, highlighting any gaps that need to be addressed. 

Step 2: Process Your Findings 

Now that the internal audit has been completed, it’s time to review the findings and translate them into actionable improvements. This final step can be carried out by your compliance officer. 

Additionally, Step 2 can also be used to record audit reports received from external audits and document findings accordingly. In Compleye Online, you can manage both internal and external audit reports under the same ‘Audit Report Section’, ensuring that all findings, observations, and corrective actions are clearly documented. This allows for a comprehensive audit trail that supports continuous improvement and compliance tracking. 

To begin, simply click the “Create New Audit Report” button located at the bottom left of the page. This will allow you to document findings, track necessary actions, and ensure continuous improvement. 

A new window will open, allowing you to upload the Audit Report document. Once attached, this document cannot be deleted but can be downloaded as needed. The Audit Report card will automatically be named based on the upload date. If multiple documents need to be uploaded, ensure that the main document is uploaded first. 

After creating the Audit Report Card, you can add the findings by copying them from your main audit document. Additionally, if needed, you can upload other relevant documents in the ‘Attachments’ tab. While adding attachments is optional, it can help provide additional context and supporting evidence for the audit findings. 

When a finding is added and saved, you will automatically have the option to create an improvement (highlighted in blue). 

NOTE: If you choose not to create an improvement, you will need to justify this decision to the external auditor. In some cases, the issue may have already been resolved, with supporting evidence uploaded in the ‘Attachments’ tab. If so, ensure the finding is clearly documented with a note such as: “Already resolved by [action taken]. Evidence can be found in the attachment.” 

However, we strongly recommend creating an improvement for each finding. Improvements become part of the Management Review, demonstrating your organization’s ability to enhance and mature its compliance framework. 

Creating an Improvement: 

A new pop-up screen will appear once you initiate an improvement. 

The finding will be automatically pre-filled, tagged as Internal Audit, indicating its source. 

You must assign an owner responsible for implementing the improvement. 

Set a due date, representing the estimated timeframe for achieving the first expected results.

Once all required fields are completed, click the ‘Create Improvement’ button. This will automatically generate an improvement with a unique ID in the ‘Improvements Section’, ensuring it is properly tracked and managed within the system. 

Now, the owner assigned to the improvement will need to take action. To ensure a smooth process: 

• Confirm that the owner has access to the board and has added their email address in the ‘People@ Section’. This ensures they receive notifications regarding improvement deadlines. 

• The Compliance Officer will monitor the progress of all improvements during the monthly security meeting to ensure accountability and timely completion. 

Closing an Improvement: 

Once an improvement is completed, it will be marked with a green check-box tick in the system. This will also include: 

• The date the improvement was closed. 

• The person responsible for closing it. 

Before embarking on a new internal or external audit, always verify whether the findings from your previous audit have been addressed and closed. This step is crucial to maintain a continuous cycle of improvement, ensuring that past issues are fully resolved. Additionally, addressing previous findings helps avoid potential nonconformities during the external audit, as unresolved findings may raise concerns and impact your audit outcome.