Internal Audit

Your audit plan covers a lot.
But the right things?

Plan, run and follow up internal audits.
From the audit universe to the closed action, in one system.

Impact across the audit cycle illustrative before with the platform 50 100 % Coverage of high risk entities 68 % +26 94 % Actions closed on time 52 % +35 87 % Time spent on actual audit work 55 % +30 85 % The audit report is produced at the click of a button, not in five days of manual work Impact across the audit cycle illustrative before with the platform Coverage of high risk +26 94 % Actions closed on time +35 87 % Time on audit work +30 85 % The audit report is produced at a click, not in five days of manual work

Trusted by leading organizations

What makes the difference

From the audit report
to evidenced impact

Auditing is the easy part. What sets a function apart is whether findings demonstrably turn into change.

The common starting point

The annual plan lives in a spreadsheet

Audit plan in Excel, workpapers on a shared drive, evidence in the inbox. The report gets finished and the follow-up fades away.

  • Audit plan in Excel, workpapers on a shared drive
  • Evidence scattered across mails, screenshots and folders
  • The committee report takes days of manual work
  • Open actions drop out of sight once the report is out
With the SwissGRC® Platform

One audit cycle, connected end to end

Audit universe, planning, workpapers, findings and actions live in one system. The current status can be queried at any time.

  • Annual plan derived from the risk of each auditable entity
  • Workpapers and evidence held on the engagement
  • Audit report and dashboard at the click of a button
  • Actions with owner and due date, tracked to closure
The SwissGRC® Platform at a glance

Your entire audit cycle,
in one place

Order the audit universe, run engagements, report. Click through the three views.

Risk based planning

The audit universe ordered by risk

Every auditable entity in one inventory, with risk rating, audit frequency and the date of the last audit. The annual plan follows the risk.

  • Auditable entities with risk rating and audit frequency
  • High risk entities listed separately
  • Last audit date and related processes per entity
Audit universe with auditable entities, risk rating and audit frequency
Fieldwork

From the engagement to the workpaper

The audit process is modelled as a flow, with roles from the audit director through to the auditee. Control tests, checklists and evidence sit on the engagement.

  • Audit process with roles, reviews and approvals
  • Control tests and audit checklist as workpapers
  • A complete audit trail from planning to the report
Internal audit process with roles and approvals in the SwissGRC Platform
Reporting

Audit status and findings at a glance

Audit status, findings by status and rating plus the state of management actions in one dashboard. The report is produced at the click of a button.

  • Audit status from planning through to closure
  • Findings by status and severity
  • Draft and final audit report as ready analyses
Audit management dashboard with audit status, findings and actions
Built on recognized standards, from risk based planning through to following up on management actions.
Global Internal Audit Standards IPPF ISO 19011 Audit universe Risk based planning Follow-up
From the report to impact

Audited is not resolved.
Resolved is resolved.

The Global Internal Audit Standards explicitly require, in Principle 15, that results are communicated and action plans monitored. That is exactly where the spreadsheet ends and the platform begins.

Risk based annual planning
The audit frequency of each entity follows from its risk. Plan, progress and coverage are visible at any time, including for the audit committee.
Workpapers and control tests
Evidence, checklists and control tests sit on the engagement instead of on a shared drive. The audit trail builds itself.
Findings and actions
Findings are rated and turned into actions with an owner and a due date. Overdue items stand out instead of dropping out.
Quality assurance
One consistent approach across every audit, documented and analysable. The basis for the internal quality programme.
One data set, several disciplines
Findings act directly on risks and controls. Internal audit, ICS and information security work from the same foundation.
Advantages and added value

More impact,
less manual work

Comprehensive and simple at the same time. That is what drives adoption and lifts maturity.

Consistent audits

A standardized approach ensures every audit runs to the same quality and methodology.

Part of a connected GRC system

Audits share one foundation with ICS, risk management, ISMS and compliance. Findings take effect where they belong.

Audit ready at any time

Current and accessible audit records. External inspections and certifications stop being exceptional events.

Less manual work

Workflows and ready analyses replace collection emails and manual effort, leaving room for the actual audit work.

Insight across engagements

Recognize patterns across several audits and years and derive targeted improvements from them.

Closer to management

A defensible overall picture for the executive board and the audit committee turns internal audit into a trusted advisor.

Contact and demo

See our internal audit
solution in action

In a personal demo we walk you through the SwissGRC® Platform and show how audit planning, fieldwork, findings and actions work together.