Internal audit checklist

An internal audit checks whether what you wrote down also happens in practice. The checklist gives the auditor concrete things to check, so nobody has to start from an empty page.

Make a checklist

Go to Internal audit and choose New checklist. Give it a title, choose the standards and, if you like, only some chapters. Add the planned date and the auditor: a colleague, or the name of someone from outside.

The checklist is written from what you wrote under How we comply for each clause. Every sentence or list item becomes a check, such as:

• "We use data masking for user data" becomes a system check: look in the database at a sample of records and see that user data is masked.
• "All staff follow an awareness training" becomes an interview with people who do the work.
• "Visitors sign in at the office desk" becomes an observation at the desk itself.

Each check says what to verify, how, who to talk to, which proof to collect and how many to look at. Clauses that are excluded or have no text yet are left out. You can add, change or remove checks yourself.

The checks are written by fixed rules, not by AI. They are a start: the auditor decides what is enough.

How many to check

Number of records or people	Check
Up to 5	All of them
6 to 50	5
51 to 250	10
More than 250	25

Pick them at random over the whole period, not only the latest.

During the audit

Open the checklist on your phone or laptop. Per check you choose the result: conforms, minor nonconformity, major nonconformity or observation. Add notes, and take a photo or add a file on the spot. The bar at the top shows how far you are. Show only the open checks to see what is left.

From a minor or major nonconformity you make a finding in one step. It appears under Findings with what was verified as its title and your notes as its description.

The report

When you are done, set the checklist to completed and download it as Word or PDF. The report has the details of the audit, the number of checks per result, every check with its result, notes and files, and the findings you raised.

Good to know

• Every member can work on a checklist. Changes appear in the activity log.
• The files you add are stored encrypted and are part of your data export.