Audit Management
Turning audit prep from six weeks into a report
Evidence lived in email, shared drives, and three people's heads. We built an append-only evidence store mapped to their control framework.
The problem
Preparing for review meant reconstructing history: searching inboxes for approvals, matching spreadsheet versions, and asking whoever had been in the room what had actually been decided. Six weeks of work, most of it archaeology rather than analysis.
The deeper issue was that nothing was immutable. A control could be marked as satisfied, then quietly un-marked, with no record that it had ever changed.
What we did
Three pieces:
A control library mapped to the framework the firm is actually assessed against, so controls are objects with owners and evidence requirements rather than rows in a tracking sheet.
An append-only evidence store. Uploading evidence creates a record; it never replaces one. Superseding a document links the new version to the old and keeps both. Every state change carries who, when, and from what previous state.
A findings lifecycle — raised, assigned, remediated, verified, closed — where each transition is a new immutable event.
What this doesn’t do
It does not judge whether a control is adequate. That is the auditor’s job and we did not try to automate it. What it does is make sure that whatever was decided is provable months later without asking anyone to remember.
The result
Preparation is now running a report. The firm’s last review started on a Monday and had its evidence pack delivered Wednesday morning.