Control tests check whether a control is operating. An audit examines whether the management system meets the questions you planned to ask. Auditing keeps that programme next to the rest of Governance & Assurance, so findings land in the same system as the controls.
What the programme shows
Questions live in a bank, with a standard, a domain, and a clause or control reference. A plan, or a single audit, copies chosen questions onto a checklist. Cited questions stay on the same audit. Sample questions are available for ISO/IEC 27001, 27701, and 42001, ISO 9001, Cyber Essentials, SOC 1, and SOC 2.
- Whether the work is being done. The overview shows scheduled audits, how many are completed, what is overdue, and what is due in the next seven days. Completed and cancelled audits are not counted as overdue.
- What was examined this year. Coverage by standard shows a question as audited, scheduled, seen only in an earlier year, or not planned.
- What the audit found. A checklist result is conform, non-conformity, an observation, or not applicable. A non-conformity can be raised only from a non-conformity result. An improvement or a risk can be raised from any result.
When you need to change it
The auditing overview, the schedule, the calendar, the question bank, planning, and checklists and findings describe how to change the programme.