Use This Doc For
/compliance/audits/compliance/audits/[id]/compliance/actions/compliance/actions/[id]
Purpose
An audit records the scope and result of an internal, external, certification, or regulatory review. Findings identify specific nonconformities, observations, or opportunities. Corrective actions turn those findings—or an incident, gap, or management review—into owned work that can be completed and then verified.
Before The Audit
- Define the scope, audit type, auditor, and scheduled date.
- Link the audit plan to the controls and evidence the auditor will need.
- Confirm access and sampling requirements before the scheduled date. Creating a scheduled audit can add a compliance calendar event when an employee context is available.
Findings To Verified Action
- Record each finding separately with its type, description, due date, and linked control where applicable.
- Create a corrective action from the finding. Include the problem, root cause, accountable owner, and due date.
- Move the action from open to in-progress while remediation is being performed.
- Mark it completed only when the owner has finished the work.
- Verify it separately. Verification records the verifier, method, date, and changes the action to verified.
- Resolve the finding only when the evidence and verified action support that conclusion. Complete the audit with its actual conducted/completed dates and rating.
Decisions And Consequences
- Completed means work was reported done; verified means someone recorded how the result was checked. They are intentionally different.
- Overdue views treat open and in-progress actions past their due date as overdue. Changing a due date changes the signal, so record why.
- A finding may link to a control, while its corrective action links back to the finding. Keep both links so recurring problems can be traced.
- Completing an audit does not automatically complete findings or actions.
What To Watch
- audit findings closed without linked corrective evidence
- corrective actions that do not clearly map back to the audit issue
- repeated audit themes that never feed a broader control improvement
- the same person completing and verifying high-risk remediation without an explicit independence decision
- due dates repeatedly moved instead of escalating blocked work
Recovery
If an action was completed or verified prematurely, correct its status and record what remains. If the wrong control was linked, repair the link without deleting the finding. Preserve the original audit and its dates; use follow-up findings or actions for newly discovered work rather than rewriting the prior review.