Audits

Engagements with scoped assessments, findings raised against real records, and follow-up tracked to closure.

Follow-up is where internal audit programmes fail. Tracking closure on the same record as the original finding removes the reconciliation step entirely.

A dedicated external auditor role, assigned to the folders the engagement covers. The auditor sees the evidence for that scope and nothing beyond it.

The alternative is exporting a folder of documents to a third party and losing track of it. Scoped access keeps the evidence in one place and leaves an access trail.

Import penetration test and scan results, band them by severity, and turn them into tracked findings against the affected assets.

A penetration test report is a PDF that ages badly. Turning its contents into findings against assets is what makes it get remediated.

A vulnerability register with CVE enrichment from an NVD cache, severity banding, asset linkage and remediation tracking.

Linking a vulnerability to the asset, and the asset to the perimeter, is what lets you answer whether a published CVE affects a regulated system.

One findings model links across audits, assessments, incidents and vendor reviews, so nothing is tracked twice.

The same weakness found by internal audit and by a vendor questionnaire is one problem. Two registers means it gets closed in one and stays open in the other.