Audit with several scopes

One audit, several products: the same requirement can be met by different controls in each scope, and concluded separately.

Typical requirementsISO 27001SOC 2Customer audits

Stage 1 of 5
Two scopes
Product A and Product B are both assets in the audit scope.
Audits Assets
Links used
1. Audits scoped to Assets
2. Assets depends on Assets
WINGMAN and AI support
Scopes are read from the asset register with their dependencies.
Decides: The auditor agrees the scopes.
Stage 2 of 5
Different controls per product
Access rights are met by SSO-based reviews for Product A and by a manual quarterly review for Product B. Each control protects its own product.
Requirements Controls Assets
Links used
1. Requirements met by Controls
2. Controls protects Assets
WINGMAN and AI support
Lists, per requirement, which control applies to which scope, and flags scopes with none.
Decides: Control owners confirm the mapping.
Stage 3 of 5
Evidence per scope
Evidence is collected per control, so each product is tested on what it actually runs.
Controls Evidence Audits
Links used
1. Controls proven by Evidence
2. Audits examines Evidence
WINGMAN and AI support
Proposes samples per scope.
Decides: The auditor samples.
Stage 4 of 5
Conclusion per scope
A requirement can be compliant for Product A and a nonconformity for Product B. Each conclusion keeps its scope.
Findings Conclusions Requirements Assets Audits
Links used
1. Findings becomes Conclusions
2. Conclusions judges Requirements
3. Audits scoped to Assets
WINGMAN and AI support
Drafts one conclusion per requirement and scope.
Decides: The auditor confirms.
Stage 5 of 5
Shared follow-up
The fix for Product B can reuse the control already proven for Product A.
Tasks Controls Plans
Links used
1. Controls improved by Tasks
2. Tasks part of Plans
WINGMAN and AI support
Suggests reusing existing controls before creating new ones.
Decides: The control owner decides.

Sector angles

What this use case looks like under specific regulations.

ISO 27001 / SOC 2

One audit programme covering several products, or ISO 27001 and SOC 2 at once, without duplicate evidence.

Videos

**WINGMAN AI GRC – audit use case** An audit step by step, from claimed controls in documents to findings, the report and the fix plan back in WINGMAN.

Plays from youtube-nocookie.com. YouTube sets no cookies until you press play.

Other use cases

Auditing

Plan, run and close an internal or external audit on the records the organisation already keeps.

All use cases

Audit with several scopes

Sector angles

Videos

Other use cases

Auditing

See WINGMAN on your own data