Auditing

Plan, run and close an internal or external audit on the records the organisation already keeps.

Typical requirementsISO 27001NIS2DORA

Stage 1 of 6
Scope
Select the requirements in scope and the products, services or sites they apply to.
Audits Requirements Assets
Links used
1. Audits tests Requirements
2. Audits scoped to Assets
WINGMAN and AI support
The audit skill builds the requirement list from WINGMAN or from a checklist workbook, with company context.
Decides: The auditor confirms scope and period.
Stage 2 of 6
Claimed controls
Read policies and procedures to learn how the organisation says it meets each requirement.
Audits Documents Controls Requirements
Links used
1. Audits reads Documents
2. Controls described in Documents
3. Requirements met by Controls
WINGMAN and AI support
Each requirement is marked documented, partly documented or not documented, with paragraph references. Unreadable documents are flagged.
Decides: The auditor reviews the mapping.
Stage 3 of 6
Plan and interviews
Interview topics come from company context, the risks the company named and the risks WINGMAN found. The auditor leads each interview.
Audits Plans Risks Roles People
Links used
1. Plans schedules Audits
2. Roles owns Risks
3. People holds Roles
WINGMAN and AI support
Proposes topics and follow-up questions; transcribes locally.
Decides: The auditor decides what to ask.
Stage 4 of 6
Evidence
Collect records, samples and screenshots, check their validity, and compare what is done with what is written.
Audits Evidence Controls
Links used
1. Audits examines Evidence
2. Controls proven by Evidence
WINGMAN and AI support
Promised evidence is tracked with due dates; transcripts and screenshots become evidence once the auditee approves them.
Decides: The auditee approves what was recorded.
Stage 5 of 6
Reasonable assurance
For each requirement, decide whether the evidence gives reasonable assurance. Where it does not, raise a finding.
Audits Requirements Evidence Findings
Links used
1. Audits raises Findings
2. Evidence supports Findings
3. Audits tests Requirements
WINGMAN and AI support
Drafts findings with evidence and paragraph references and proposes severity.
Decides: The auditor confirms or changes each finding.
Stage 6 of 6
Conclusions and follow-up
Confirmed findings become conclusions per requirement. Nonconformities get corrective tasks in a plan, and the report goes back into WINGMAN.
Findings Conclusions Requirements Tasks Plans Roles
Links used
1. Findings becomes Conclusions
2. Conclusions judges Requirements
3. Findings resolved by Tasks
4. Tasks part of Plans
5. Roles accountable for Plans
WINGMAN and AI support
Proposes corrective tasks with owners and dates from each finding.
Decides: Management accepts the fix plan.

Sector angles

What this use case looks like under specific regulations.

NIS2

The self-assessment and the periodic cybersecurity audit run on the same records, with conclusions per requirement.

ISO 27001 / SOC 2

Internal audits per clause with findings, conclusions and corrective actions, ready for the certification body or the SOC 2 auditor.

AI governance

Internal audits against ISO 42001 or EN 18286, with conclusions per clause.

CRA

Internal checks against the essential requirements before conformity assessment.

GDPR

Data protection audits per article and per processing activity, with findings tracked to closure.

Videos

**WINGMAN AI GRC – audit use case** An audit step by step, from claimed controls in documents to findings, the report and the fix plan back in WINGMAN.

Plays from youtube-nocookie.com. YouTube sets no cookies until you press play.

Other use cases

Audit with several scopes

One audit, several products: the same requirement can be met by different controls in each scope, and concluded separately.

All use cases

Auditing

Sector angles

Videos

Other use cases

Audit with several scopes

See WINGMAN on your own data