What it is
The internal-audit surface is where assessments are run and their findings followed through to a fix. It brings together the engagement register — each audit with its assessor, phase and status — the findings raised across those engagements with their control, severity and status, and the control tests that periodically re-check whether a control is still working.
This is how compliance proves itself rather than assuming it. An engagement is a planned piece of assurance work; a finding is something it turned up; a control test is the recurring check that keeps a control honest over time. A KPI band counts engagements, those in progress, open findings, tests due and controls that have drifted — so the head of compliance always knows what assurance work is live and what has slipped.
When to use it
- You are running a scheduled internal audit or assessment
- You need to track findings through to remediation
- You want to know which control tests are due
- A control may have drifted and needs re-testing
- You are reporting on the state of assurance to leadership
How it works
Step by step.
- 1
Read the KPI band
The band counts engagements, those in progress, open findings, tests due and drifted controls — the assurance picture at a glance.
- 2
Open an engagement
The engagement register lists each audit with its assessor, phase and status. Open one to see its scope and findings.
- 3
Track findings
Review findings across engagements by control and severity, and follow each through its status until it is remediated.
- 4
Check control tests
The control-test workpapers show each test, the method, when it was last run and its result.
- 5
Re-test a drifted control
When a control has drifted, run its test again and record the new result to bring it back into assurance.
Worked example
Follow it through.
The scenario
You are running a quarterly access-control audit and one test has drifted since last quarter.
- 1 Open the internal-audit surface; the KPI band shows 2 engagements in progress and 3 tests due.
- 2 Open the access-control engagement and review its open findings.
- 3 A medium-severity finding on dormant accounts is still open — follow its remediation status.
- 4 In the control tests, the quarterly access-review test shows as drifted.
- 5 Re-run the test, confirm the control is back in place, and record the result.
The result
The engagement’s findings are tracked, the drifted control test is re-run and passing, and the assurance picture is current for the quarter.
Tips & notes
Good to know.
- A finding is not closed until its remediation status says so — an unaddressed finding is the one that resurfaces in the next audit.
- Drifted controls are the early warning: a control that passed once can quietly stop working, which is why the tests recur.
- Use the severity on findings to prioritise — a high-severity open finding outranks a backlog of low ones.
- The engagement register is also your audit history; a closed engagement with its findings is evidence the work was done.
When you’re done
Your audit engagements are tracked, findings are followed to remediation, and control tests are current — a defensible record of assurance.