The updated Audit Setup Wizard walks you through creating an audit in four steps: choose a program, set the scope, build the evidence request list, and add the audit's details. Nothing is created until the last step, so you can move back and forth freely. Leaving the Wizard before finishing will save a copy of that Audit for completion later.

Before you begin, have these ready if they apply to your audit:

Your answers in Steps 1 and 2 shape the rest of the wizard. Use this table to decide.

Open Compliance -> Audits (Arrow 1a) and select + New audit (Arrow 1b)

The wizard opens on the Program step. All four steps of the Audit creation process (Program, Scope, Requests, Review & details) run across the top of the Wizard (Box A). A Summary panel on the right fills in as you make choices (Box B).

There are four ways that users can start a new audit:

Method 1: Base this audit on a previous one if the audit is to be based on a prior audit (eg, SOC2 from last period)

Method 2: Use an existing program if this is a completely new audit to be based on an established Program. Recent Programs appear first, followed by all Programs.

Method 3: No program: gap assessment, readiness review, or internal audit if this audit is meant to capture

Method 4: Resume an unfinished audit setup if you started building a new audit and had to stop before completion

The Scope step decides what is tested and how results are scored.

Keep ZenGRC Default or choose another method from the Scored by list. ZenGRC Default concludes on Design, Operation and Maturity. Other methods appear only when an Administrator has set them up in System Settings.

If the audit assessment is based on each Control:

Search for and select the Program Sections to include:

Review the Controls necessary for this audit assessment. When you start from a program, its controls are already selected. Users can:

If the audit assessment is based on each objective:

Review and select the sections’ objectives to be included in this audit assessment. Click on Narrow to expand each Section and narrow down the objectives to be included.

There is no third step under Scope when the audit is based on each Request.

It is also possible to delay choosing the Scope and instead add controls or objectives later.

Step 2.5 - Review the Summary panel

The Summary panel shows how many controls are in scope and how many control assessments will be created. The panel changes based on the way that the user determines how the assessments will work.

As users choose which Sections/Controls/Objectives they want included in the Audit, the Summary panel figures will update as well.

The image below shows a Scope screen with the option “On each control” chosen by the user. Note the count of the figures in the Summary panel (Box A). The value “394 objectives in scope” are affected by what is chosen in the section “Which part of the framework does this audit cover?” (Box B). The values 230 controls and 230 control assessments are determined by what is chosen in the “Which controls get tested?” portion of the Scope step (Box C).

In the subsequent image, the user deselected one program from Which part of the framework does this audit cover? and several Control Sets in the section Which controls get tested? Notice how the Summary panel (Box A) values change based on the removal of these Sections (Box B) and Controls (Box C).

The user deselected five Control Sets from the Which controls get tested? section (Box C) and yet the Summary panel shows a decrease of only one control and one control assessment (from 230 to 229). This is because one control can be counted under several Control Sets: when the user deselected the accountability Control Set, the Audit Wizard removed all Control Sets that only contained the sole control (GOV-01-Cybersecurity & Data Protection Governance Program) found under the accountability Control Set.

The Audit Client provides evidence based on what is chosen in the Request list. There are four ways that users can begin their Request list:

For most users, the option Suggested list for your scope will be appropriate for Auditing needs. In choosing this option, users will prompt the Audit Wizard to create one Request per scoped Control (which were set during Step 2: Set the Scope).

For users who already have an established list from which they want to work, they can select Start from an existing list. They are they able to select a list from:

Some users may receive a list of Requests from an auditor, may keep Requests in a separate file, or are working in conjunction with another platform. For users who are taking a list of Requests from outside the platform, they can use the feature Upload a request list to upload multiple Requests into the Audit.

The final step in the Audit Setup Wizard includes sections where users can enter final yet important details:

Before clicking on Create Audit, users should review Summary panel on the right for accuracy:

In addition, users should review the On Create portion of the Summary card for an automated written explaination of what will happen after Create Audit is selected.

Once users have confirmed that the information is correct in the Review & details portion of the Audit Setup Wizard, they should click on Create Audit. Selecting this will bring the user to a page showing the creation status of the Audit.

The platform will work on the audit in the background, so the user who create the audit can navigate away from this page as the audit creation process finishes.

The newly created audit's status is set to Draft after it is created. Users can change this status in the Audit Listing page by hovering their cursor in the Status cell (Box A). This will reveal a pencil icon, which users should select (Arrow 1).

Users can then change the audit status in the subsequent dropdown menu that appears.