Step-by-Step Onboarding Guide: Audit Management

Get up and running with your Audit Management solution

Thank you for choosing the OneTrust Audit Management solution to help manage your privacy, security, and governance program needs.

The solution is designed to be intuitive and easy to configure and this guide will take you through each step one by one.

And if you have questions along the way, or at the end of your implementation, you can reach out to the team who will be happy to help.

Audit Management allows your organization to transform the auditing process to a dynamic measure of logged activity, in or out of line with your policy guidelines, regulatory mandates, and overall risk appetite. Kickstart audit efforts with pre-planned work papers and a centralized platform to initiate interviews, test the design and effectiveness, attach evidence, and summarize findings and provide recommendations to improve areas of concern or where there is potential to optimize processes.

Let’s get you started

Follow the steps below to get your solution set up. Each stage of the process is covered by comprehensive guidance and support collateral on the my.onetrust.com online resource platform and this guide will direct you towards all the information you need.



Before you begin

Before you get started with your implementation, complete the following key activities which will help you accelerate your implementation:

  1. Configure IT Risk Management

    Audit Management runs against IT Risk Management , so Audit Management will need to be configured first.

    The Controls Library is the key element in IT Risk Management that needs to be configured to use Audit Management. See step 1 in the table below for further guidance.

    You can find all details on how to set up IT & Security Risk Management here, as well as the IT & Security Risk Management step-by-step guide here.

  2. Assign Key Decision Maker

    This will be the main point of contact throughout the implementation and will make configuration/setting decisions.

  3. Review Roles

    You will need to assign roles to the users you want to work on Audit Management internally, this is not something that needs to be decided in advance, but it is something to consider. You can review our GRC-related roles here.

Audit Management Configuration

You can access all our knowledge base articles at the link here. The steps below direct you to the most relevant way to get started as quickly as possible.

Step

Description

1

Audit Management runs against IT Risk Management , so Audit Management will need to be configured first before you can begin utilizing it.

As mentioned above, the Controls Library is a key element that needs to be configured within ITRM to use Audit Management.

Set up controls you want to audit in the controls library.

You can find all details on how to set up IT & Security Risk Management and specifics on the Controls Library using the guidance below:

Step-by-Step Onboarding Guide: IT & Security Risk Management

Managing Controls

2

OneTrust pre-populates the attribute inventories with attributes commonly associated with audits, workpapers, and controls.

You can add additional attributes to suit your organization's needs, edit the name and description of an attribute, and deactivate attributes you no longer wish to use.

Use the below articles as guidance:

Adding, Editing, and Deactivating Attributes

Configuring Audit and Workpaper Attribute Groupings

3

Using Audit Management, you can create a new audit using the Audits menu.

When you create a new audit, you are required to enter an audit name, select a standard/framework, select an organization, assign auditors and approvers, define the controls in scope, and assign auditors to each control.

Once you complete the required details, you have the option to complete additional fields as needed to add more details to your audit.

When your audit has been created and added to your audit list, you will have the opportunity to make changes and add details to the audit on the Audit Details screen.

The Audit Details screen gives you the ability to edit details, edit the scope, complete workpapers, add attachments, view findings, add tasks, and view activity for your audit.

Use the below articles for further guidance:

Creating, Editing, and Deleting an Audit

4

Audit Details

The Audit Details screen provides users with an overview of the audit record to help manage the auditing process. The screen also displays the current stage of the audit.

The Audit Details tab shows relevant meta-data or custom attributes about the audit including:

  • Audit ID

  • Audit Name

  • Standard/Framework

  • Statement/Goal

  • Start Date

  • End Date

  • Organization

  • Auditor(s)

  • Approver(s)

Scope

The Scope tab shows a comprehensive list of controls being audited as well as the assigned auditor for each control. You can edit the scope and assign an auditor that will be responsible for identifying the audit result.

Workpaper - See Step 5

Attachments

The Attachment tab allows users to add attachments to audit records to provide additional details. The screen displays the name of the attachment, attachment description, and upload details.

Findings - See Step 6

Tasks

The Tasks tab allows users to create, review, and manage all tasks for an audit. The tasks created can be assigned to any user within an organization.

The Tasks tab displays the task name, description, assignee, and deadline date. Users can click the Task Name to see task details. Within the task details, the user can edit the task, manage any attachments on the task, and add/view comments.

Activity

All changes made to Details tab of an audit will be logged in the Activity tab. The details logged in this tab include changes to the audit description, start date, end date, and auditors.

Use the following articles for further guidance:

Creating Audit Tasks in Bulk

Managing Audit Tasks

Adding, Editing, and Deleting Audit Attachments

5

Workpapers provide auditors a central location to manage audit work for compliance control.

Auditors can use workpapers to gather evidence and determine their view of a control's effectiveness.

The Workpaper tab shows relevant workpaper data, including the ID, workpaper name, auditor name, stage, number of findings or any additional custom attributes. You can click the Workpaper ID to view the Workpaper Details screen.

Use the below article for further guidance:

Managing Workpapers

6

Once an auditor completes the workpaper, the audit manager and auditor will review the findings of the audit.

A finding is an issue and/or compliance gap identified by an auditor through an audit workpaper.

The Findings tab allows users to review, address, and add action plans to all findings.

It also displays the ID, description of the finding, finding type, date created, created by user, action plan, and stage. Users can click the Finding ID to view the Finding Detail screen.

Use the below article for further guidance:

About Audit Findings

7

The Audit Management Dashboard offers a comprehensive view of your organization's audits using visualizations and metrics.

You can build a custom dashboard and widgets with the goal of optimizing the comprehensive view of your audits and workpaper status. The widgets allow users to add audit attribute dashboard filters.

Use the below articles for further guidance:

Using the Audit Management Dashboard

Complete!

Congratulations on completing your implementation.