How to use the Audit Module

The audit module plans, executes and documents your internal and external audits: the audit programme (which audits recur and when), the frameworks you audit against, the audit team, the scope of every audit, the day-by-day division of the work over the auditees, the questions every auditee answers, the findings that come out of it, and the audit report. Everything an auditor asks you to demonstrate - who audited what, when, against which framework and which criteria, with which conclusion - is recorded per item and stays available for the next audit.

In short: a series describes a recurring audit and names the frameworks it audits against. Every occurrence of the series is an audit that moves through a timeline: Created, Planned, Preparing, Executing, Completed, Published. On the Prepare and Execute tab you divide the scope over the days of the audit and assign it to auditees; each assignment creates a task built from a procedure in your organisation's procedure library, and the questions on that task are the audit criteria of the audited item. The audit is completed when all those tasks are done. The auditee does not judge the item from the task alone: the task takes them to the item's own screen, where the audit work sits next to everything ISOPlanner knows about that item.

Before you start

The Audit module must be part of your subscription, and it must be switched on for your organisation under Admin > Company > Modules > Audit. It then appears as Audit in the navigation. The module is currently in preview: if you do not see it at all, ask ISOPlanner support to enable it for your tenant.
Managing audits - creating them, editing the team and the scope, assigning work, moving the status, writing the report - is for users with a manager role (manager, consultant or administrator). Starting a new audit series also requires the Create Audit Template permission, which an administrator grants per role under Admin > Authorization > Permissions > Audit. The standard roles have it by default.
Everything after that - the team, the scope, the planning, the assignments, the statuses and the report - is governed by the authorization schema on the series: whoever may edit the series may run its audits, and whoever may delete it may delete them. Set the schema and only its members see and manage the audits of that series. Without a schema, every manager can.
The schema decides, and your role in the audit does not. A lead auditor has no rights an auditor does not have, and putting yourself on your own audit as auditee or observer does not take any away: if you may edit the series, you may run its audits whatever role you hold in them. This is deliberate - the alternative would let you lock yourself out of an audit you created.
A user without a manager role can be on an audit team. They then get read-only access to that one audit's Prepare and Execute tab, which is where the link in their invitation mail lands, so they can see the plan they are part of. Two things are needed: the authorization schema of the series has to let them read, and they have to be on that audit's team. They can never edit the audit itself; their own work is done in their task.
An auditee needs no audit permission to do the work: being assigned an audit task is enough to open it and record the result. Read access to the audit is separate, and only decides whether they can also open the audit's own screen.
An audit is conducted against one or more frameworks, so at least one framework has to be active under Frameworks. Custom frameworks count as well.
A Teams meeting and participant availability require the Outlook integration to be configured. Without it you can still run the whole audit; only the meeting buttons are disabled.
The audit report is stored as a document in your library, so it requires the SharePoint integration for reports. Without it you can run the audit through Completed, but you cannot create the required report or publish the audit.
Audit tasks are dated with the working hours from your ISOPlanner settings: a task planned on an audit day starts when your working day starts and is due when it ends. Check those settings once if your organisation does not work from 08:00 to 17:00.
The AI features - scope suggestions, the audit assistant, Audit with AI, drafting audit criteria, the written summary in the report, updating the report while keeping the team's edits, the findings analysis and the improvement proposals - only appear when AI is enabled for your tenant. Everything in this article works without them; the AI never decides anything on its own.

1. Create an audit series

Go to Audit and choose New audit template. A series holds everything that stays the same year after year, so you only have to set it up once.

Field	What it does
Name	Name of the series, for example "Software development". Every occurrence is named after it with its period, for example "Software development - August 2026".
Type	Internal audit or external audit.
Description	The purpose and the standing scope of the audit. It is copied into every occurrence, printed in the report, and used by the AI when it suggests a scope.
Frameworks	The frameworks this series audits against; at least one. Every active framework is ticked by default. The choice decides which audit criteria the auditees are asked and under which frameworks the AI audits run (see steps 6 and 7). Every new audit copies the frameworks of the series and can narrow them until it starts preparing.
Recurrence	How often the audit comes back - see the next step. A series without a recurrence is valid; you then only create audits ad hoc.
Audit team (optional)	The participants who are always involved. Copied into every occurrence, and editable per audit.
Owner and authorization schema	You are the owner by default. Both are changed afterwards with Edit on the series in the overview, or in the header of any of its audits. The schema is optional and limits who can see and manage the audits of this series.

When the series has a recurrence, its first audit is planned the moment you save and the confirmation offers Open first audit. Without a recurrence it offers Create audit for the first ad hoc occurrence.

Use Copy on an existing series to reuse a proven set-up (team, description, frameworks) for another subject. Edit template scope sets the default scope of the series: every next audit starts from it.

2. Plan the audit programme

Set a recurrence on the series, for example every year in March, or every six months. Two things follow from it:

The start of the recurrence is the start of the series. As soon as the recurrence is active, the first audit is created on that date. There is no separate start date to maintain.
Each time you publish an audit, the next occurrence of the series is created automatically on the next date in the pattern. You are always one audit ahead, never more.

The series and its occurrences also appear in the annual plan, next to your other recurring work. Occurrences that are still in the future are shown as a preview.

Do you need an extra audit outside the schedule? Use New audit from this template on the series in the overview: an ad hoc occurrence is created that behaves exactly like a scheduled one. The button is disabled while the series still has an audit that is not published - finish that one first, because two open audits of one series would both claim to be "the current audit". A series without an active recurrence is perfectly valid - you then only work ad hoc.

Make an audit the template for the next ones

The set-up of an audit often gets better while you run it: you refine the scope, the team settles, a framework is dropped. Select that audit in the overview and choose Use as template: its scope, team and frameworks become the saved set-up of the series, and every next audit starts from it. This happens by itself the first time an audit of the series is published, so a series that runs normally keeps itself up to date. When a next audit is already planned, you are asked whether to rebuild it from the new set-up as well; saying yes replaces its scope and team and deletes all its tasks, including work already done in them.

The opposite direction is Restore from template on the Details tab of an audit: the saved set-up of the series is put back onto this audit. All tasks of the audit and the findings raised from them are deleted; this cannot be undone. Procedures are never part of either action: the procedure library belongs to the whole organisation, and one audit must not rewrite what every other audit uses.

3. Put the audit team together

Add the participants under Audit team, on the series (for everyone who is always involved) or on a single audit (for this occurrence only). Every participant has a role:

Role	Meaning
Lead auditor	Runs the audit: scope, planning, assignments, conclusion, report. Counts as an auditor.
Auditor	Audits along with the lead auditor.
Auditee	Is audited and does the work. Scope items are normally assigned to auditees, but anyone on the team except an observer can be given one.
Observer	Attends, is invited to the meeting, has no work of their own.

An audit cannot move to Planned until there is at least one auditor or lead auditor - without one there is nobody to do the audit. An auditee is not required: a one-person audit is perfectly valid. You can be the whole team, assign the scope items to yourself, and do every step alone. That is the normal shape in a small organisation.

Changing the team of a running audit has consequences for the work. Somebody you remove from the team, or turn into an observer, can no longer hold audit work, so their open audit tasks are released in the same save and they are told by mail. Tasks they already finished keep their name. Somebody you add after the invitations went out receives the invitation straight away.

Can this person actually do it?

A team of the right shape is not yet a team that can work: somebody the authorization schema shuts out cannot open the audit, and somebody without a manager role can never write to it. So every participant is checked against the schema of the series, and the outcome is shown next to their role - either Permission granted or the reason it is not. What each role needs:

Role	Needs
Lead auditor, Auditor	A manager role, and edit rights in the authorization schema. They record outcomes and conclusions on the audit itself, so read is not enough.
Auditee, Observer	Read rights in the authorization schema. A user without a manager role can hold these roles.

Because an auditor writes to the audit, and only a manager can ever have edit rights, a user without a manager role cannot be an auditor. You can still pick the role - it is not hidden, because a greyed-out option explains nothing - and the line next to it then tells you why it will not work. Everyone stays licensed too: a participant whose licence was withdrawn is reported as such.

The audit does not move to Planned until every participant is granted. The confirmation dialog names the people who are not, so you can fix it in one place: give them rights in the schema of the series, or give them a role they can hold. From Planned onwards the same rule guards saving the team, so an audit that is already running cannot be edited into a team that cannot work. Before Planned the team is still being put together and saves freely.

Careful with the other direction: the authorization schema of a series applies to all of its audits, so narrowing it can leave a running audit with participants who have just lost their access. Nothing stops you - a permission decision is not the audit's to overrule - but the team then shows it, and the next status step asks you to sort it out.

4. Set the frameworks and the scope

Frameworks

Every audit starts with the frameworks of its series, shown under Frameworks on the Details tab. You can narrow or widen them while the audit is Created, Planned or Preparing. From Executing onwards the list is locked, because the questions the auditees are answering follow from it: an audit criterion that belongs to a framework outside the audit is simply not asked (see step 6). Removing a framework while audit tasks already exist asks for confirmation: questions that were already answered stay visible read-only, questions that were not answered yet disappear from the auditees' forms.

Scope

Open the scope picker from the Scope section on the Details tab. The picker is a draft editor: your changes are applied when you press Add. You can put items from the whole management system in scope:

Requirements and controls
Processes
Risks
Assets and suppliers
Processing activities
Objectives
Documents from the library

Helpers in the picker:

The Frameworks filter narrows the requirements and controls to one framework of the audit; All frameworks in scope shows them all.
Never audited / Last audited ... per item, so you can spread coverage over the years.
Risk score per item, so you can start with the risky parts.
Add related items: preview and add everything connected to an item, for example the controls of a risk.
Suggest scope with AI (when AI is enabled): a proposal under AI Suggestions, based on the description of the series, its frameworks and three years of audit history, optionally steered with an extra instruction such as "focus on cloud suppliers". Every suggestion is a proposal; you decide what goes in scope.

An audit needs at least one scope item to move to Preparing. Up to and including Executing you can still add or remove items - removing an item also removes its audit task, and you are asked what should happen to findings raised from it. Add writes the whole scope at once, so the scope you see in the picker is the scope you get - it is never left half applied.

5. Plan the meeting and invite the participants

The timeline at the top of the audit shows the current step and the actions belonging to it. For the opening meeting there are two separate actions, each with its own button and its own "done on" state:

Create Teams meeting - creates an online meeting in your calendar and invites the team. Auditors and auditees are required attendees, observers optional. Change the date or the times later and the meeting is updated with the audit; when Outlook no longer matches the plan, the timeline says so and offers Update meeting. Open meeting joins it, Remove cancels it for everyone. A meeting the organizer moves in Outlook is mirrored back into the audit.
Send invitations - mails the participants. Moving to Executing prompts you for the final invitation with the definitive team, scope and times. Both mails name the frameworks the audit is conducted against.

Before you fix a moment, use Participant availability: ISOPlanner reads the free/busy information of the required participants from their calendars (times only, never the subject of their appointments) and suggests moments when everyone is free. A conflict is always a warning, never a blockade - you decide.

In the Preparing step the timeline also links straight to Go to Prepare and Execute. Dividing the work and assigning it does not have to be finished before you invite the team: many lead auditors do it with the auditees, for example during the opening meeting, and send the final invitation afterwards.

6. Standardise how you audit: procedures and audit criteria

An audit is only repeatable if the way of auditing is fixed. Two things fix it: a procedure says how an item is audited, and the audit criteria of the item say what has to be true and what proves it. The procedure carries the criteria to the auditee as the questions on the task form.

The procedure library

Procedures live in one procedure library for your whole organisation, shared by every series. Open it with the Procedures button in the command bar of the audit overview - no audit has to be selected, and the library stays reachable when every audit that uses a procedure is already published. The screen shows a short explanation, the matching rules and the list of procedures; Add procedure creates a new one, and you can search and reorder them.

Each procedure is one way of auditing:

its name and description are the instruction for the auditee ("check for these five things ...");
under This procedure audits: you link the scope item it is written for, for example control A.8.34. A new procedure without a name takes the name of the item you link;
its form is generated: when you save a procedure with a linked item, ISOPlanner builds a form from that item's audit criteria and keeps it in step with them. You do not pick or design the form, and it cannot be swapped afterwards. Before the first save the Audit criteria tab shows the questions the form will ask, so you can review or add them right there.

One linked item is the shape everything is built for, and linking a second one asks first: every audit of any of those items then shares this procedure, its form and its result, which is mainly meant for procedures that came out of monitoring tasks (see step 12). A warning also appears when another procedure already covers the item you link - an audit uses one procedure per item, so one of the two would never be used. Extend the existing procedure instead, unless the new one is meant to replace it.

How a scope item gets its procedure

On the Prepare and Execute tab the Procedure column shows the procedure the item is audited with: after assignment the procedure the task was built from, before assignment the procedure ISOPlanner proposes. The column is shown to users who manage procedures; open the procedure from it to edit its audit criteria (see step 8) - that is how a lead auditor prepares the questions item by item. The match is deterministic and predictable - ISOPlanner never guesses on the basis of similar wording, because a procedure silently attached to the wrong item is worse than no procedure at all. The rules are tried in this order:

#	Rule	Shown as
1	A procedure is linked to this exact item (for example the procedure "Assess A.8.34" is linked to control A.8.34).	linked to this item
2	This item was audited in the previous audit of the series. That procedure comes back, and the auditee who did it then is proposed as well.	from the previous audit
3	A procedure has a form about this type of item (a form with a risk field for a risk, an asset field for a supplier, and so on), as long as there is exactly one such procedure. Two candidate forms leave the choice to you.	matched by form
4	Optional: you ask the audit assistant under AI actions to propose a procedure for the items that are still open. Only for tenants with AI enabled, and only when you ask for it.	AI suggestion
5	You pick a procedure yourself while assigning.	chosen manually

No match? Then the item is not left without one: the moment you assign it, ISOPlanner writes a procedure for it in the library, named after the item and linked to it, so the next audit finds it through rule 1 and proposes the same auditee. Its form asks the item's audit criteria. An item that has none yet gets a task without questions for now: open the procedure from the Procedure column, or the item on the Audit criteria tab of Frameworks, and write or draft the criteria there; they appear on the open task as soon as they are saved. Documents from the library are the exception: a document has no audit criteria, so it gets a task with the instruction "Perform the audit of ...", and it can only be matched by rule 1 or 2.

Audit criteria: the questions on the form

Every requirement, control, process, risk, asset, objective and processing activity can carry audit criteria: an ordered list of what must be true for that item and what evidence proves it. They belong to the item, not to a procedure or an audit, so the same question is asked whichever procedure or audit covers the item, and the AI audits judge against the same list. Each criterion has:

Field	What it does
Requirement	The question the auditee answers.
Success criteria	What has to be seen for the answer to be a pass.
Mode	Recurring: judged in every audit, for things that have to happen over and over (reviews, tests, backups) or cover things that come and go (accounts, access rights). One-time: proven once per certification cycle, roughly every three years, through an evidence task linked to the criterion - for a standing arrangement you set up once and leave alone, such as a signed contract or a certificate. One-time does not mean never again.
Verification	AI: the AI audits may judge it. Manual: a person always judges it.
Required, Requires a comment, Requires an attachment	Whether the auditee must answer, must explain the answer, and must attach evidence.
Frameworks	The frameworks the criterion applies to. It is asked in audits that include at least one of them and hidden in audits that include none. A criterion of a control is tagged with every framework it satisfies instead of being repeated per framework; criteria of the other item types apply to every framework unless you narrow them.

Criteria are managed in two places, and nowhere else: centrally per framework on the Audit criteria tab of Frameworks, and on the procedure that audits the item. On the Frameworks tab you pick a framework and every requirement and control shows how many criteria it has, whether they are Reviewed, the state of its Evidence tasks, which Procedures cover it and whether it needs a Re-evaluate; the tiles above the list add the totals. Open an item to edit its criteria as cards, or use the commands for the whole framework:

Generate criteria (AI) drafts the criteria of every requirement and control that has none yet from its framework text, its own description and implementation and its linked documents, in the background. Items that already have criteria are left alone. Inside one item, Add new criteria adds what the documentation newly implies and Delete and create again starts over.
Bulk review walks you through every item whose criteria were never reviewed, changed since the review, or were flagged for re-evaluation because a source changed (a framework activated or upgraded, a requirement link or a document changed). Ticking Reviewed is the statement that a person read them and agrees; the Audit criteria to re-evaluate dashboard widget shows the backlog.
Evidence wizard walks through the one-time criteria that are not verified yet and lets you Select existing task or Create evidence task per criterion. A one-time criterion counts as verified when a person completes or archives its evidence task; AI advice on that task is advice only.

The second place is the procedure: its form shows the criteria of every item it audits as cards. You reach it from the library under Procedures or from the Procedure column of the Prepare and Execute tab. An audit task itself never offers to write criteria: the auditee came to answer them. Two rules protect the record: a criterion that was already answered in an audit is never rewritten - an edit archives the answered version with its answers and asks the new text from the next form version; and no AI draft replaces an existing criterion without a person seeing the current text next to the proposal and approving it.

7. Prepare and execute: divide the work and assign it

The Prepare and Execute tab becomes available once the audit is Preparing. It lists every scope item with its task, its auditee, the status of that task, its result and what publishing will do with it - the whole audit at a glance - grouped by the audit day the item is planned on. Until the audit is completed everything on the tab stays editable. The command bar holds Assign, an Audit days menu (Add day, Move to day), Start, AI actions when AI is enabled, the Show my items only toggle and Refresh. At the end of the bar a ... menu holds the rarer edits: Unassign, Delete from scope and Assess manually.

Plan the audit days

An audit usually runs over more than one day. Every scope item sits under the day it is audited on, with the date as the group header ("August 3"). Items you have not planned yourself sit under the first day of the audit, so nothing is ever hidden.

Add day - in the Audit days menu. Pick a date inside the audit period and the day appears as an empty group, ready to receive items. Days that are already in the planning are greyed out in the picker. Has the audit no end date yet? Then the callout asks for it first and the day picker stays disabled until you fill it in; audit days can only be planned inside the period of the audit. Both values are stored when you press Save, so Cancel really cancels.
Drag and drop - drag a row onto another row of the target day, or straight onto the day header, to move it to that day.
Move to day - select rows and pick the target date. This does exactly the same as dragging, which makes it the reliable route for long lists and touch screens.
Remove day (in the ... menu) - select a day header and remove the whole day. Its items move to the previous day of the audit and their tasks move along with them; you are asked to confirm when the day still holds items. The first day of the audit cannot be removed - it has no day before it, and it is where unplanned items live. The same menu entry reads Delete from scope when you have rows selected instead: one command, and its name says which of the two it is about to do.

Click a day header to select the day itself. That selection is about the day: the only thing you do with it is remove it, so the commands that act on scope items (Assign, Start, Unassign, Assess manually, Move to day, Audit with AI) stay switched off until you select rows instead. Selecting rows and selecting a day are mutually exclusive, which is what keeps one click on a header from re-assigning a whole day of work.

The planned day drives the dates of the audit task: it starts at the beginning of your working day and is due at the end of that same day. Move an item to another day and its open task is re-dated with it. Tasks that are already done keep their own dates. Change the period of the audit and the planning is moved along into the new period.

Assign the scope to the auditees

Select one or more rows.
Choose Assign and pick who does the work. Everyone on this audit's team is offered except the observers - including yourself, which is how a one-person audit is executed. Leave the procedure on Use the matched procedure per item to give every row its own proposal, or type part of a procedure name in the procedure menu and pick one procedure for the whole selection.
Each row gets one task for that auditee, built from the procedure, linked to the item to audit and dated with its audit day. A task audits exactly one item. It is an ordinary task of its own: it appears in the auditee's task list, can be planned in their Outlook calendar, and shows on the Tasks tab of the item it audits. The audit as a whole can only be completed when all these tasks are done.

Assigning again is how you correct yourself: hand the item to another auditee, or pick another procedure and the open task is rewritten with the new instruction and form. Answers already filled in under the old form are not carried over, so change the procedure before the auditee starts. Editing the criteria of the same procedure needs no re-assignment: an open task on which nothing has been answered yet follows the procedure's form by itself. Tasks that are already done are never touched by a re-assignment.

The rest of the command bar

Start - where you go to do the work. It opens the selected item in a new tab, the same screen the auditee works on, with the audit task waiting beside it (see step 8). The arrow beside the button holds Open task, which opens the audit task itself instead. Both halves need an item that already has a task, so Start stays grey until the item is assigned.
Unassign (... menu) - releases the item and deletes the task of the auditee, including anything filled in but not yet finished in it. When findings were raised from that task you are asked what should happen to them: they stay as ordinary tasks and only stop belonging to this audit, unless you tick Also delete the findings. A result already recorded on the scope item stays. Assign the item again to hand it to someone else.
Assess manually (... menu) - record the result of an item yourself, for the parts you audit without handing them to an auditee. One item at a time, and only while the item has no task: once an auditee has a task the result is recorded there.
Delete from scope (... menu) - with rows selected it takes the items out of scope, including their tasks and the work recorded in them, with the same question about the findings. Handy for last-minute changes to the scope. With a day selected the same entry reads Remove day and removes that day (see above).
Show my items only - filters the list to the items assigned to you. This is what a participant opens the list with: "what do I have to do here?".
Refresh - re-reads the list. The auditees work in their own tasks, so their status and outcome appear here after a refresh.

Unassign leaves finished work alone. A completed audit task keeps its result and the auditee who produced it - taking their name off it would rewrite what actually happened - so items whose task is already done are skipped. They are not silently skipped: the unassign does the items it can and then tells you how many it kept and why, so you can reopen a task first if you really do want to hand that item to someone else. Select nothing but finished work and you get that message straight away. Delete from scope is the other way round: it does remove an item whose task is finished, along with the work recorded in it.

The link in the Item in scope column opens the item itself in a new tab - the same screen the auditee works on, and the same thing Start does for the selected row. The icon that appears behind the item name when you point at the row, the Open task entry in the Start menu and a double-click on the row open the audit task. The Procedure column opens the procedure, for those who manage procedures.

Audit with AI

With AI enabled, AI actions offers Audit with AI: the AI audits the controls and requirements in scope against their audit criteria, under the frameworks of the audit, and puts its verdict next to every item in the AI result column. Select rows to audit a part of the scope; no selection audits all of it. Only controls and requirements can be audited this way, and only while their task is still open - a finished task holds a recorded result that must not be overwritten. The dialog tells you how many items will be audited and why the rest is left out, lets you pick the Documentation audit (is the control sufficiently documented?), the Evidence audit (does the evidence prove it operates?) or both, and offers Also re-audit items that already have an AI result. Items without audit criteria get them drafted when the run starts; review those afterwards.

The preparation collects the documents and evidence of every item and takes a few minutes - keep the window open until it has finished. After that the audit continues on its own, so you can close the browser; the results appear per item. Stop AI audit lets the item being audited finish and skips the rest. Clear AI results deletes the stored AI results so the items can be audited afresh; the audit, the tasks and the recorded outcomes stay as they are. The human auditor keeps the final say: an AI result is a proposal until the auditee adopts it in their task (see step 8), and the AI never creates a finding.

Let the audit assistant do the work

With AI enabled, the Copilot panel knows which audit you have open and offers ready-made actions for it:

Divide the work over the audit days - spreads the scope evenly over the days you created and updates the planning.
Assign procedures to auditees - proposes and assigns the best matching procedure and auditee for every item that has no task yet.
What is still missing? - summarises the preparation: which items have no task, which have no procedure, and what to do next.

The buttons only start the conversation; you can ask the same things in your own words ("give Monday to Sarah and Tuesday to the IT team", "put the access control items on the first day"). The assistant changes the planning and the assignments directly instead of handing you a list to copy, and every change is one you can undo yourself on the tab. The list refreshes when the assistant is done.

8. The auditee's work

An auditee finds the audit task in their own task list, in Teams and in their mail. The task opens in a focused view showing only what matters for the audit:

the Audit and the Item to audit, both clickable. The item is the way to the audit itself - see below;
the day the work is Planned on;
the Instruction from the procedure;
the form with the audit criteria of the item: one pass/fail question per criterion, with a comment box and, when the criterion asks for it, an attachment. Only the criteria that apply under the frameworks of this audit are asked. The comment box is also where the auditee leaves a remark about the question itself - "this asks for evidence that does not prove the answer" - which the lead auditor picks up later on the Improvement tab (step 11);
the Result: an Outcome and a Conclusion in which the auditee describes what was examined, which evidence was seen and what the judgement is;
the Previous audit result of this item, collapsed. The outcome is pre-filled from it and Use previous result copies the previous conclusion in - but it is never copied silently, because this year's conclusion has to be about this year's evidence;
with AI enabled, Suggest conclusion drafts the conclusion from the answers, the findings and the evidence of this task, and the AI audit result when the item was audited with AI: the verdict per criterion, the findings and limitations the AI saw, and the report. Take over result fills the outcome, the conclusion and the answers from it into the unsaved task, so the auditee reviews and saves; the AI never proposes a major non-conformity, that judgement stays human. Save report to library stores the AI report as a document next to the item.

The name of an audit task cannot be changed: it says which item is audited with which procedure, and the lead auditor steers it from the Prepare and Execute tab. A task cannot be finished while its result is missing: an outcome has to be selected, the conclusion has to have a minimum length, and every required question has to be answered - the task says which.

A task whose form has no questions says so: the audited item has no audit criteria yet, or none of them apply under the frameworks of this audit. In the first case a manager adds the criteria on the procedure (open it from the Procedure column of the Prepare and Execute tab) or on the Audit criteria tab of Frameworks; they appear on the open task without a re-assignment. The second case needs nothing: there is nothing to answer.

Do the audit where the item lives

You cannot judge a control from a task description. The evidence is on the item itself: its implementation, its documents, its risks, its monitoring, its history. That is why the Item to audit in the task is a link to the item's own screen, opened in a new tab so the task list stays where it was. On that screen the audit work is waiting for you: the Audit task tab in the panel next to the item opens by itself, already on your task for this audit, on whichever tab of the item you are and however you got there. You read the item on the left, you record the result on the right, in one place.

The Audit task tab holds the same work as the task, in a compact form:

the audit it belongs to and the day it is planned on;
the form with the audit criteria, to fill in as you go;
the Outcome and the Conclusion. There is no Save button: the tab saves by itself while you work and shows Saving... and Saved, so nothing is lost by walking away;
the Previous audit result and the AI audit result behind their icon buttons, when there is one;
Previous and Next to walk to your next audit task on this same item, when you have more than one.

The tab only appears when you actually have audit work on that item: it lists your audit tasks that are still open, most urgent first, and it is not there for a colleague, for a task you already finished, or on an item that is not in an audit. Everything you record there is the same record as in the task - the task's status, its result and the Prepare and Execute tab move with it, whichever of the two you worked in.

Documents are the exception. A document from the library has no screen of its own, so its link opens the document the way documents always open in ISOPlanner: the preview, or the file itself when your organisation reads its documents outside the app. You read it there and record the result in the task.

Outcome	Use it for
Not assessed	Not yet judged.
Conform	Meets the requirement, no action needed.
Observation	No non-conformity, but worth an improvement.
Minor non-conformity	Isolated shortcoming.
Major non-conformity	Structural shortcoming, the requirement is not met.

Found something? Create a follow-up task from the audit task - a finding, an incident or an improvement. Such a task is linked to the audit automatically, appears in the report, and keeps its own life: a finding is not thrown away when the audit is finished. The lead auditor can also raise one from the Findings sub-tab of the Reporting tab; it then asks What did the audit find? and you pick the audited item the finding belongs to. The result (outcome, conclusion, who assessed it and when) is saved on the scope item itself, which is why it can be shown as the previous result at the next audit.

A non-conformity always needs a follow-up finding. Minor and major non-conformities are the outcomes that ask for work, so the audit cannot be published while one of them has no finding yet. The Prepare and Execute tab says so per row - Finding required until there is one, Finding created afterwards - so you see it while you are still executing, not when the publish is refused. A finding you raise by hand on the item itself counts too. Observations never hold up the publish: an observation is a remark, not a shortcoming.

9. Complete the audit

Moving to Completed is subject to three hard rules and two checks:

Blocking: all audit tasks with an auditee must be done. As long as such a task is open the audit cannot be completed - the auditees are still working.
Blocking: something must have been audited. An audit in which no item was ever assigned and no result was ever recorded cannot be completed; there would be nothing to report.
Blocking, but you can clear it: open tasks without an auditee. Nobody is doing them, so the confirmation dialog offers to delete them and continue in one go. Assign them instead if the work still has to happen.
Warning: scope items that were never assigned. You can continue, but you are then completing an audit with scope nobody looked at.
Warning: scope items without an outcome.

Warnings never block; they are shown in the confirmation dialog so that skipping something is a decision, not an accident. The dialog also offers Update the report with the latest results when a report exists, so the report is written from the completed audit. Once the audit is Completed the results are frozen: the outcomes and conclusions can no longer be changed. Completing changes nothing outside the audit yet - that happens when you publish. Moving a step back in the timeline is always allowed, and it unfreezes the results again.

Record your own judgement of the audit as a whole in the Conclusion of the audit, on the Reporting tab. It is taken over in the report.

Decide what publishing changes: the "State on publish" column

The audit judges; you decide what the organisation does with that judgement. The last column of the Prepare and Execute list, State on publish, holds that decision per scope item. The audit fills it in from the outcome - a non-conformity proposes the state that says the item has to be worked on again - and you can override it, including with Do not change to leave the item exactly as it is. Nothing is written until the audit is published.

Not every scope item works the same way:

controls, requirements and processes get their implementation status;
objectives, risks, assets, suppliers and processing activities each get a status from their own list;
a document has no status the audit can set. What a conform document produces is an approval round instead - see the next step;
a non-conformity does both: it can write a status back and it needs a follow-up finding. The column shows the status choice with the finding state underneath it.

10. Report and publish

The Reporting tab becomes available once the audit is Preparing and has four sub-tabs: Overview with the numbers, Findings with the tasks that came out of the audit, Report with the report document, and Improvement with what the audit says about your procedures (step 11). The report commands work from Executing onwards and only with the SharePoint integration for reports.

The report

Generate report writes the report from the audit: header data, the frameworks it was conducted against, participants, the documents reviewed, the result per scope item, the findings, and your conclusion. When AI is enabled for your tenant it opens with a written summary of the audit; without it you get the same report without that summary.

Generate the report before you publish. If Microsoft refuses access to the configured Reports library, ISOPlanner shows an error notification and leaves the audit at Completed. Ask your Microsoft 365 administrator to authorize the SharePoint reports and publishing integration for your account and give you access to that library.

The report is a document in your library, not a one-off download. It is built on your own report template, so it carries your styles, header and footer, and you can edit it straight in the preview on this tab - correct a sentence, add a paragraph - or send the team a link so they can edit and comment in Word. Once a report exists the button reads Update report. Update keeps the same document, so its link, its version history and any approval on it survive, and it asks what should happen to the team's work:

Update, keeping the changes and comments of the team (with AI): the report is rewritten with the latest results, the text your team wrote is kept and the points from their comments are taken into it. The comment threads themselves do not survive an update. A comment that disputes a recorded result is never applied - a result is changed on the Prepare and Execute tab, not by rewording the report - and such points come back to you afterwards in Points that did not go into the report.
Start over from the results of this audit: the report is written again from scratch and everything the team changed or commented is replaced. Without AI this is the only thing Update can do, and the dialog says so.

The previous version always stays available in the version history of the document in SharePoint.

A report you generate before the audit is Completed is marked INTERIM in the title: it is a draft of a running audit.
A report with scope items that have no outcome yet says so, with the number of items - so nobody mistakes an unfinished audit for a clean one.
Download report (PDF) and Send report to team use exactly the document that is stored. Before the audit is published, sending mails the whole team - auditors, auditees and observers - a link to the Word document so they can add their changes and comments. From Published onwards it mails the final PDF as an attachment. Everyone also gets a notification in ISOPlanner.

Publish

Publish makes the audit final and is the moment the verdict becomes binding. Four things happen:

The report is frozen. The PDF is rendered once and stored with the audit. Downloads and mails from then on serve that exact file, whatever happens to the document in the library afterwards, and the Report sub-tab shows it read-only.
The statuses are written back. Every scope item whose State on publish is not "Do not change" gets that status, with an entry in its own change log.
Approvals are offered for the documents you found conform. A document has no status to set, so what the audit produces for it is an approval round. The timeline offers Create approvals: ISOPlanner opens the approval panel on exactly those documents, pre-filled with the approvers it can work out - the workflow of the template, the people who approved the previous round, or the document owner. You review them, and you send or cancel. Closing the panel creates nothing, so the action stays available on the Published step for as long as you need it. Documents already out for approval are left alone: a second parallel round asks the same people the same question.
The next audit of the series is created on the next date in the pattern. It starts with the same scope and frameworks, without the results - and it proposes per item the procedure and the auditee of this audit, so a repeat audit is a matter of reviewing and confirming.

Publishing is refused while a non-conformity has no follow-up finding (see step 8), while the SharePoint integration for reports is unavailable, or while the audit has no report document. When the report is older than the results - written before the audit was completed, or before an item was assessed - the dialog warns and offers Update the report with the latest results, which runs before the report is frozen. Publishing is also walked one step at a time: you cannot jump from Created straight to Published.

Findings are the exception to the lock. They keep a life of their own, so you can still manage them on the Findings sub-tab after the audit has been published: a finding has to be solved, or escalated to an incident, long after the audit is closed.

Let the assistant check your findings

Open the assistant on an audit that is being executed or later and choose Analyze results and propose findings. It goes through the results you recorded and answers two questions: is there a result that warrants a finding but has none yet, and does an existing finding still contain only the generic text of the template it was created from? It then proposes new findings and rewrites of existing ones, with a description and a checklist about the item that was actually audited, and labels where they fit.

Nothing is saved until you approve it. Review the proposal, ask for changes in your own words, remove what you do not want, and pick per new finding the template it should be created from - that template gives the finding your own form and the label that says what kind of finding it is. Findings you already solved yourself are left alone.

11. Improve the procedures from what the auditees said

Nothing flows back into the shared procedure library on its own. The Improvement sub-tab of the Reporting tab collects every remark the auditees wrote in the comment boxes beside the questions, so you can decide what deserves to change. A remark that says "this question is unclear" or "this asks for evidence that does not prove the answer" is about the audit criterion behind the question, and a change there reaches every procedure that asks it and the AI audits alike. The tab stays available after the audit is published: improving the procedures is what happens after the record closes.

Analyze the remarks (under AI actions) picks the remarks that are about the procedure rather than about this one audit and writes an evaluation and a recommendation per remark. Remarks that only record what was found are set aside.
Improve the audit criteria drafts a new text for every criterion the selected remarks are about and shows them in Approve the criterion changes: the current text next to the proposed one, both proposed fields editable, a tick per draft, and Apply approved changes after a confirmation naming the count. Applying creates a new version of each criterion: the version the auditors answered is archived with its answers, every procedure covering the item asks the new question on its next form version, and the criteria enter the Bulk review queue as changed since review. This round runs once per audit and drafts at most ten criteria: a second round would build on texts the auditors never answered against. A remark on a question the procedure's own form added, rather than a criterion, can only become a task.
Create a task for it makes one task for the lead auditor with a checklist item per remark and the recommendation as its comment. One task per audit; a second click opens the existing one.
Work without a procedure lists the audit tasks that were done without a procedure from the library but are worth repeating - they carry a form, a checklist or a hand-written instruction. Apply to library turns the ones you tick into procedures, so the next audit of those items starts from this work. A task named like a procedure that already covers the item improves that procedure instead of adding a second one.

12. Upgrade annual plan tasks to an audit series

Many organisations already run recurring monitoring tasks in the annual plan that are audits in all but name. Select one or more active recurring annual plan tasks in the annual plan and choose Upgrade to audit from its overflow menu. A five-step wizard - Sources, Team, Scope, Schedule, Review - proposes a series from them: the combined context of the tasks as the scope (remove what does not belong; the last item cannot be removed), the assignees as the team with at most one lead auditor, one of the source rhythms as the recurrence (an audit repeats monthly at most), and the checklists and forms of the tasks as new procedures in the library, one per group of tasks that audit the same items.

Create audit asks for confirmation and names what happens: the series starts on the first date in the pattern after the work you already recorded, the selected annual plan tasks are completed so the work is not scheduled twice, and their unfinished instances in the current audit year are removed. Completed instances and their evidence stay where they are; the series shows its origin under Annual plan tasks on the Details tab with a link to that history. An annual plan task can be upgraded once; selecting it again points you at the existing series. The conversion is a snapshot: later changes to the source tasks do not reach the series.

The statuses at a glance

Status	What happens	Condition for the next step
Created	Complete the details, set the frameworks and put the audit team together.	At least one auditor or lead auditor, and every participant granted. An auditee is optional.
Planned	Determine the scope and collect the documents to review. Create the Teams meeting and invite the participants.	At least one scope item.
Preparing	Divide the scope over the audit days and assign it to the auditees, with the team if you like. The frameworks can still be changed. Then send the final invitation.	-
Executing	The auditees do the work on the screens of the items themselves and record their results and findings; you keep steering the planning and the assignments, and can let the AI audit the controls first.	All audit tasks done, no open task left without an auditee, and at least one item audited.
Completed	Results are frozen. Write the conclusion and the report. Nothing outside the audit changes yet.	Every non-conformity has a follow-up finding, a report exists, and the Reports integration is on.
Published	The report PDF is frozen, the statuses are written back, approvals are offered for the conform documents, the audit is locked and the next occurrence is created. Findings and the Improvement tab stay open.	-

Questions and troubleshooting

The Procedure column says "No procedure" for every item

Nothing is assigned yet and no procedure in the library matches the items: the library is empty, or none of its procedures is linked to these items and none audited them before. Assign the items: ISOPlanner writes a procedure per item as it goes, or you add them yourself with the Procedures button in the audit overview. From the second audit onwards the previous audit fills the column by itself.

The auditee's task has no questions

The audited item has no audit criteria yet, or none of them apply under the frameworks of this audit. In the first case a manager opens the procedure from the Procedure column and writes or drafts the criteria there, or drafts them for the whole framework with Generate criteria on the Audit criteria tab of Frameworks; the questions appear on the auditee's open task as soon as they are saved. In the second case the task says so and nothing has to be answered - the auditee records the outcome and the conclusion.

I changed the criteria but the auditee's task still shows the old questions

A task on which something has already been answered keeps the questions it was answered on; only an open task without any answer follows the changed procedure. The answered version stays part of the record and the new text is asked on the next audit of the item. An auditee who has the task open in the browser sees the new questions after reopening it.

Add day and Move to day are greyed out

Both sit in the Audit days menu. They are disabled when the audit has no start date, because there is no period to plan days in - set the dates of the audit on the Details tab. Move to day also needs selected rows. Missing only the end date? Then Add day asks for it and sets it for you.

Dragging a row does not move it

Drop it on a row of the target day or on the day header - the empty space below a day is not a drop target. Move to day always works and can move a whole selection at once.

Assign and Unassign are greyed out although I selected something

You selected a day, not rows. A selected day can only be removed; select the rows you want to work on and the item commands come back. Unassign additionally needs a selected row that has an auditee. Both commands live in the ... menu at the end of the command bar.

Unassign says it kept some items

Those items have a completed audit task. A completed task keeps its result and the auditee who did the work, because taking the name off finished work would rewrite the record of the audit - so unassign does the items it can and reports the rest. Do you really need to hand such an item to someone else? Open the task with Start > Open task, reopen it, and unassign the item after that.

Assess manually is greyed out

Assess manually records the result of one item at a time, and only while that item has no task. Select a single row without an auditee. An item that has a task gets its result in that task.

Start is greyed out

Start opens the selected item with its audit task, so it needs exactly one row that already has a task. Assign the item first. Without a selection, or with several rows selected, there is no single item to start on.

Audit with AI is greyed out or audits fewer items than I selected

The AI audits controls and requirements only, and only those whose task is still open. It is disabled when the scope holds none of those, when a day is selected instead of rows, or while a run is going on. When it is enabled the dialog names how many items it will audit and why the others are left out. The audit also has to name at least one framework: the run is conducted under the frameworks of the audit.

I cannot change the frameworks of the audit

The list is locked from Executing onwards, because the questions the auditees are answering follow from it. Move the audit back to Preparing with Previous in the timeline if you really have to change it; answered questions of a removed framework stay read-only, unanswered ones disappear.

The auditee cannot finish the task

The task asks for a result before it can be finished: select an outcome and write a conclusion of the minimum length. Required questions on the form have to be answered too; the task names the ones that are still blank.

An auditee says they cannot open the audit

Their work never depends on it: an auditee works from their task and from the item the task points at, and everything they need - the item with all its evidence, the instruction, the previous result and the result to record - is in those two places.

Opening the audit itself is separate, and it is what the link in their invitation mail does. For that they need read rights in the authorization schema of the series, on top of being on the audit's team. If they land on a not-authorized page, the schema is shutting them out: add them to it, and the audit's Prepare and Execute tab opens read-only. The audit team on the Details tab says per participant whether their rights are in order, so you can see it there before they complain.

Everything else about the audit stays for managers: a participant sees that one tab, and cannot edit anything on it.

I do not see the Audit task tab on the item

The tab is only there for your own open audit work on that item, and it opens by itself when there is any. It is hidden when the task is assigned to somebody else, when you already finished it, and when the audit is completed or published. A colleague's audit task is visible to the lead auditor on the Prepare and Execute tab, not on the item.

The item link opens a preview instead of a screen

Then the item is a document from the library. A document has no screen of its own, so it opens the way documents always open here - the preview, or the file itself. Read it there and record the result in the task.

I do not see the Audit menu item

Four things have to allow it: you need a manager role, Audit has to be part of your subscription, the module has to be on under Admin > Company > Modules, and - while the module is in preview - it has to be enabled for your tenant by ISOPlanner. Your administrator can check the first three; for the last one, contact support. The same conditions decide whether audits appear in your annual plan.

Being on an audit team does not add the menu item, and that is not a fault: a participant without a manager role reaches their one audit through the link in their invitation mail, not through the audit overview. They can also add the Active audits widget to their dashboard. It lists the active audits they participate in and opens Prepare and Execute read-only. The overview lists the audits of the whole organisation, which stays a manager's screen.

New audit template is greyed out in the audit overview

You do not have the Create Audit Template permission. An administrator can grant it per role under Admin > Authorization > Permissions > Audit. You do not need it to run an existing series - only to start a new one.

New audit from this template is greyed out

The series still has an audit that is not published. Publish it - or delete it, if it was created by mistake - and the button comes back. A series has one current audit at a time.

I cannot move the audit to Planned

Either the team is incomplete - it needs at least one auditor or lead auditor; an auditee is not required - or somebody on it cannot act in the role they were given. The confirmation dialog names them. Open the Audit team on the Details tab: the line next to each role says what is wrong. An auditor or lead auditor needs a manager role and edit rights in the authorization schema of the series; an auditee or observer needs read rights. Fix it by giving them rights in the schema, or by giving them a role they can hold - a user without a manager role can be an auditee or an observer, never an auditor.

I cannot complete the audit

There is still an audit task open, or nothing was audited at all. The Prepare and Execute tab shows the status of every task (use Refresh for the latest state); chase the auditee, or take the item out of scope if it turns out not to be relevant. Is the task without an auditee? Then the confirmation dialog offers to delete those tasks and complete the audit in one step. An audit in which no item was ever assigned or assessed cannot be completed: assign at least one item, or record a result yourself with Assess manually.

I cannot publish the audit

Check the messages in the confirmation dialog. A non-conformity may have no follow-up finding, the SharePoint integration for reports may be unavailable, or the audit may have no report document. Generate the report on the Report sub-tab and resolve any access notification with your Microsoft 365 administrator. For missing findings, create a follow-up task from the audit task or use Analyze results and propose findings. Also check that you are moving one step at a time: an audit is published from Completed, not straight from Executing.

Generate report says I do not have permission

Your Microsoft account cannot write to the configured Reports library. Ask your Microsoft 365 administrator to authorize the SharePoint reports and publishing integration for your account and give you access to that library. The audit remains Completed until the report is generated successfully.

The report says INTERIM

It was generated while the audit was still running. Use Update report once the audit is Completed and the marker is gone. The same goes for the notice about items without an outcome: it disappears when every scope item has been assessed. The publish dialog warns about an outdated report and offers the update, so the interim version never becomes the final report unnoticed.

Update report asks me to choose what happens to the team's changes

Somebody edited the report document after it was written, and the dialog names who and when. Choose Update, keeping the changes and comments of the team to bring the results up to date without losing their work, or Start over from the results of this audit to replace everything. Without AI only the second is possible, and the dialog tells you so before it replaces anything. Either way the previous version stays in the version history of the document in SharePoint.

The team received a link instead of the PDF

The audit is not published yet, so Send report to team sends a link to the Word document: the report is still a draft the team may edit and comment on. Once the audit is Published the same button mails the frozen PDF.

A document I audited did not get an approval

Approvals are only offered for documents you assessed as conform, and they are never created automatically - you send them yourself from the panel behind Create approvals in the timeline. If the panel says everything is already out for approval, a round on those documents is still pending and ISOPlanner will not start a second one alongside it.

Improve the audit criteria is greyed out on the Improvement tab

Either the criteria of this audit were already improved once - the tab shows the date - or none of the selected remarks is about an audit criterion. The criteria round runs once per audit, because a second round would build on texts the auditors never saw; for anything left over, Create a task for it. A remark on a question the procedure's own form added is not a criterion and can only become a task.

I moved the audit to another period

The open audit tasks, the day planning and the Teams meeting move with it; days that would fall outside the new period are pulled inside it. Tasks that are already done keep their own completion date.

What happens to the findings if I delete the audit?

The audit tasks disappear with the audit, but the findings, incidents and improvements stay: they have value of their own and are still in your task list. Deleting a series deletes all its audits with it; the procedures in the library are not touched, because they belong to the organisation.

Where do I see the audits I am involved in?

Add the Active audits widget to your dashboard. In the audit overview you can also filter on auditor, auditee, observer, status, type and period.