Live Search spaceKey ZenGRCOnboardingGuide additional none placeholder Search our site type page
Overview
This step differs between external and internal audits.
For an external audit, this is the step to export data in a CSV file showing the relationship between the objectives and controls. The CSV file can then be sent to external auditors who use it to structure the Document Request List (DRL).
For an internal audit, this step allows you to choose whether or not assessments will be generated as part of the audit. It also allows the selection of default assessors and verifiers on assessments, which are generated added to objects when the audit is activated.
External Audit - Exporting Audit Data
To export audit data for an external audit, complete the following steps:
Click Export Audit Data. The CSV file will open or download in the manner you've specified in your browser.
Click Close to pause the audit. This puts the audit in a draft state.
Alternatively, click any of the circled step numbers at the top of the screen to continue with audit setup.
Audit Data
The audit data is structured to show your external auditors how your organization's controls map to the objectives in your compliance program. It can also help them arrange an interview schedule with relevant control owners.The following are the column headings in the CSV file:
- Control Code
- Control Title
- Control Description
- Control Owner
- Objective Code
- Objective Title
- Objective Description
Exporting Data After the Initial Export
There may be several reasons for exporting a CSV file after it's been initially exported.| Tip | ||
|---|---|---|
| ||
If the step has been completed, a green check mark displays instead of the step number. |
Click Need to export audit data again?
Exporting Data After the Audit is Activated
There may be several reasons for exporting a CSV file after it's been initially exported.
To generate another file with audit data, complete the following steps:
Click the circled number or green check mark displayed at the top of the audit set up page.| Tip | ||
|---|---|---|
| ||
If the step has been completed, a green check mark displays instead of the step number. |
| Tip | ||
|---|---|---|
| ||
Complete this step to automatically populate default assessors and verifiers of the audit's assessments. These selections utilize certain fields from the controls being assessed, as well as the Audit managers field that was filled out in Step 1 of audit creation. |
| Tip | ||
|---|---|---|
| ||
All of the information in this step is optional. To bypass setting up assessors or verifiers, click Next to continue with the next step, or click any of the circled step numbers at the top. |
Generating Assessments
To determine whether assessments will be created when the audit is activated, complete the following:
- Select the Yes radio button under Would you like to perform control assessments?
- Alternatively, select No to prevent their generation.
Anchor assessmentTemplate assessmentTemplate
Assigning Default Assessors and Verifiers
| assessmentTemplate | |
| assessmentTemplate |
Selections in this step add assessors and verifiers to the audit's assessments, which are automatically generated when the audit is activated.
- Default assessors - These are the users conducting the testing and whose names are placed in the Assessor field of the assessments.
Depending on the selection, Default assessors pulls information from the following fields and adds them to the Assessors field of the audit's assessments:- Selecting Control owner uses names in the Owner field of the control being assessed.
- Selecting Audit managers uses names added to the same field in Step 1 of audit setup. The following screenshot is from Step 1 and displays the audit manager. If there is more than one name, they all are added to the Assessors field in the assessment.
- Selecting Primary Contact pulls from the Primary contact field of the control being assessed.
- Selecting Secondary Contact pulls from the Secondary contact field of the control being assessed.Selecting Other leaves the Assessor field blank for all assessments generated.
Default verifiers - These are the users conducting the testing and whose names are placed in the Verifier field of the assessments.
Depending on the selection, Default verifiers pulls information from the following fields in ZenGRC and adds them to the Verifiers field of the audit's assessments- Selecting Audit managers uses names added to the same field in Step 1 of audit setup.
- Selecting Other leaves the Verifier field blank for all assessments generated.
Selecting None leaves the Verifier field blank for all assessments generated.
Click Next to complete the step.
3: Setting up Audit RequestsInfo title NOTE Continue to the next section - Step 5: Reviewing and Starting the Audit.