Skip to main content
Ref · AP-FY2026-001Live previewApprovedInternal use only

Audit 360 · by Sigmoid Analytica

The audit trail starts at planning.

Risk-based planningGoverned executionAudit-ready artefacts.

See how it works

Guided onboarding · No free trial · No self-serve setup

  1. 01

    Discovery

    ProducesUnderstanding workspace

  2. 02

    Risk

    ProducesRisk register

  3. 03

    Planning

    ProducesAnnual Internal Audit PlanAIP-2026-001

  4. 04

    Execution

    ProducesEngagement LetterEL-2026-014

  5. 05

    Governance

    ProducesDeclarations record

  6. 06

    Publication

    ProducesBP · AIP · RAR · ELPack 2026

  7. ↺

    Returns to 01 · Discovery for the next cycle.

Aligned with
IIA IPPFKing IVISO 19011POPIA-resident
Lifecycle
  1. Draft
  2. Under review
  3. Approved
  4. Locked

Fig 2 · Diagnostic

FND-2026 · 5 findings

Internal audit is still fragmented.

Planning, risk registers, engagement readiness, declarations, and formal artefacts still live across separate tools. We took the diagnostic that actually shows up on internal-audit working papers, and listed it the way an audit team would.

FND-2026-001Severity · High

Risk Register

FY26 · p.03

RSK-01Ghost employeessrc → eng ✓
RSK-02Bid-committeesrc → eng ✓
RSK-03- - - - -? → ??
RSK-04Fuel-card misusesrc → eng ✓
trail?

The risk story gets lost.

Source documents drift from the plan; the trail from risk to engagement is hard to reconstruct.

FND-2026-002Severity · High

Annual Plan

AIP · FY26 · draft

Coverage72% of universe?vs last yr?
Capacity5.4 FTE · 1 040 hrs?burn rate?
Rationalesee Appendix B?where?
Approver

Annual plans are hard to defend.

Coverage, capacity, and rationale live in separate sheets; committee questions reopen each year.

FND-2026-003Severity · Medium
Plan
Kickoff
Fieldwork
Report

From · bob@dept.gov.za

Declaration signed off

decl_conflict_bd.pdf · 22 Jan

not in platform

Declarations live outside the flow.

Conflict and independence checks are signed in email or paper, not the system that owns the engagement.

FND-2026-004Severity · High

BP · pg 2

AIP · pg 5

RAR · exec sum.

Q4 · assembled by hand

Artefacts assembled by hand.

BPs, AIPs, and RARs get pasted together at quarter-end from snapshots that should have been the same record.

FND-2026-005Severity · Medium

Governance memo

v3

Nomsa D.

28 May 26

·

no events

Platform

Governance lives on paper.

Sign-off discipline lives on paper, not in the platform that runs the operations it claims to govern.

The pivot

Audit 360 is one connected internal-audit operating platform.

SourceRiskPlanEngagementArtefact
See the artefacts →

More intuitive than heavy enterprise suites. More governed than spreadsheets and generic workflow tools.

One trail from source material to audit action.

Audit 360 is built around a six-phase internal audit operating model. Work moves from understanding and risk assessment into planning, governed execution, readiness control, and formal output, with traceability preserved throughout.

Each phase has a defined purpose

Each handoff is visible

Each gate is part of the platform, not a side process

  1. 01

    Phase 01 · Discovery

    Understand the environment

    Capture strategic documents, interviews, minutes, policies, and other source material in the Understanding workspace.

    Understanding workspace

    Working
  2. 02

    Phase 02 · Risk

    Identify and score risks

    Turn source-based observations into a structured risk register with scoring, classification, and audit conclusions.

    Risk register

    Working
  3. 03

    Phase 03 · Planning

    Build the annual plan

    Translate identified risks into a defendable annual plan with linked coverage, prioritised plan items, and committee-facing structure.

    AIP-2026-001

    Formal
  4. 04

    Phase 04 · Execution

    Launch governed engagements

    Create engagements from the plan, carry forward the audit rationale, and issue the engagement artefacts that govern the work.

    EL-2026-014

    Formal
  5. 05

    Phase 05 · Governance

    Control readiness and independence

    Manage declarations, approvals, and readiness controls so audit work starts only when governance conditions are met.

    Declarations record

    Working
  6. 06

    Phase 06 · Publication

    Produce audit-ready artefacts

    Generate the formal outputs that support review, oversight, and audit-file completeness.

    Pack 2026

    Formal

The same operating model can be read in two ways: as the six-phase audit trail above, or as the formal artefacts reviewed in governance and committee contexts (next section ↓).

See it on a real plan

The audit artefact pack as first-class platform objects.

Every artefact is a real platform object with live-preview, approval, and locked states, not a document assembled afterwards.

Showing 4 of 4 · Audit pack 2026

AllApprovedLiveIssued

Each artefact is part of the operating model: draft, live-preview, approved, and locked states are platform behaviour, not status fields someone updates by hand.

From root cause to audit response.

Audit 360 is designed to support more data-driven assurance. Signals, patterns, and exception themes don't have to live in a separate analytics silo. They inform audit focus, engagement design, and governed follow-through.

Col 1 · Root cause

Col 2 · Risk theme

Col 3 · Audit response

Col 4 · Artefact produced

Analytics-led assurance: root cause to artefactA four-column flow from root cause to risk theme to audit response to the platform artefact each response produces: AIP entry, Engagement Letter, Findings register, or RAR update.Access / control failure flows to Procurement riskAccess / control failure flows to Revenue riskAccess / control failure flows to Cyber / IT riskAccess / control failure flows to Payroll riskProcess breakdown flows to Revenue riskProcess breakdown flows to Compliance riskProcess breakdown flows to Payroll riskWeak governance flows to Asset / fleet riskWeak governance flows to Procurement riskWeak governance flows to Payroll riskData quality issues flows to Asset / fleet riskData quality issues flows to Revenue riskData quality issues flows to Compliance riskData quality issues flows to Project delivery riskCapacity constraints flows to Asset / fleet riskCapacity constraints flows to Compliance riskCapacity constraints flows to Project delivery riskAsset / fleet risk flows to Annual plan focusAsset / fleet risk flows to Scoped engagementProcurement risk flows to Annual plan focusProcurement risk flows to Scoped engagementProcurement risk flows to Exception monitoringRevenue risk flows to Annual plan focusRevenue risk flows to Continuous testingRevenue risk flows to Advisory reviewCompliance risk flows to Annual plan focusCompliance risk flows to Advisory reviewCyber / IT risk flows to Scoped engagementCyber / IT risk flows to Continuous testingProject delivery risk flows to Scoped engagementProject delivery risk flows to Advisory reviewPayroll risk flows to Exception monitoringPayroll risk flows to Continuous testingAnnual plan focus flows to AIP entryAnnual plan focus flows to RAR updateScoped engagement flows to Engagement letterScoped engagement flows to Findings registerException monitoring flows to Findings registerException monitoring flows to RAR updateContinuous testing flows to Findings registerContinuous testing flows to RAR updateAdvisory review flows to Findings registerAdvisory review flows to RAR updateAccess / control failurePermission gaps, segregation-of-duty breaks, and weakly enforced approval boundaries.Access / control failuree.g. dormant admin accounts still able to approve payment runs.Process breakdownSteps that drift from their design: informal workarounds, undocumented exceptions, hand-offs that lose context.Process breakdowne.g. purchase-order authorisation done retrospectively via email thread.Weak governanceAuthority, oversight, and sign-off gaps that let exposure accumulate before anyone owns it.Weak governancee.g. audit committee did not review Q3 exception log before quarter-end.Data quality issuesSource data that’s incomplete, stale, or inconsistent across systems. Auditable signal becomes noise.Data quality issuese.g. three systems, three different vendor IDs for the same supplier.Capacity constraintsStretched delivery teams that drop discipline before they miss deadlines.Capacity constraintse.g. one senior reviewer covering three concurrent engagements at year-end.Asset / fleet riskAsset register mismatch, fleet utilisation outliers, write-off and disposal discipline.Asset / fleet riskProcurement riskSplit awards, related-party suppliers, contract-value drift across the cycle.Procurement riskRevenue riskTariff misapplication, leakage, billing-cycle exception accumulation.Revenue riskCompliance riskRegulatory deadline drift, mandatory-disclosure gaps, statutory return errors.Compliance riskCyber / IT riskIdentity exposure, configuration drift, third-party integration weakness.Cyber / IT riskProject delivery riskSchedule slippage, milestone-payment misalignment, capex/opex classification drift.Project delivery riskPayroll riskGhost employees, overtime abuse, payroll-system override exposure, leave-balance integrity.Payroll riskAnnual plan focusThemes that earn dedicated coverage in the FY plan with explicit risk justification.Annual plan focusScoped engagementThemes that trigger a scoped engagement: declarations, planning workspace, engagement letter, fieldwork.Scoped engagementException monitoringThemes the analytics layer watches continuously. Exception streams routed to audit triage.Exception monitoringContinuous testingRule- or anomaly-based testing runs that fire on data refresh, not on calendar.Continuous testingAdvisory reviewThemes audit takes on in an advisory posture: design review, control walk-through, pre-go-live diligence.Advisory reviewAIP entryA line in the Annual Internal Audit Plan with risk-coverage justification and assigned engagement window.AIP entryEngagement letterIssued Engagement Letter with scope, declarations record, and gate-enforced approval lineage.Engagement letterFindings registerFindings with severity, lineage back to the source observation, and a tracked remediation lifecycle.Findings registerRAR updateQuarterly or trigger-driven update to the Risk Assessment Report with conclusion shifts and re-rating evidence.RAR update

Read

From root cause to audit response

Hover any node to trace its full upstream and downstream path through the chain. Hover a flow to follow one band end-to-end.

  1. Access / control failure: Permission gaps, segregation-of-duty breaks, and weakly enforced approval boundaries.
    1. flows to Procurement risk, which drives:
      1. Annual plan focus, producing AIP entry, RAR update
      2. Scoped engagement, producing Engagement letter, Findings register
      3. Exception monitoring, producing Findings register, RAR update
    2. flows to Revenue risk, which drives:
      1. Annual plan focus, producing AIP entry, RAR update
      2. Continuous testing, producing Findings register, RAR update
      3. Advisory review, producing Findings register, RAR update
    3. flows to Cyber / IT risk, which drives:
      1. Scoped engagement, producing Engagement letter, Findings register
      2. Continuous testing, producing Findings register, RAR update
    4. flows to Payroll risk, which drives:
      1. Exception monitoring, producing Findings register, RAR update
      2. Continuous testing, producing Findings register, RAR update
  2. Process breakdown: Steps that drift from their design: informal workarounds, undocumented exceptions, hand-offs that lose context.
    1. flows to Revenue risk, which drives:
      1. Annual plan focus, producing AIP entry, RAR update
      2. Continuous testing, producing Findings register, RAR update
      3. Advisory review, producing Findings register, RAR update
    2. flows to Compliance risk, which drives:
      1. Annual plan focus, producing AIP entry, RAR update
      2. Advisory review, producing Findings register, RAR update
    3. flows to Payroll risk, which drives:
      1. Exception monitoring, producing Findings register, RAR update
      2. Continuous testing, producing Findings register, RAR update
  3. Weak governance: Authority, oversight, and sign-off gaps that let exposure accumulate before anyone owns it.
    1. flows to Asset / fleet risk, which drives:
      1. Annual plan focus, producing AIP entry, RAR update
      2. Scoped engagement, producing Engagement letter, Findings register
    2. flows to Procurement risk, which drives:
      1. Annual plan focus, producing AIP entry, RAR update
      2. Scoped engagement, producing Engagement letter, Findings register
      3. Exception monitoring, producing Findings register, RAR update
    3. flows to Payroll risk, which drives:
      1. Exception monitoring, producing Findings register, RAR update
      2. Continuous testing, producing Findings register, RAR update
  4. Data quality issues: Source data that’s incomplete, stale, or inconsistent across systems. Auditable signal becomes noise.
    1. flows to Asset / fleet risk, which drives:
      1. Annual plan focus, producing AIP entry, RAR update
      2. Scoped engagement, producing Engagement letter, Findings register
    2. flows to Revenue risk, which drives:
      1. Annual plan focus, producing AIP entry, RAR update
      2. Continuous testing, producing Findings register, RAR update
      3. Advisory review, producing Findings register, RAR update
    3. flows to Compliance risk, which drives:
      1. Annual plan focus, producing AIP entry, RAR update
      2. Advisory review, producing Findings register, RAR update
    4. flows to Project delivery risk, which drives:
      1. Scoped engagement, producing Engagement letter, Findings register
      2. Advisory review, producing Findings register, RAR update
  5. Capacity constraints: Stretched delivery teams that drop discipline before they miss deadlines.
    1. flows to Asset / fleet risk, which drives:
      1. Annual plan focus, producing AIP entry, RAR update
      2. Scoped engagement, producing Engagement letter, Findings register
    2. flows to Compliance risk, which drives:
      1. Annual plan focus, producing AIP entry, RAR update
      2. Advisory review, producing Findings register, RAR update
    3. flows to Project delivery risk, which drives:
      1. Scoped engagement, producing Engagement letter, Findings register
      2. Advisory review, producing Findings register, RAR update

The thesis

Audit administration earns trust. Analytics creates distinction.

Governance built into the operating model, not bolted on.

Sign-off, traceability, and lifecycle discipline are platform behaviour. Every action carries its chain of custody.

See the audit trail →

All gates active6 controls4 gating · 2 trailing

Cycle · FY2026

CTRL-001
Enforced
01Gate
Active

Role-based approvals

Every state transition requires a role-appropriate approver before it commits. No approval, no transition.

CTRL-002
Enforced
02Gate
Active

Declaration gates

Conflict and independence declarations are required before fieldwork begins. The platform enforces it, not the manager.

CTRL-003
Enforced
03Gate
Active

Structured risk scoring

Risks are scored on a structured impact × likelihood matrix with lineage to source observations, not free-form notes.

CTRL-004
Enforced
04Trail
Active

Source → risk → plan → engagement trail

Every artefact carries lineage back to the source documents it was built from. Traceability is a query, not a reconstruction.

CTRL-005
Enforced
05Trail
Active

Audit trail, tenant-isolated

Every write recorded with actor, timestamp, and before/after state. Trail data does not cross tenant boundaries. Ever.

CTRL-006
Enforced
06Gate
Active

Committee-ready artefacts

Artefact lifecycle states (draft, live-preview, approved, locked) are platform behaviour, not a status column someone updates by hand.

Each control is a platform behaviour that fires at known phases of the trail above. Gates block transitions; trails record every action. Together they are why the artefact pack is defensible to committee, not because someone polished a PDF.

Built for the people who govern internal audit, not just the people who record it.

Audit 360 supports the real roles that shape internal audit work, from annual planning and engagement readiness to formal artefact review, approval, and oversight.

  1. CAE / Audit Director

    Strategy and approval

    Set direction, approve plans, and review formal artefacts with clearer visibility from risk identification through to audit action.

  2. Audit Managers

    Governance and control

    Control engagement readiness, declarations, planning discipline, and the governance conditions that must be met before work begins.

  3. Audit Teams

    Execution and delivery

    Move from planning and risk-linked engagements to testing, evidence, findings, and delivery in one connected workflow.

  4. Committee-facing outputs

    Oversight and assurance

    Support oversight with formal artefacts that are structured, traceable, and ready for review, challenge, and approval.

Governance is real when it is role-bound. Every gate above fires at a named role; every artefact below is approved by one.

More intuitive than heavy enterprise suites. More governed than spreadsheets.

Book a guided walkthrough on a real plan, real risks, real artefacts. Forty-five minutes, tailored to your audit environment.

Guided onboarding · No free trial · No self-serve setup