> ## Documentation Index
> Fetch the complete documentation index at: https://docs.matproof.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Programs

> Plan and execute internal compliance audits, manage findings, and generate audit reports.

## Overview

Matproof's Audit Programs module lets you run structured internal compliance audits against your frameworks. Create audit programs, assign auditors, work through control checklists, log findings, and generate a final audit report — all in one place.

<CardGroup cols={2}>
  <Card title="Audit Programs" icon="clipboard-list">
    Plan and scope audits, assign auditors, track progress
  </Card>

  <Card title="Audit Reports" icon="file-chart-column">
    Generate PDF reports with findings, gaps, and recommendations
  </Card>

  <Card title="Audit Dashboard" icon="chart-bar">
    Upcoming audits, overdue items, findings by severity
  </Card>

  <Card title="External Auditors" icon="user-check">
    Invite external auditors with read-only access
  </Card>
</CardGroup>

## Creating an audit program

Navigate to **Audit Programs** (`/[orgId]/audit-programs`) and click **New Audit Program**.

You will configure:

| Field         | Description                                                    |
| ------------- | -------------------------------------------------------------- |
| **Framework** | The compliance framework being audited (ISO 27001, DORA, etc.) |
| **Scope**     | Which systems, departments, or processes are in scope          |
| **Auditor**   | Internal team member or external auditor assigned to lead      |
| **Schedule**  | Start date, end date, and any recurring cadence                |

Once created, Matproof auto-generates an **audit checklist** from the controls attached to the selected framework. Every in-scope control becomes a checklist item.

## Running the audit checklist

Inside a program (`/[orgId]/audit-programs/[programId]`), the checklist view shows all controls to be reviewed. For each control, the auditor can:

* Mark the control as **Conformant**, **Partial**, or **Non-conformant**
* Add **notes** on what was reviewed and how
* Attach or request **evidence** directly from the checklist item
* Log a **finding** when a gap or deficiency is identified

<Tip>
  Evidence requests can be sent to control owners from within the checklist. They receive a notification and can upload evidence without needing access to the full audit program.
</Tip>

## Logging findings

A finding is a documented gap, deficiency, or non-conformity identified during the audit.

Each finding includes:

* **Title** — short description of the gap
* **Severity** — informational, minor, major, critical
* **Linked control** — which control it relates to
* **Description** — detail on what was found and why it is an issue
* **Recommendation** — suggested remediation
* **Status** — open, in review, resolved

Findings can automatically generate [Corrective Actions](/features/corrective-actions) to ensure gaps are tracked through to resolution. All findings — whether raised inside an audit program, from a penetration test, from the device agent, or manually — also surface in the unified [Findings](/features/findings) view, so compliance leads see one list across every source.

## Inviting external auditors

You can invite external auditors by email from the program's **Auditors** tab.

External auditors receive the **Auditor role**, which grants:

* Read-only access to controls, evidence, and policies in scope
* Access to their dedicated auditor view at `/[orgId]/auditor`
* No ability to modify data or settings

<Note>
  External auditors cannot see controls, evidence, or findings outside the specific program they are assigned to.
</Note>

<Warning>
  Do not grant external auditors admin or editor roles. Always use the Auditor role to ensure read-only access.
</Warning>

## Generating the audit report

Once the checklist is complete, click **Generate Report** to produce a PDF audit report.

The report includes:

* **Executive summary** — scope, methodology, overall assessment
* **Control status summary** — conformant, partial, non-conformant counts
* **Evidence summary** — evidence collected per control
* **Findings** — all logged findings with severity and recommendations
* **Gaps and risks** — areas requiring immediate attention
* **Recommendations** — prioritized remediation steps

Reports are accessible under **Audit Reports** (`/[orgId]/audit-reports`) and can be downloaded at any time.

## Audit dashboard

The Audit Dashboard (`/[orgId]/audit-dashboard`) gives a real-time overview of your audit program health:

* **Upcoming audits** — programs scheduled in the next 30/60/90 days
* **Overdue items** — checklist items or evidence requests past their due date
* **Findings by severity** — breakdown of open findings across all programs
* **Recent activity** — latest updates across active audit programs

<Tip>
  Use the audit dashboard before board or committee meetings to get a quick read on compliance posture and open findings.
</Tip>