Skip to content
Specified, being builtFor the reviewer and audit manager, also the auditee and the auditor

Follow-up on audit

Keep every work paper with a gap open past report issue, request corrective-action evidence from the auditee, and close only on signed-off evidence.

  • NIST CSF
  • DORA
  • GDPR
  • ISO 27001
  • PCI DSS
  • SOC 2

Follow-up · the firm's register

3 open

Every work paper signed off with a gap, across the firm's audits and auditees. A date passing closes nothing.

CC8.1.8 Approves system changes

Open

Follow-up definition

Owner at the auditee
Diego Marín
Committed date
30 Nov 2026 (the auditee's)
Follow-up date
7 Dec 2026 (the auditor's)

Recommendation on the signed-off work paper

Require a recorded approval on every production change, and state that the approver is not the change's author.

Starting…

Step 1 of 6

A simulation of the product with pre-baked content. Watch it play, or pressTry it yourself to click through.

What it is

The register that keeps every work paper with a gap alive after the report until the auditee's corrective action is evidenced and signed off.

What you do, as the reviewer and audit manager

  1. 1Watch the register of open work papers across the firm's audits and auditees, with the auditee's committed date and your follow-up date shown side by side.
  2. 2Hold the two dates apart: a committed date passing marks the work paper overdue, a follow-up date passing marks it due, and neither closes anything.
  3. 3Request corrective-action evidence for several work papers at once; the remediation owner answers through a link, with one request per owner.
  4. 4Close a work paper only on new evidence signed off in the workbench, or carry it forward with a recorded reason.

Specified, being built

This is specified and being built; the design is agreed, the screens are not all live. The simulation follows the specification.

Inside the product

What is inside follow-up on audit

Follow-up definition

Per work paper with a gap: a named remediation owner at the auditee, the agreed implementation date, the auditor's follow-up date, and a carried-forward marker. Every change is recorded with an actor and a time.

Two dates, never merged

The auditee's committed date and the auditor's follow-up date are separate fields. Passing the first marks the work paper overdue; passing the second marks it due. A date passing closes nothing.

Requested evidence

Corrective actions arrive through the same intake and portal as fieldwork evidence, with artefact type, origin, and reliability determinants recorded, consolidated into one request per remediation owner.

Closing as the auditor's act

A work paper closes only when the auditor corrects and signs it off in the workbench on the new evidence. There is no "mark as resolved" button, and a saved draft does not count.

One register for the firm

One list of open work papers across all of the firm's audits and auditees, so the reviewer and audit manager can see what is overdue, what is due, and what was carried forward.

Deliberately not in scope

  • Nothing closes automatically. Not on the auditee's committed date, not on the auditee saying it is done, not on a file arriving.
  • The issued report is never reopened, amended, or re-issued; follow-up continues the audit without touching it.
  • Not a task manager for the auditee. No subtasks, no percentage complete, no plan of work, no burndown.
  • No AI run and no separate assessment record in the first release. The auditor corrects and signs off the work paper in the workbench on the supplied evidence.

Two dates, one judgement

The auditee’s committed date and the auditor’s follow-up date are two different facts, and the register keeps them apart. The first is what the auditee promised in answer to the recommendation; the second is when the auditor will check. When the committed date passes the work paper is marked overdue; when the follow-up date passes it is marked due. Two marks, two meanings, and neither changes the follow-up state. The judgement sits elsewhere. When the remediation owner answers the evidence request, the auditor opens the work paper in the workbench, reads the new evidence against the control criterion, corrects the text, and signs it off. That post-evidence sign-off is the follow-up record. If the gap remains, the work paper stays open or is carried forward with a reason, and every change of owner or date is written to the audit log.

What an investor should notice

Follow-up is deliberately manual in the first release. No control test runs, no model is called, and no assessment record is created; the product supplies the register, the evidence request, and the sign-off, and the auditor supplies the judgement. That restraint is the point. Follow-up is where a one-off report becomes a relationship: the firm returns to the same auditee, on dates both sides agreed, with evidence anyone can inspect. Firms do this by hand today, in lists that are not linked to the audit that produced the work paper and not backed by evidence. Run Audit links each open work paper to its recommendation, its remediation owner, and the evidence that eventually closes it, across every audit and auditee the firm holds. The report stays immutable; the work continues.

Products

The other products

AI document auditing

Available

Upload the evidence the auditee already keeps, test the controls against it, correct and sign off the work papers, issue the report.

For the auditor

  • NIST CSF
  • DORA
  • GDPR
  • ISO 27001
  • PCI DSS
  • SOC 2
Watch the demo →

Pre-audit planning

Planned

Study the prior audits, see where risk concentrates, and decide who to talk to and what evidence to request before fieldwork starts.

For the auditor

Watch the demo →

Voice interview

Planned

Interview the auditee from inside the audit and keep what was said as evidence a work paper can cite.

For the auditor

Watch the demo →

Cloud configuration review

Planned

Connect a cloud account read-only and test the selected controls against its live configuration, from inside the audit.

For the auditor

  • NIST CSF
  • ISO 27001
  • SOC 2
  • PCI DSS
Watch the demo →

See it on your own evidence

A walkthrough takes forty minutes: one framework, a handful of controls, and the documents an auditee already keeps.