Skip to content

Internal Audit — Control Catalog & Test Evidence Index

Audit season needs one register of controls, owners, frequency, and test evidence—not mailbox archaeology.

Why this is needed

  • Control inventories live in stale spreadsheets.
  • Evidence is scattered across SharePoint.
  • Links to regulatory obligations when needed.

Proposed entities in EntiHub

Governance settings

Setting Recommended value Why
approvalRequired true Control design changes are controlled.
historyEnabled true Evidence and test history for auditors.
allowSameAuthorApproval false Maker/checker separation for sensitive changes.
deletedRetentionDays 90 (or higher) Soft-delete retention for auditability.

Entity definition (YAML sketch)

name: internal_control
displayName: Internal control
domain: Internal Audit
description: Internal control
version: "1.0.0"
approvalRequired: true
historyEnabled: true
deletedRetentionDays: 90
displayRefColumn: control_code
uniqueConstraints:
  - name: uq_internal_control_control_code
    columns: [control_code]
columns:
  - name: control_code
    dataType: string
    nullable: false
    maxLength: 64
  - name: title
    dataType: string
    nullable: false
    maxLength: 256
  - name: owner_team
    dataType: string
    nullable: false
    maxLength: 128
  - name: frequency
    dataType: string
    nullable: false
    maxLength: 32
  - name: last_test_result
    dataType: string
    nullable: true
    maxLength: 32
  - name: evidence_ref
    dataType: string
    nullable: true
    maxLength: 512
  - name: status
    dataType: string
    nullable: false
    maxLength: 16

YAML sketches

Sketches highlight the important fields and governance flags. Trim or extend columns to match your domain. See Setup Entity for the full YAML reference.

Sample data

control_code title owner_team frequency last_test_result status
CTL-AP-IBAN Dual control on supplier IBAN change Finance Ops quarterly pass active
CTL-ACCESS-Q Quarterly access recertification Security quarterly in_progress active

Benefits for the company

  • One control register for audit season.
  • Evidence indexed next to controls.
  • Clear owners and test cadence.