Run the IIA audit cycle and ISO 31000 risk process on one platform
Ontech Audit & Risk ranks your audit universe from the live risk register, builds the annual plan within your capacity, runs engagements with versioned workpapers and full-population analytics, chases every agreed action up an escalation ladder, watches your systems continuously, and produces the Audit Committee pack in PDF, Word and PowerPoint. Your auditors judge; the platform does the chasing.
The audit plan is scored from the risk register, the analytics run on your own ledgers, and the monitors query your systems. Nothing on the dashboard is typed in.
Every auditable entity is linked to the risks it carries. Their residual scores drive half of its audit priority, so the plan follows the register, not last year's plan.
Payments, journals, payroll, loan books and user lists, uploaded as CSV or Excel. Each file is fingerprinted with SHA-256 and profiled column by column before any test runs.
Read-only queries against your ERP, payroll or core system, on connections your ICT team controls. The platform never stores the credentials and only ever runs SELECT.
Thresholds and tolerances per indicator, measurements captured by hand, by import or from a connection, and a breach that alerts the owner and shows on the dashboard.
Early warningIncidents, losses and near misses with root cause and corrective actions, linked to the risk they realised and watched by the same monitors as everything else.
Root causeEvery workpaper version keeps its SHA-256 fingerprint, uploader and time; a different person must review it; and every status change is on the engagement's trail.
Tamper-evidentEach role sees its own work; the Audit Committee sees the whole picture.
The committee pack assembled by hand from spreadsheets the week before the meeting
With Audit & Risk: approve the plan on screen, watch delivery against the year, and generate the pack from live data in PDF, Word or PowerPoint
Approves · reportsSamples of 25 because the full ledger would take a week in Excel
With Audit & Risk: test the whole population in minutes, file the result as a workpaper, raise the finding in one click, and log the time against the step
My Audit WorkTreatment actions that drift past their dates with nobody chasing
With Audit & Risk: one register, KRIs with alerts, and the same escalation ladder for treatments as for audit actions
ISO 31000Reminders by e-mail with no record of what was promised or done
With Audit & Risk: see only your unit's engagements and your own actions, update progress, and close them when audit verifies
Own unit onlySix jobs the platform does on its own. People step in only where a judgement is needed.
Every entity is re-scored from the register whenever the page opens, so the priority order is never stale.
Give it the available auditor days and the minimum band; it proposes the year's engagements in priority order, spread over the quarters.
A sweep every morning reminds owners of overdue actions and escalates by age. Each level is logged once; reminders repeat weekly.
A rule, a data source and a schedule. Every run compares its exceptions with the last: new ones are owned and notified, repeats keep their explanation, cleared ones close themselves.
A workpaper's reviewer cannot be its preparer. A finding's author cannot review it. A finding cannot close until internal audit has verified every agreed action.
By designThe engagement report, the annual plan and the Audit Committee pack are generated from the data at the moment you ask, and every generation is logged.
The audit cycle follows the IIA Global Internal Audit Standards; the risk process follows ISO 31000.
A documented audit universe, a priority method you can explain, and a plan the committee approves on the record.
GIAS 9.4Programmes, versioned workpapers with sign-off, and an activity trail that shows who did what and when.
GIAS 14.6Condition, criteria, cause, effect and recommendation on every finding; management responses and agreed actions on the record.
GIAS 14.3 · 15.1Automatic follow-up, verification by internal audit, and escalation to the committee for what stays open.
GIAS 15.2Context, identification, analysis, evaluation, treatment, monitoring and communication, with configurable scales and a matrix.
ISO 31000Plan delivery, findings by rating and root cause, action ageing, monitoring position and universe coverage in one pack.
Committee-readyChosen from drop-down lists of the columns in your data. No scripting language, no separate desktop licence.
Same vendor, invoice and amount paid twice, with the excess value totalled.
Missing and reused voucher, cheque or receipt numbers.
First-digit distribution against expectation, with a conformity verdict.
Amounts outside the normal range, round amounts, weekend postings.
Payments to suppliers not on the approved vendor master.
Totals by approver, cost centre or vendor, with each one's share.
Random, systematic, monetary-unit or largest-item, with a recorded seed.
For queries that already apply the rule, such as overdue treatment actions.
Five steps, the same every engagement, with a record of each one for the reviewer.
The universe is scored from the register; the year's plan is proposed within capacity and approved on screen.
Each engagement loads its programme from the library; the team works the steps and logs its days.
Workpapers are versioned and signed off by two people; analytics test whole populations and file their results.
Findings with the five C's, management responses and agreed actions; the report generated in the format the reader needs.
Actions chased up the ladder, verified by audit, and the position tabled in the committee pack.
Screens from the running system, with sample data.
The Internal Audit dashboard: plan delivery, findings, actions, monitoring and coverage, live.
A duplicate-payments test on a 622-row ledger, filed as workpaper 5.2 with the auditor's conclusion.
Continuous monitoring: seven monitors, their last results and open exceptions.
A finding: condition, criteria, cause, effect, recommendation, the management response and its agreed actions.
The action tracker and its escalation ladder.
An approved annual plan on the quarter board, with capacity and coverage.
What protects your evidence and your decisions, switched on from the first day.
A password plus a one-time code by e-mail; Active Directory sign-on where you have it; accounts lock after repeated failures.
Roles for the Chief Audit Executive, audit managers, auditors, auditees and the committee; auditees see only their own unit and actions.
Preparer and reviewer, author and reviewer, owner and verifier are always different people, and every step is logged with who and when.
Every uploaded file and dataset carries a SHA-256 fingerprint, so what was tested is what is on file.
Monitors run SELECT only, with row caps and time-outs; credentials stay with your administrator; secret columns are refused.
Containers on your own servers or a cloud of your choice; the same software either way, operated by Ontech Solutions, a registered data controller.
We'll walk your audit and risk teams through the platform with your own universe and a sample ledger.
Risk-based planning, workpapers, analytics, findings, follow-up, continuous monitoring and the committee pack, in one platform.
