Every station of internal audit, with its real screen

This is Govercom from the inside, station by station. The screenshots are real, with demo data.

Risk-based annual plan
The plan starts from the audit universe and risk scores, and is measured against real team capacity.
- An audit universe of entities that are scored and rank the plan
- Available against committed hours, and coverage per risk level
- No approval beyond capacity without a written gap statement; the plan locks once approved
Risk and control registers
Residual risk is derived from controls, not typed in.
- Inherent, residual and target risk on a scale you define
- Controls with tested design and operation; an untested control reduces nothing
- Key risk indicators (KRIs) with thresholds; a breach sends a notification
Risk heatmap
The risk picture on one screen.
- A 5x5 impact and likelihood matrix
- What falls outside risk appetite shows with no manual calculation
- From a cell to the risks inside it
Process maps
Every step of a cycle linked to its risks and controls.
- Draw the cycle step by step
- Link each step to its risks and controls
- A step with a risk and no control shows at once
Engagements and workpapers
Phases cannot be skipped, and a closed engagement cannot be edited.
- Planning, then fieldwork, then reporting, then closing
- An audit program and workpapers with preparer and reviewer, and evidence uploaded with a fingerprint
- Document requests to the auditee, and team hours against budget
Findings and corrective actions
A finding has all five elements, and closing is the auditor's call.
- Criteria, condition, cause, effect, recommendation: no incomplete finding is issued
- A corrective action has an owner, a due date and progress; overdue shows by date
- The action owner cannot write the verification date; the auditor verifies and closes
Fraud and whistleblowing
Scheme-based assessment, and a reporting channel anonymous by design.
- Fraud risk assessment per cycle, by known schemes and exposure
- A public reporting form with no identity field and no IP logging
- The channel ships closed; opening it is a decision recorded by name, and each report gets a case file
Combined assurance map
Who covers what, from proven work only.
- Management, the second line, internal audit and external assurance per risk
- Risks nobody covers, or covered only by management's own word
- Overlap: several parties covering the same thing
Board report
One dated paper that does not change once captured.
- Figures captured and stored with their date, each with its source
- Drill down from every figure to the rows behind it
- The chief audit executive's written conclusion before approval, and a Word report with real tables
Indicators dashboard
What needs your attention today.
- Plan execution and engagements in progress
- Open findings by severity
- Overdue actions, and risks outside appetite

Also in Govercom

Auditee portal
Each department sees and answers its own findings and actions only, and uploads remediation evidence; the scope is enforced on the server. Auditee accounts are free.
Single sign-on and two-factor
Sign in with your organisation's account via OIDC, two-factor authentication, and eight roles with permissions you set.
Governance and compliance
Versioned policies with staff acknowledgement, a delegation-of-authority matrix, committees with quorum, conflicts of interest, and compliance frameworks linked to risks.
Quality assurance
Self-assessment, auditee surveys, and activity indicators computed automatically.
A tamper-evident audit log
Every change goes into a hash-chained log; editing a row breaks the chain and shows.
Your hosting or ours
A cloud subscription, or a perpetual licence installed on your own servers from a single package.

Fieldwork on a phone

An auditor on site starts a visit and uploads evidence from a phone; anything captured offline is kept on the device and syncs when the connection returns.

Request a demo