Skip to content
Crosswalker
🚧 Early alpha — building the foundation. See the roadmap →

For internal audit

Updated

What you own in the model

Section titled “What you own in the model”
EntityYour role
Assessment (audit)◎ own
Finding / Issue (+ remediation)◎ own
Control● test (GRC/ISRM owns the library)
Risk / Risk Scenario● use for risk-based planning
Requirement / Framework○ reference

How you get into it

Section titled “How you get into it”
  1. Reuse the shared control library. Your audit programs reference the same control objects GRC/ISRM maintains — no parallel control universe to keep in sync.
  2. Map tests to controls. An audit test points at a control (which already hangs off the relevant CRI / framework requirements via the crosswalk), so a passed/failed test rolls up to framework coverage automatically.
  3. Write findings to the shared register. A finding records against the control/requirement that failed — visible to GRC and compliance, who own remediation alongside you.
  4. Plan risk-based. Use the shared risk scenarios (tagged to CRI functions) to scope the audit universe.

Why this beats a siloed audit tool

Section titled “Why this beats a siloed audit tool”

A standalone audit workpaper engine (Pentana / Ideagen, AuditBoard) keeps its own objectives-risks-controls-tests library. That’s fine — but if it doesn’t share the control objects with GRC, you get drift: audit tests one control definition, GRC manages another. In the unified model, the control is one object; audit tests it, GRC maintains it, compliance maps obligations to it. Crosswalker can hold that shared control + crosswalk layer your audit tool points at.

Section titled “Related”