Compliance & audit
Run audits from the same workspace your controls live in
Adopt frameworks, map a control once and reuse the mapping across them, keep evidence beside the control it supports, and give your auditor scoped, read-only access in place of a shared folder.
In short
Controls, evidence, audits and auditor access sit in one workspace, in place of a spreadsheet and a shared folder. You map a control once and reuse the mapping for each framework you adopt, and every action is written to a tamper-evident activity log, so an auditor can see what changed, when and by whom.
Run several frameworks side by side
Most organisations answer to more than one framework: ISO 27001 for international customers, HIPAA if they handle US health data, PCI DSS if they take card payments. The requirements overlap, yet teams often run each one as its own project, with its own spreadsheet, evidence folder and audit timetable.
In Certifyi you map a control once and reuse that mapping wherever the requirement comes up again. An access review that serves ISO 27001 Annex A 5.18 can also be mapped to PCI DSS Requirement 7.2.4 if you adopt both, and the review is documented once.
- Framework catalogue. ISO 27001, ISO 42001, GDPR, HIPAA, PCI DSS, NIST CSF, NIS 2, DORA, the EU AI Act and CMMC, plus regional standards including the NRB IT Guidelines (Nepal), CBUAE, NCA ECC (Saudi Arabia), the DPDP Act (India), PDPA (Thailand) and PDPL (Saudi Arabia).
- Common control set. Map one control to requirements in several frameworks and link its evidence once.
- Statement of Applicability. Set applicability per control, with the justification for each included or excluded control, and export it for your auditor.
- Compliance dashboard. Posture across the frameworks you have adopted, with drill-down from framework to control to evidence.
Plan, run and close audits
An audit involves scoping, scheduling, collecting evidence, recording findings, following up corrective actions and holding management reviews. Most teams coordinate all of that over email and project tools that were not built for it.
In Certifyi, internal and external audits run in the same workspace as the controls and evidence they test.
- Audit roadmap. Plan your internal audit calendar, with the scope, auditors and timing for each audit.
- Findings. Record each finding with its severity, root cause, corrective action and due date, and follow it through to closure.
- Management reviews. Agenda, attendees, decisions and actions for the ISO 27001 Clause 9.3 management review.
- Auditor access. Each auditor is invited to their engagement with scoped, read-only access to its evidence, so they work from the record itself rather than from copies.
- Proposed findings. Auditors can propose findings in their own view. Your team reviews each proposal before it becomes a finding.
| Ref | Finding | Severity | Due | Owner |
|---|---|---|---|---|
| OBS-2026-017 | Access review missed two systems | Major | 15 Nov 2026 | J. Okonkwo |
| OBS-2026-018 | Continuity plan not exercised this year | Minor | 30 Nov 2026 | R. Sharma |
| OBS-2026-019 | Supplier SOC 2 report out of date | Major | 28 Nov 2026 | L. Moreau |
| OBS-2026-020 | MFA not enforced on the VPN | Critical | 6 Nov 2026 | D. Kimura |
Audit findings with severity, due date and owner. Example data, not a customer record.
Keep evidence beside the control it supports
Evidence is what shows a control actually operated. A screenshot of a settings page only proves the setting at the moment it was taken, and an exported CSV in a shared folder carries no record of who put it there.
In Certifyi each piece of evidence is linked to the controls and frameworks it supports. The tamper-evident activity log then answers the questions a folder cannot: who attached it, when, and what changed afterwards.
- Evidence register. All your compliance evidence in one place, linked to the controls and frameworks it supports.
- Evidence from your tools. Upload what you export from the tools that hold it, and it sits on the control it supports.
- Tamper-evident activity log. Each entry is linked to the previous one by a hash, so a change made later shows up when the chain is checked.
See your posture across the frameworks you adopt
The compliance dashboard shows status across all adopted frameworks. You can drill down from a framework to its controls and their evidence.
- Framework view
- Readiness for each adopted framework, broken down by domain and control group.
- Control view
- The status of every control, with the evidence linked to it.
- Evidence view
- Every evidence item, how it was collected and the controls it supports.
- Gaps
- Controls an adopted framework requires that have no evidence yet.
Set the Statement of Applicability per control
For ISO 27001 you need a Statement of Applicability: every Annex A control, whether it is included or excluded, and why. It is one of the first documents an auditor opens, and a spreadsheet copy is rarely in step with the controls it describes.
In Certifyi you set applicability per control, so the decision and its justification live on the control, and the Statement of Applicability is exported from there when your auditor asks for it. The rows below are an example.
| Control | Status | Justification |
|---|---|---|
| A.5.1 Policies for information security | Included | Information security policy approved and published |
| A.5.2 Information security roles and responsibilities | Included | Roles agreed by the management team and reviewed each year |
| A.5.3 Segregation of duties | Included | Separate roles for requesting and approving access |
| A.8.1 User endpoint devices | Included | All laptops enrolled in device management |
| A.8.12 Data leakage prevention | Excluded | No DLP tooling in scope; residual risk accepted by the CISO |
What an auditor asks for first
Have these ready before the opening meeting and the first week goes faster.
-
The scope
Which sites, systems and teams are included, and the reasons for any exclusions.
-
The Statement of Applicability
For ISO 27001, every Annex A control with its status and justification.
-
Evidence for sampled controls
Proof that each sampled control operated throughout the audit period.
-
Last year’s findings
Each finding from the previous audit, and what happened to it.
Related modules
Compliance and audit sits with the other modules in one workspace. Risks relate to controls, and incidents relate to the controls they affect.
How Certifyi helps
From spreadsheets and folders to one workspace
Frameworks, controls, evidence, audits and auditor access in one place. This is what changes.
-
Adopt a framework
Choose a framework from the catalogue, work through its controls and mark the ones that apply.
-
Map controls once
Map a control once and the mapping carries over to every framework it serves.
-
Give auditors scoped access
External auditors get scoped, read-only access to the evidence for their engagement and can propose findings.
-
Follow every finding to closure
Findings are recorded with severity, root cause, corrective action and owner.
Questions
Compliance and audit questions
Which frameworks are in the catalogue?
ISO 27001, ISO 42001, GDPR, HIPAA, PCI DSS, NIST CSF, NIS 2, DORA, the EU AI Act and CMMC, plus regional standards such as the NRB IT Guidelines, CBUAE, NCA ECC, the DPDP Act, PDPA and PDPL. Ask us about any framework not listed here.
Can I map one control to several frameworks?
Yes. You map a control once and reuse the mapping for every framework it serves. The evidence is linked to the control, so you collect it once too.
What does the activity log prove?
That a record has not changed since it was written. Each entry is chained to the one before it with a hash, and changing an entry after the fact breaks verification. It does not show the evidence was accurate when it was collected.
What do auditors see?
Auditors are invited to a specific engagement, with read-only access to its evidence, controls and findings. They can propose findings for your team to review. They do not see the rest of your workspace.
Does Certifyi replace our audit management tool?
It covers audit planning, evidence, findings, management reviews and auditor access. If your internal audit team uses a specialist tool for other kinds of audit, Certifyi can run alongside it.
One workspace for frameworks, audits and evidence
Book a demo and we will set up an example engagement with you, from the auditor’s scoped access to their proposed findings and sign-off, so you can compare it with how your last audit ran.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them