Gathering audit evidence for internal and certification audits

Internal audits and certification audits

An internal audit is one you run on yourself, to check that what happens in practice matches what your procedures say. A certification audit is run by an external certification body against a standard, commonly a management system standard such as ISO 9001 (quality), ISO 14001 (environment) or ISO 45001 (occupational health and safety). Customer and supplier audits sit somewhere between the two.

This site does not describe the requirements of those standards clause by clause; read the standard itself or ask your certification body. In general terms, a management system audit looks for evidence that you have defined how you work, that you do it that way, that you keep records showing it, and that you review and improve it. The evidence is usually ordinary business records: procedures, registers, training records, inspection sheets, meeting minutes, corrective actions.

That is good news for automation. The evidence already exists, scattered across folders, mailboxes and people. The work is gathering it.

From an audit plan to an evidence list

Most audits start with a plan or a request list from the auditor, or with your own internal audit checklist. Turning that into collected evidence involves the same steps every time:

1. Break the request into individual items, each with an owner.
2. Find what already exists in your files.
3. Ask owners for anything you cannot find.
4. Check that each item is the current version and covers the period being audited.
5. File it so the auditor can follow the trail.
6. Keep a list of gaps, and decide what to do about each.

Steps 1, 2, 3, 5 and the gap list are admin. Step 4 is partly admin (dates and versions) and partly judgement. Deciding what to do about gaps is judgement.

How an AI worker collates evidence

The Everything can read the audit plan or checklist you give it and work through it in your Microsoft 365 tenant:

• Searching. It looks for matching records in SharePoint and OneDrive, such as the last two management review minutes, the current risk register, or inspection records for a given site and period.
• Collating. It copies or links what it finds into one audit folder, with an index that maps each request item to the file that answers it.
• Chasing. For items it cannot find, it asks the likely owner by email or Teams, follows up, and files what comes back.
• Flagging. It notes items that look out of date or outside the audit period, and lists gaps for you to review.
• Drafting. After the audit, it can turn findings into a corrective action list with owners and due dates, and remind owners as dates approach.

Because the same records feed every audit, keeping your registers, controlled documents and training records current all year makes each audit far less work.

Keep originals, not copies that drift

An audit folder should point to your real records, not become a second set of them. Practical rules that work well:

• Link to the controlled version where you can, and copy only when the auditor needs a fixed snapshot.
• Never edit a record to make it look better for an audit. If something is missing, record the gap.
• Keep the index with the date it was assembled and who approved it.

Some regulated industries have explicit audit trail rules. In the United States, FDA rules for electronic records (21 CFR Part 11, §11.10(e)) require "secure, computer-generated, time-stamped audit trails" and say "record changes shall not obscure previously recorded information". If you are under rules like that, check how your record systems meet them; an AI assistant does not change those obligations.

What stays with a person

• Adequacy. Whether a record actually shows what the auditor needs is a judgement for someone who knows the process.
• The conversation with the auditor. People answer questions, explain context and accept or dispute findings.
• Gaps. Deciding how to respond to missing evidence, and being honest about it, is a management decision.
• Corrective actions. The AI can track them, but the owner decides what the fix is and confirms it is done.

Before you start

The Everything runs inside your Microsoft 365 tenant with tightly scoped permissions, but your data does leave the tenant for AI processing. Its privacy policy names Microsoft (Azure OpenAI) and OpenAI as AI providers and says providers may process information outside your country. The public site does not claim any certification such as SOC 2 or ISO 27001, and it does not name a hosting country.

Audit folders tend to collect sensitive material: personnel files, incident reports, customer contracts. Before you start, check your own privacy and record-keeping obligations, any confidentiality terms with customers or your certification body, and decide which sites and folders the AI may search. The Everything does not claim any certification itself, so using it is not evidence of compliance with any standard.

Questions people ask