Using Keen

Plan audits and sample evidence

Chapter 14 of 17

Plan audits and sample evidence

An audit in Keen is a container for one review: its scope, the people involved, the evidence you examined, your findings and the report. This chapter walks one audit from start to completion, then covers scheduled audits and the coverage views that tell you what has not been looked at lately.

Scope

The controls, clauses and documents the audit sets out to examine. A statement of intent.

Sample

A record you actually examined: an event, a risk, a document, a measure and so on.

Finding

The result of your assessment of a requirement against the samples.

audits.manage lets you create audits and scheduled templates and run or edit the ones you created. audits.admin also edits other people's audits and deletes audits or templates. Sampling evidence also needs read access to the underlying event or record, for administrators too.

Plan and conduct audits

In Audits, Start an audit walks through the audit's details, its scope and its participants, one step at a time. Then sample the evidence, risks and other records you examine. For each sample, say why you chose it and what it demonstrates, and include adverse evidence as well as favourable where a balanced conclusion needs it.

Record findings with enough detail to identify the requirement, the observed facts and the necessary action. Keep the notes and executive summary current, review the whole audit, and only then complete it: a completed audit restricts further changes.

Scheduled audits create audit records through the background scheduler, and coverage views show which requirements have not been examined recently. Both are covered later in this chapter.

Plan and conduct an audit

1. Open Audits → Start an audit. The audit belongs to the framework selected in the top navigation, so switch that first if you mean another one. Give the audit a title you will recognise in the register, say whether it is an internal or an external audit, and add its begin and end dates if you know them.
2. Tick the controls, clauses, policies and procedures the audit will examine, and the SWOT items if you have ISMS access. Choosing a policy, procedure or clause adds the clauses and controls linked to it. You can skip this step and set the scope later on the audit's page.
3. Add the participants, preferably from the people register or from Keen accounts, with each person's role. Check names and contact details before any invitations go out.
4. Check the summary, use Change to correct a step, and create the audit. Then choose where to start: look for evidence by event, by control or in the ISMS, or start writing the report notes. Evidence you sample goes to this audit unless you pick another.
5. From an event or other supported record, use its sampling action to add it to the audit. Explain the selection and your assessment in the notes.
6. Compare each requirement with the sampled facts and add findings with the requirement, observation and needed action.
7. Maintain the report notes and executive summary on the audit's page, during the audit and at its end. Attach an external report with Upload report or add supporting URLs.
8. Use Export audit ZIP and read the export. When you are satisfied that scope, participants, samples and findings hang together, complete the audit.

Select evidence and finish an audit

Use Open while preparing an audit and In progress while conducting it. Scope says what you plan to cover; samples record what you examined and what you found.

Choose the material to sample

On an evidence event or another supported record, choose Sample into audit, pick the audit and add a title and notes: why this sample, which requirement, what you observed. Sampling the same record again updates its existing sample. Removing a sample only removes its association with the audit; the event or record itself is untouched.

You can sample evidence events, risks, PESTLE(E) items, interested parties, objectives, documents, BookStack policy snapshots, organisation-chart nodes, assets, access-matrix rows, application-configuration rows, meeting minutes, effectiveness measures, individual metric entries and stories. An audit also accepts supporting URL evidence. For context and response reviews, include SWOT items in scope and sample them.

Record findings and conclusions

A finding is a Major non-conformity, Minor non-conformity, Opportunity for improvement or Best practice. Give it a title and description, optionally a control, and keep its status as Open, Accepted or Closed. Write the requirement, the sampled observation and the conclusion so another reviewer can follow the reasoning.

Maintain the report notes and executive summary, add supporting links and upload the final report (up to 100 MiB). Review participants, scope, samples and findings before completion; Completed and Archived audits restrict edits.

Schedule the next audit

Scheduled audits holds templates that create ordinary Open audits. A template chooses an exact date, the first weekday of a month or the first named Monday-Friday, and recurs once, weekly, monthly, quarterly or yearly with an interval and optional end. Keep scope and attendees on the template; selected documents can contribute their linked clauses and controls when an occurrence is created.

Schedule recurring audits and check coverage

1. Open Audits → Scheduled audits. Enter the title, audit type and planning notes; the schedule belongs to the framework selected in the top navigation.
2. Choose the date rule and its first run date, or the first-weekday month and year fields the rule offers. Check the date against the working days of that month.
3. Set the end date or duration, the recurrence, the interval and an Until date where appropriate.
4. Select the policies and processes in scope, add attendees with name, account, e-mail and role, and save. Check the template's calendar placement.
5. Before the date, confirm the audit record was created; creation happens within the configured lead time (KEEN_SCHEDULED_AUDIT_CREATE_DAYS_AHEAD). When mail is set up, each attendee of an open audit is reminded once, two days before it starts unless your administrator chose otherwise.
6. Open the created audit and review its scope and participants. A later template change does not rewrite an existing occurrence.

If an occurrence is missing, ask the administrator to check the scheduling logs and look-ahead window before creating a manual audit, so you avoid duplicates.

In Scope coverage, choose the audit source, date range and filters to see which controls, clauses and documents have been included in audits, and follow the links back to those audits. Use the gaps to plan coverage, then judge sample sufficiency and findings for each requirement.

Read the evidence visualisations

Open Controls → Visualisations to explore source-to-control graphs, heatmaps and a control sunburst. Graph edges show mapped-event relationships; Break sources down by splits a source into its connections, systems, actors, actions or outcomes. In the sunburst, inner segments are controls and outer segments the sources contributing to them: click an inner segment to zoom in, an outer segment to open the filtered events, and the centre to zoom out.

Use the coverage views to find controls without evidence for the selected period, and Audits → Scope coverage for requirements and documents still outside audit scope in the chosen window. Read evidence quality and findings alongside the counts.