HomeSolutions · By role
For internal audit teams

Independent visibility into control testing and policy status, without asking anyone.

The third line should not depend on the second line's spreadsheet. Blueprint+ gives internal audit read access to the same registers, assessments and approval histories the business works in, with an audit log on every action.

ControlLast testedResult
AML-C-002 Sanctions screeningAutomated · quarterly · owner: S. ChenQ3 RCSA · 14 SepEffective
AML-C-001 STR filing windowManual · monthly · owner: R. MehtaQ3 RCSA · 14 SepPartial
OPS-C-014 Dormant account reviewManual · quarterly · owner: M. BrownQ1 RCSA · 12 MarOverdue test
KYC-001 Enhanced due diligenceManual · monthly · owner: L. ChenQ3 RCSA · 14 SepEffective
Control testing status across assessments, as audit sees it (illustrative)
The problem
"Send me the latest register"

Evidence that arrives by email

Audit works from exports the business prepares. By the time fieldwork starts, the export is a snapshot of a moment that has passed.

Was the control tested, or just ticked?

No trail behind the rating

A control rated effective in a workbook carries no evidence, no reviewer and no date. Audit has to re-perform the test to trust it.

Policy says one thing, the system another

Documents detached from controls

Checking that a policy clause has a working control behind it means two teams and three files.

What audit gets
01
Read access, everywhere

The same registers the business uses, in real time

An audit role sees the Risk Register, Control Registry, Regulations Library, every policy's version history and every assessment's scores and threads, without the ability to change them. Independence is a permission, not a courtesy.

  • Role-based access with read-only audit roles
  • Live data, not exports
  • Filter by business unit, period or regulator
A workflow timeline showing who approved what and when
Approval histories show who acted, when, and with what comments
14 Sep 10:42S. Chen rated AML-C-002 Effective · evidence: screening_log_Q3.csv
14 Sep 11:05R. Mehta rated AML-C-001 Partial · comment thread #412
15 Sep 09:12P. Nair reviewed RCSA Q3 · Retail · 2 ratings challenged
16 Sep 14:30Workflow escalated OPS-C-014 test overdue → Head of Operations
18 Sep 16:01D. Lee approved Credit Risk Policy v2.1 · board tier pending
19 Sep 08:55Report RCSA-Q3-Retail.pdf generated by S. Chen
The audit log: every action, actor and timestamp (illustrative)
02
Audit log

Every rating has a person, a date and evidence behind it

Control ratings, approvals, publications and register changes are logged as they happen, with the actor, the time and the attached evidence. Audit can trace a rating back to the test, the tester and the thread where it was challenged.

  • Audit log on every action in the platform
  • Evidence attached to control ratings
  • Threads preserved with the assessment
03
Policy to control to test

Follow the thread from the clause to the evidence

From any policy clause, open the control that makes it real, the risk it treats and the most recent assessment that tested it. From any control, see the clauses that depend on it. The Impact Analyzer shows what a finding affects, so recommendations land on the right documents.

  • Linked items in both directions
  • Impact Analyzer for findings and remediation
  • Export the trace as working papers
A policy clause with regulatory and control references inline
Regulation, control and risk references inline in the clause

See what the second line sees, as it happens.

Book a demo and bring a recent finding. We will show you the trail from the clause to the test.