The third line should not depend on the second line's spreadsheet. Blueprint+ gives internal audit read access to the same registers, assessments and approval histories the business works in, with an audit log on every action.
Audit works from exports the business prepares. By the time fieldwork starts, the export is a snapshot of a moment that has passed.
A control rated effective in a workbook carries no evidence, no reviewer and no date. Audit has to re-perform the test to trust it.
Checking that a policy clause has a working control behind it means two teams and three files.
An audit role sees the Risk Register, Control Registry, Regulations Library, every policy's version history and every assessment's scores and threads, without the ability to change them. Independence is a permission, not a courtesy.

Control ratings, approvals, publications and register changes are logged as they happen, with the actor, the time and the attached evidence. Audit can trace a rating back to the test, the tester and the thread where it was challenged.
From any policy clause, open the control that makes it real, the risk it treats and the most recent assessment that tested it. From any control, see the clauses that depend on it. The Impact Analyzer shows what a finding affects, so recommendations land on the right documents.

Book a demo and bring a recent finding. We will show you the trail from the clause to the test.