Audit Types and Cadence

Outline internal audits, external audits, and compliance reviews. Define frequency, sample sizes, and scope aligned with program risk.

Evidence and Independence

Auditors must have independence, maintain documentation, and collect evidence such as training records, incident files, and remediation evidence to support conclusions.

Reporting and Closure

Audit findings are reported to the Steering Committee and executive leadership. Corrective actions are tracked until closure and validated by follow-up reviews.