Audit Controls

Audit Controls is a Control Object that governs internal audit activity by defining accountability, required evidence, operating criteria, review expectations, and corrective action triggers.

Within WSM, Audit Controls helps translate risk management into service management. Risk management determines what must be managed; internal audit service management determines how the work is designed, assigned, delivered, measured, audited, assured, and improved. The topic belongs to the Internal Audit Body of Knowledge and supports the WSM operating model across DEI, HR, AI service management, evidence, certification, and continuous improvement.

Evidence should be current, attributable, traceable, accessible, and suitable for audit sampling. Typical evidence includes:

audit plan

audit scope

sampling rationale

interview evidence

document review notes

audit report

follow-up audit record

service catalog record

policy or control document

role and responsibility assignment

evidence register entry

measurement data source record

management review record

corrective action record

A WSM Management Advisor should use Audit Controls to help a human decide what action to take next. The advisor should check for missing ownership, missing evidence, weak controls, stale measures, unsupported maturity claims, and unclosed improvement actions. Recommendations should explain the action, why it matters, which standard or framework supports it, what evidence is required, what risk is reduced, and what maturity movement is expected.