What It Is
The Internal Audit & Assurance module is MPG's environment for third-line assurance work. It holds the audit universe — every auditable unit the organization can be asked to give assurance over — and connects it to the plans drawn from it, the engagements those plans produce, the evidence requested and received, the findings raised, and the actions that answer them.
The module follows the audit lifecycle rather than a document store: PLAN, SCOPE, FIELDWORK, FINDINGS, MANAGEMENT RESPONSE, QUALITY REVIEW, REPORT, FOLLOW-UP, RETEST and CLOSE. An engagement carries its own objectives, scope and criteria, its lead auditor and team, its independence and conflict declarations, its budgeted and actual hours, its opinion with the rationale behind it, its assurance level, and its quality review — so the file that supports the opinion is the file the workspace itself holds.
Because it sits inside the same governance workspace as the risk register, controls, policies and compliance obligations, an audit universe item can be linked to the governed record behind it, a finding to the risk and control it concerns, and an evidence request to the engagement it serves. The result is assurance that can be traced from the plan through the fieldwork to the finding, the response, the retest and the committee report.
Who It Is For
Problems It Solves
How MPG Solves Them
The audit universe register holds each auditable unit with its type, business owner, its own risk rating and the rationale behind it, its audit frequency, its last audit and next audit due date, whether the current plan covers it, and a link to the governed record behind it. Risk ratings and frequencies make the plan defensible, and the coverage view shows which units the plan reaches and which it does not.
Plans are built in the plan register with their year, type, objective, scope, risk basis, owner, capacity and estimated days, and they carry a version with its own history and an approval. Engagements are drawn from the plan and run through the lifecycle, with planned and actual dates and hours so each plan can be read against the work it actually produced — the committee pack sets budgeted hours beside booked hours per plan.
Evidence requests leave the workspace on their own link. The operator chooses who is asked and how long the link is given; the request records what was asked, the due date, whether the respondent is internal or external, what was submitted and its provenance, and items the respondent names where the evidence is held elsewhere. Findings carry the criteria, condition, cause and effect statement, the severity, the recommendation and the management response with its accountable owner and due date; the action register tracks remediation, approved extensions, completion evidence, the verification result and its verifier, and the escalation count — and separation of duties stops an action owner signing off their own retest.
Key Features
Reporting Studio & Governance AI
Every record in this module can be reported on
The Reporting Studio turns what your workspace records into governed figures — compiled from your own records, approved before anything leaves the workspace, and answered with citations.
Governed measures
Each figure is compiled from the module's own records and carries the instant it was read at and what it leaves out.
Approval before release
A report pack leaves the workspace only once the approval chain its report type requires has decided on it.
Answers you can check
The assistant points to the records each answer rests on, and it never approves, publishes, releases or deletes anything.
Workflow
Maintain the audit universe: register each auditable unit, its risk rating and rationale, and its audit frequency
Read the risk basis and build the plan against the team's capacity and estimated days
Approve the plan version and open engagements from it
Scope the engagement: objectives, criteria, team, independence declarations and dates
Run fieldwork and request evidence — internal auditees and external respondents answer on their own link
Record findings with criteria, condition, cause and effect, severity and recommendation
Capture the management response, accountable owner and committed due date
Quality review the engagement and issue the opinion with its rationale and assurance level
Track follow-up: actions, approved extensions, completion evidence and escalation
Retest independently, close the finding with evidence, and report coverage, findings and repeat issues to the audit committee
Use Cases
Related Governance Risks
Related MPG Modules
Frequently Asked Questions
What is an audit universe and how does MPG maintain it?
The audit universe is the set of auditable units the organization can be asked to give assurance over — business units, processes, systems, entities or third parties. MPG holds each unit in its own register with its type, business owner, risk rating and the rationale behind that rating, audit frequency, the date of the last audit and the next audit due date, and whether the current plan covers it. Because the universe sits beside the risk register, the rating that drives the plan is the organization's own, not a figure kept separately for audit.
Can I build an audit plan against team capacity?
Yes. Each plan carries its objective, scope, risk basis, owner, available capacity and estimated days, and each engagement records budgeted and actual hours. The committee report set reads every plan against the engagements it produced, so you can see where the plan ran ahead of or behind the capacity it was given.
How do evidence requests work for auditees and external parties?
An evidence request names the subject, the engagement, the type of evidence asked for, who is being asked and whether they are internal or external, and the due date. The operator controls how long the link is valid, and the respondent opens it with nobody signed in. Submissions record the files received, their provenance, the items the respondent named and where each is held, and the reviewer. A request whose link has lapsed with nothing submitted is counted apart from one simply awaiting a response.
How are findings and management responses recorded?
Each finding states the criteria, condition, cause and effect, with its severity, recommendation, management response, accountable owner and due date. The action register tracks what answers the finding, including due-date extensions with their approval, completion evidence, the verification result and who verified it. Where a finding repeats an earlier one, the repeat flag carries the earlier finding on the new record, so recurring themes are visible rather than rediscovered.
Can an action owner close their own remediation?
No. The module enforces separation of duties: an action whose owner is the person who did the work cannot be verified by that same person, so a retest is carried out by someone independent of the remediation. Closure evidence and the verifier are recorded on the action.
What does the audit committee report set cover?
Coverage counted per risk rating, open findings banded by age with the oldest still-open finding named, the repeat issues themselves, each plan against its engagements' budgeted and booked hours, how the concluded engagements concluded, and how much evidence is outstanding, past its date, or sitting on a lapsed link. The same set exports as an Excel workbook or PDF that states what it read, from how many records, and under which ceilings.
Related Guides
Ready to strengthen your governance with Internal Audit & Assurance?
Join organizations using My Premium Governance to transform their governance, oversight, and compliance operations.