Skip to main content
The audit lifecycle in Regentra spans four phases: planning an audit period, recording findings during the audit, managing issues to closure, and preparing for auditor sign-off. This page covers Audit Periods, Audit Findings, and Compliance Issues as one integrated workflow.

​
What you can do

  • Create audit periods — Define an audit window (start/end date), framework scope, and audit type (Type 1 or Type 2)
  • Record auditor information — Capture the external auditor’s name and email for coordination
  • Respond to information requests — Manage audit requests (IRLs) from auditors with a NOT_READY → INTERNAL_REVIEW → AUDIT_READY → APPROVED / FLAGGED workflow
  • Log findings and issues — Issues can be sourced from the audit, Control Tests, Access Reviews, or manual entry
  • Track issue status — Move issues from Open → In Progress → Resolved as your team remediates
  • Assign and monitor — Assign owners, set due dates, and see progress in dashboards

​
Plan an audit period

1

Open Audit Periods

In the Compliance module sidebar, click Audit Periods (sits under the small EVIDENCE & REPORTING caption).
2

Click New Audit Period

Fill in the audit name (e.g. “Q1 2026 SOC 2”), choose your Framework, select report type, and set start/end dates.
3

Add auditor details (optional)

Enter the external auditor’s name and email so coordination is logged in one place.
4

Save the period

Click Create Period. The audit window is now active and visible to your team.

​
Audit period statuses and types

StatusMeaning
ActiveAudit is currently underway or scheduled to start soon
CompletedAudit has finished; findings are documented
CancelledAudit was postponed or abandoned
Report Types:
  • Type 1 — snapshot audit of controls at a point in time
  • Type 2 — audit of controls over a period of time (more common for SOC 2, ISO 27001)

​
Log and track compliance issues

1

Open Compliance Issues

In the Compliance module sidebar, click Issues (under the EVIDENCE & REPORTING caption).
2

Click New Issue (or generate from findings)

Choose title, description, severity (Critical / High / Medium / Low), and source (Audit, Test Failure, Access Review, or Manual).
3

Link to control and audit period

Select the control and audit period the issue relates to. This ties the issue to your audit scope.
4

Assign and set a due date

Assign the issue to a team member and set a target remediation date.
5

Update status as you remediate

Move the issue from Open → In Progress → Resolved. When signed off by the auditor, mark Closed.

​
Issue status lifecycle

StatusMeaningNext step
OpenIssue is new or not yet addressedAssign and begin work
In ProgressRemediation is underwayComplete work and gather evidence
ResolvedIssue is fixed; evidence is collectedShare with auditor for verification
AcceptedAuditor acknowledges the fixVerify closure in audit report
ClosedIssue is officially resolved and documentedArchive; reference for future audits

​
Linking issues to controls and evidence

Each issue can reference:
  • Control — the specific control being tested
  • Audit Period — which audit uncovered the issue
  • Evidence — links to Evidence Collection items (test results, attestations, logs) that support closure
When an issue is marked Resolved, attach evidence that demonstrates the fix. This is critical for auditor sign-off and for SOC 2 Type 2 audits, where auditors verify that controls operated throughout the period.
Compliance issues created from failed Control Tests automatically link to the control and test. Issues from Access Reviews findings also auto-link to the review evidence.

​
Integration with audit reports

Issues, findings, and their closure status flow into Reports under the audit period. Auditors can review:
  • Total issues vs. resolved
  • Severity distribution
  • Remediation timeline and evidence
  • Sign-off on closed issues
Type 2 audits require demonstrating that controls operated for the entire audit period. Ensure issue closure dates and remediation timelines align with the audit window. Late remediations may require additional evidence or qualifications in the audit report.

​
Frequently asked questions

Yes. Each audit period is tied to one framework. If you’re audited against SOC 2 and ISO 27001 simultaneously, create two separate audit periods.
Review the issue due date alongside the audit period end date. The audit report flags any unresolved critical/high-severity issues that fall within the audit window.
Test results, attestations, policy documents, configuration screenshots, or audit logs — whatever demonstrates the control now works. See Evidence Collection.