> ## Documentation Index
> Fetch the complete documentation index at: https://docs.regentra.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Lifecycle

> Plan audit periods, track findings, manage compliance issues to closure, and prepare for sign-off.

The audit lifecycle in Regentra spans four phases: planning an audit period, recording findings during the audit, managing issues to closure, and preparing for auditor sign-off. This page covers Audit Periods, Audit Findings, and Compliance Issues as one integrated workflow.

## What you can do

* **Create audit periods** — Define an audit window (start/end date), framework scope, and audit type (Type 1 or Type 2)
* **Record auditor information** — Capture the external auditor's name and email for coordination
* **Respond to information requests** — Manage [audit requests (IRLs)](/compliance/audit-requests) from auditors with a `NOT_READY → INTERNAL_REVIEW → AUDIT_READY → APPROVED / FLAGGED` workflow
* **Log findings and issues** — Issues can be sourced from the audit, [Control Tests](/compliance/control-tests), [Access Reviews](/compliance/access-reviews), or manual entry
* **Track issue status** — Move issues from Open → In Progress → Resolved as your team remediates
* **Assign and monitor** — Assign owners, set due dates, and see progress in dashboards

## Plan an audit period

<Steps>
  <Step title="Open Audit Periods">
    In the Compliance module sidebar, click **Audit Periods** (sits under the small EVIDENCE & REPORTING caption).
  </Step>

  <Step title="Click New Audit Period">
    Fill in the audit name (e.g. "Q1 2026 SOC 2"), choose your [Framework](/compliance/frameworks), select report type, and set start/end dates.
  </Step>

  <Step title="Add auditor details (optional)">
    Enter the external auditor's name and email so coordination is logged in one place.
  </Step>

  <Step title="Save the period">
    Click **Create Period**. The audit window is now active and visible to your team.
  </Step>
</Steps>

## Audit period statuses and types

| Status        | Meaning                                                |
| ------------- | ------------------------------------------------------ |
| **Active**    | Audit is currently underway or scheduled to start soon |
| **Completed** | Audit has finished; findings are documented            |
| **Cancelled** | Audit was postponed or abandoned                       |

**Report Types:**

* **Type 1** — snapshot audit of controls at a point in time
* **Type 2** — audit of controls over a period of time (more common for SOC 2, ISO 27001)

## Log and track compliance issues

<Steps>
  <Step title="Open Compliance Issues">
    In the Compliance module sidebar, click **Issues** (under the EVIDENCE & REPORTING caption).
  </Step>

  <Step title="Click New Issue (or generate from findings)">
    Choose title, description, severity (Critical / High / Medium / Low), and source (Audit, Test Failure, Access Review, or Manual).
  </Step>

  <Step title="Link to control and audit period">
    Select the control and audit period the issue relates to. This ties the issue to your audit scope.
  </Step>

  <Step title="Assign and set a due date">
    Assign the issue to a team member and set a target remediation date.
  </Step>

  <Step title="Update status as you remediate">
    Move the issue from **Open** → **In Progress** → **Resolved**. When signed off by the auditor, mark **Closed**.
  </Step>
</Steps>

## Issue status lifecycle

| Status          | Meaning                                     | Next step                            |
| --------------- | ------------------------------------------- | ------------------------------------ |
| **Open**        | Issue is new or not yet addressed           | Assign and begin work                |
| **In Progress** | Remediation is underway                     | Complete work and gather evidence    |
| **Resolved**    | Issue is fixed; evidence is collected       | Share with auditor for verification  |
| **Accepted**    | Auditor acknowledges the fix                | Verify closure in audit report       |
| **Closed**      | Issue is officially resolved and documented | Archive; reference for future audits |

## Linking issues to controls and evidence

Each issue can reference:

* **Control** — the specific control being tested
* **Audit Period** — which audit uncovered the issue
* **Evidence** — links to [Evidence Collection](/compliance/evidence-collection) items (test results, attestations, logs) that support closure

When an issue is marked **Resolved**, attach evidence that demonstrates the fix. This is critical for auditor sign-off and for SOC 2 Type 2 audits, where auditors verify that controls operated throughout the period.

<Note>
  Compliance issues created from failed [Control Tests](/compliance/control-tests) automatically link to the control and test. Issues from [Access Reviews](/compliance/access-reviews) findings also auto-link to the review evidence.
</Note>

## Integration with audit reports

Issues, findings, and their closure status flow into [Reports](/compliance/reports) under the audit period. Auditors can review:

* Total issues vs. resolved
* Severity distribution
* Remediation timeline and evidence
* Sign-off on closed issues

<Warning>
  Type 2 audits require demonstrating that controls operated for the entire audit period. Ensure issue closure dates and remediation timelines align with the audit window. Late remediations may require additional evidence or qualifications in the audit report.
</Warning>

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Can I create audit periods for multiple frameworks?">
    Yes. Each audit period is tied to one framework. If you're audited against SOC 2 and ISO 27001 simultaneously, create two separate audit periods.
  </Accordion>

  <Accordion title="How do I know which issues must be closed before the audit ends?">
    Review the issue due date alongside the audit period end date. The audit report flags any unresolved critical/high-severity issues that fall within the audit window.
  </Accordion>

  <Accordion title="Can I link an issue to multiple controls?">
    Each issue links to one control. If the issue affects multiple controls, create separate issues or a summary issue and link the others as related.
  </Accordion>

  <Accordion title="What evidence proves an issue is resolved?">
    Test results, attestations, policy documents, configuration screenshots, or audit logs — whatever demonstrates the control now works. See [Evidence Collection](/compliance/evidence-collection).
  </Accordion>
</AccordionGroup>