Evidence you can test directly, not evidence someone had to prepare for you.
Internal audit's worst outcome is being late: a control failure that an external auditor or an incident surfaces first. The second worst is subtler — auditing evidence that was prepared for you by the team you are auditing, which tests their assembly skills, not the control.
TruSecure gives audit a direct line: evidence is system-sourced and continuous, each record traceable to the source query behind it, and every control carries its full state history — including every drift and how it closed. You test the record; the record tests the control.
What changes for the audit plan
- Plan from live state
The audit universe starts from actual control state — what exists, what is implemented, what is already flagged — not from last year's scope.
- Test the source, not the summary
Records trace to the source systems and the queries that produced them. Re-performance is a click, not a data request.
- See the history
Each control's timeline shows every drift, exception and closure. Point-in-time assertions come with the point in time.
- Report with citations
Findings cite the exact framework clause and the control — so remediation tracks to a named requirement, not a paraphrase.
What you'd actually look at
One test from the plan — the detail view that opens from every test row in the dashboard:
- Assertion
- all privileged accounts covered
- Method
- re-perform · source query
- Sample
- 214/214 accounts
- Result
- pass · 0 exceptions
- History
- drift 2× · both closed
- Evidence
- EV-2026-04417 · linked
What the function is measured against
| What it asks of the function | Citation | Where it is answered |
|---|---|---|
| NIS2 · procedures to assess the effectiveness of measures | Art. 21(2)(f) | Continuous control testing |
| ISO 27001 · internal audit at planned intervals | Clause 9.2 | Tests · history |
| ISO 27001 · management review inputs | Clause 9.3 | Reporting pack |
| SOC 2 · operating effectiveness over time | Trust Services Criteria | Drift history |
Independence, structurally
One structural point matters to this seat: the evidence is produced by the system, not by the auditee. Nothing in the audit view depends on the team under audit assembling, formatting or timing what you see — the preparation bias leaves the sample, and the fieldwork shortens because the data-request cycle disappears.
How audit functions usually start
A demo with a sample control tested end to end — source query, evidence record, history — then onboarding sets the audit universe against your first regime, and the subscription. No self-serve checkout, no per-seat math.
TruSecure helps operationalize requirements and prepare evidence. Legal interpretation should be validated by qualified counsel.