What an audit-readiness package looks like
A small extract of the package RAMP prepares for an auditor or a continuous monitoring tool, built for a fictional company, Northwind Software.
Illustrative sample. Northwind is fictional, and its statuses, owners, dates and findings are made up. Control IDs and titles, evidence request templates and policy names come from RAMP's catalog. This is not an audit report, certification or attestation.
Gap summary
The summary leadership reads first: scope, test of design results and the gaps found, with next steps.
Download 01-gap-summary.mdControl matrix
Each control with its test of design and test of effectiveness status, gaps, owners and target dates.
Download 02-control-matrix.csvEvidence requests
Requests generated per control, with who is asked, how often, and examples of acceptable evidence.
Download 03-evidence-requests.csvPolicy map
Policies mapped to the controls they support, with their status.
Download 04-policy-map.csvAudit plan
How design and effectiveness testing proceeds, step by step, from sampling to exceptions to hand-off.
Download 05-audit-plan.mdSign-off record
Where the human reviews and approvals are recorded for the file.
Download 06-signoff.md
Want one for your organization?
Check where you stand first, or schedule a walkthrough.