Knowledge base / Audit and compliance

Audit evidence

When an auditor relies on a system-generated report, they test where the data came from, whether it is complete, whether the logic is right, who controls the rules and whether the result can be reproduced. ClearDuty's Audit tab is built around those questions.

The twelve readiness checks

1. Source system recorded — system ID and client.
2. Real extracts, fingerprinted — every file with its SHA-256. Sample data is never audit evidence.
3. Extract date for every file.
4. Row counts reconciled to SAP — the SE16N count matches the file.
5. User master and profiles loaded — USR02 and UST04.
6. Ruleset version approved — version, approver and date.
7. Engine tests passed — all built-in test cases give the expected result.
8. Reconciled to SAP GRC — every difference explained.
9. Analyst and reviewer named.
10. Every open high or critical finding has an owner.
11. Reviewer sign-off on these results.
12. Valid licence covering all users.

Reviewer sign-off

The sign-off is tied to the exact set of findings and their status. Any later change to data, scope, ruleset, as-of date or mitigations invalidates it, so it has to be repeated. This is deliberate.

The audit pack

One Excel workbook: management summary, findings, the authorization-level evidence for each, mitigating controls, remediation status, engine test results, the GRC reconciliation, the source files with fingerprints and row counts, and the change log.

Sharing outside the security team

Pseudonymise user IDs and role names with one click before export. The re-identification key is kept separately.

Still stuck? Ask us — we answer within one working day.