Question - Internal Control "Control without Audit Plan" Manual removal

Posting Rules:

I have quite a few internal controls that I created in my initial patch work process that the dynamic status claims that there is “Control without Audit Plan” but I don’t want them to have audits. When I go into the control, set an audit (filling out the requires with dummy data), save, and then go back in and turn it off the status goes away.

Is this a bug? or am I circumventing something with this work around? I have many controls right now that are maintenance only, its messy for it demand audits I don’t intend to supply.

(Eramba Enterprise v. 3.29.1)

I believe that’s a canned/default alert. You should be able to turn it off, or even better, modify it to include an additional criteria to make it only fire at the right time. For example, put a custom field on controls to indicate that an audit is required, and add that as a second criteria for the alert.

1 Like

It’s a default status. Audits are the only way to know if the control works or not. That status warns you that a production control has no audits; therefore, you can’t know if the control works!

You can check the Internal Control docs here:

Feels though that some internal controls could simply require maintenance? Also I can get rid of the default status it seems through the arduous process of creating a dummy audit and then turning it off.

I will endeavour to pivot to “controls require audits” if that is the intention of the system.

I’m in the camp that not all controls require audits. The audits should be selected on a risk-based basis and for some, maintenance may be all that you care about.

Eramba is highly customizable to adapt to YOUR processes. The platform shouldn’t generally dictate what your processes should be - it is there to support you.

In this case, you can simply disable the Dynamic Status if that is what fits your processes best….

Auditing sometimes is not an option simply because of budget. Audits take time, and time equals money for the company, and companies usually don’t have an unlimited budget!

A common approach then is to have audits on a risk-based approach, like @david.schroth mentions.

This piece of the docs explains the estimation of audit costs!