Audit Management System: configurable audits for BFSI, from schedule to sign-off
The Audit Management System is a configurable, API-first audit platform for BFSI organisations. Configure the audit types your regulator cares about, publish versioned checklists, let schedules raise the work, and show afterwards, from an activity log, who decided what and when.
- Audit types, checklists, workflows and SLAs are configuration, not code
- One schedule can create an audit for each of up to 200 branches
- Queries, findings and corrective actions in the same workflow
Talk to us about the Audit Management System
What it does
One platform for the whole audit cycle
From the checklist an audit runs against to the corrective action that closes a finding, every stage runs in one workspace.
Configuration over code
Audit types, versioned checklist templates, approval workflows, assignment rules, SLAs, the escalation matrix, notifications, picklists, branches and custom fields are all configured as data.
Audits from raise to close
Created by hand, by a schedule, by CSV import or over the API; assigned by rule, pool or name; executed against a snapshotted checklist with evidence and remarks.
Scoring
Weighted or count-based scoring, with rating bands that turn a percentage into a label and an outcome of Pass, Fail or Conditional.
Queries to the branch
The auditor asks the branch a question against a checklist item. The branch answers with evidence, and the auditor accepts it or re-raises it, up to a set limit, after which it escalates.
Findings and corrective actions
Raised by hand or automatically from a failing answer, with severity, category, owner and deadline, then remediated, evidenced and verified.
Scheduling
One-time, daily, weekly, monthly, quarterly, yearly or cron schedules in their own time zone, with targets that turn one schedule into one audit per branch, up to 200.
SLAs, escalation and notifications
A warning at a set share of the SLA, then an escalation ladder per audit type, by in-app message, email, SMS and WhatsApp.
Dashboards and reports
Dashboards per role, nine standard reports and a three-step custom report builder, all exportable to CSV.
Integrations
API keys, signed webhooks, sync-back to your LOS or LMS, OpenID Connect single sign-on with role mapping, and embedding.
How an audit runs
From configuration to the closing report
Each stage has an owner, and every state change is written to the activity log.
System Admin
Configure
Set up picklists, branches, the audit type and its checklist template, then the workflow, assignment rules, escalation and notification rules. Publish the checklist.
Audit Manager
Schedule or create
A schedule run creates one audit per target and assigns it. Audits can also be created by hand, imported from CSV, or posted from your LOS over the API.
Audit Manager, a rule or the pool
Assign
Assignment rules choose an auditor by least load, round robin or at random. An audit no rule matches waits in the pool for an auditor to pick up.
Auditor
Execute
The auditor works the checklist beside the case data, answering items, adding remarks and attaching evidence. On a phone the same screen shows one item at a time.
Auditor and Branch User
Query
When an answer depends on the branch, the auditor raises a query. The branch responds with evidence, and the auditor accepts it or re-raises it; past the limit, it escalates.
Auditor, then Audit Manager
Submit and approve
The auditor submits once every blocker is cleared, and scoring runs on submission. The approver approves, or sends the audit back with a reason.
Auditor, then action owner
Findings and actions
Findings carry a severity, category, owner and due date. Their corrective actions are worked, evidenced, marked complete and verified by a manager.
Audit Manager and Compliance Viewer
Close and report
The manager closes the audit once findings are settled, or closes it anyway with a reason. Reports, exports and the activity log show what happened.
Running underneath every stage
The SLA clock warns before time runs out and escalates through the matrix, and when a source system is configured, the approved outcome is pushed back to it.
Who uses it
One workspace, with a view for each role
The sidebar shows only what a role can reach, and the server enforces the same permissions. Six roles come configured, and each can be edited or copied.
Set the workspace up and keep it running
Configuration, people, integrations and the audit trail. A System Admin also holds every permission an Audit Manager has.
- A checklist builder with guardrails and a preview of what the auditor sees
- An escalation matrix per audit type, with a global fallback
- Notification templates checked for unknown placeholders when saved
- Roles built from a fixed permission catalogue
Plan, assign, approve and report
A dashboard of active, overdue and on-hold audits, SLA compliance, approvals waiting and open findings, where every tile links to the work behind it.
- Assign up to 200 audits at once
- An approvals queue worked from a drawer, one audit after another
- Schedules in a table or a calendar, with the next runs previewed
- Nine standard reports, plus custom reports
Work the checklist beside the case
Case data on the left, the checklist on the right. The Field Auditor role adds mobile access, for checklists with field-visit items.
- Evidence attached per item; mandatory evidence blocks submission
- One item per screen on a phone, ending on review and submit
- A failing answer can raise a finding automatically
- A blocked submit lists what is still missing
Answer queries and fix what was found
The sidebar is short on purpose: Dashboard, Queries and Corrective Actions.
- Query threads run oldest first, with an iteration counter
- Each response carries the evidence that proves it
- Corrective actions updated, evidenced and marked complete
- Overdue actions escalate, so reminders reach the manager
Read everything, change nothing
Read-only across audits, queries, findings, actions, schedules, reports, configuration, users and the activity log, plus the right to export the activity log.
- Every standard report and shared custom reports, exportable to CSV
- The activity log filtered by date, action or entity, then exported
- The same trail available over the API for a SIEM
Controls
Controls for a platform that is itself in audit scope
In BFSI, the audit platform is itself in scope for the regulator.
Activity log
Who did what and when: every sign-in, configuration change, assignment, response, approval and upload is recorded with the actor, IP address and before and after state. Entries are kept for the retention period your settings define.
Only the assignee works an audit
Answering and submitting an audit are refused for anyone but its assignee, an administrator included.
Versioned checklists
A published checklist version is frozen, and each audit keeps the items it was created from, so audits stay comparable across versions.
Encrypted integration secrets
Gateway, SMTP, single sign-on and webhook secrets are encrypted at rest with AES-256-GCM and never returned by the API.
Integrations
Connects to your LOS, LMS and identity provider
The platform is API-first: the web app uses the same API that your systems call.
Sync-back to the source system
The LOS or LMS that raises a case receives the audit's outcome when it is approved, and again on close if you choose.
API keys
Permission-scoped keys for integrations, shown once, with optional expiry, rotation and revocation. A key cannot manage users or roles.
Signed webhooks
Subscribe to audit, query, finding, action, approval, schedule and user events. Deliveries are HMAC-signed and retried.
Single sign-on
OpenID Connect with PKCE and claim-to-role mapping, and a Microsoft Entra ID option. Local sign-in stays for System Admins as break-glass.
Email, SMS and WhatsApp
Connect an SMTP relay and SMS or WhatsApp gateways per workspace. With no gateway set, the in-app notification stands in.
CSV in and out
Import branches and audits from CSV with a preview before anything is written, and export lists, reports and the activity log.
Keep exploring
More for BFSI compliance teams
ConsentGuard
FinHub's DPDP consent management for BFSI: purpose-based consent, rights requests, data discovery, data mapping and DPIA.
ConsentGuardDocuSwift
A serverless document management system on AWS for lenders, with an immutable audit trail.
DocuSwiftBFSI document governance
A free assessment that maps your documents against DPDP Rule 6 and RBI expectations, with a written gap list.
Document governance
Questions
Questions about the Audit Management System
A configurable, API-first audit platform for BFSI organisations, from HabileLabs. Audit types, versioned checklists, workflows with approvals, manual and scheduled audits, queries, findings, corrective actions, evidence, SLA escalation, notifications, dashboards and integrations run in one workspace.
Any audit type you configure. Each type sets its platform, SLA, approval, scoring, the fields an auditor fills in about the thing being audited, and the evidence it requires.
Yes. Schedules run one-time, daily, weekly, monthly, quarterly, yearly or on a cron expression in their own time zone, and one schedule can create one audit for each target, up to 200 branches or subjects. Audits can also be imported from CSV or created over the API.
A finding has a kind, a severity, a category, an owner and a due date. Its corrective actions are worked by their owner, evidenced, marked complete and verified by someone other than the owner. An audit with open findings cannot be closed unless the manager closes it anyway and gives a reason.
Yes. Field auditors use the same web app on a phone, where the checklist shows one item per screen, and it can be installed as a progressive web app. Checklist items can be restricted to mobile, and only roles with mobile access can answer them.
Yes. A configured source system receives each audit's outcome when the audit is approved, and your LOS can create audits over the API. API keys, signed webhooks and single sign-on cover the other connections.
Who did what and when: each entry records the actor, IP address and before and after state. Entries are kept for the retention period your settings define, and the log can be exported as CSV or read over the API for a SIEM.
Two container images, PostgreSQL and S3-compatible object storage such as Amazon S3 or MinIO. Email, SMS and WhatsApp gateways are optional.
Next step
Tell us how your audits run
Tell us which audits your teams run and how they are assigned, approved and closed today, and our team will talk you through how the Audit Management System handles them.
- Configurable audit types and checklists
- Scheduled audits, one per branch, up to 200
- An activity log of who did what and when