Audit management software
for internal audits
For auditors and QM, ISMS and compliance teams who run internal and supplier audits. Plan audits, record findings and track actions until they are closed — audit reports and the management review come from the same data instead of spreadsheets.
- 01Audit planning: audit programmes and audits with scope, criteria and schedule
- 02Audit sessions: rate every requirement as conform, partial, nonconform or not applicable
- 03Action tracking: nonconformities and observations at the requirement, actions with owners and deadlines
- 04Audit reports and the management review from the same data
The process follows the ISO 19011:2026 guideline for auditing management systems — for ISO 9001, ISO 27001, NIS2 and other standards.
Why Complaica as your internal audit management tool
What auditors and owners gain once audits no longer run in spreadsheets.
Audits at the requirements
Ratings, findings and evidence hang on the standard’s requirement and on the objects it concerns — not in a spreadsheet beside the system.
Evidence on the object
Documents and evidence sit on the process, system or site they support; the auditor finds them where the check happens. How Complaica chains this evidence and secures it with eIDAS time stamps is shown on the evidence management page.
Actions until closed
A nonconformity becomes an action with an owner, a deadline and a status; every status change is recorded with author and date.
Working in one system
Internal and external participants — auditors, process owners, suppliers — work in the same system; access is granted per object and by link.
SaaS or on-premises
Hosted in Germany or in your own infrastructure — the licence costs the same either way.
Internal audit software: the audit module step by step
How you run internal audits in Complaica — from the audit programme to the management review.
- Set scope
- Name auditors
- Prepare requirements
- Rate
- Record findings
- Assign actions
- Verify the result
- Report and management review
01 / 07 · Audit programme
Plan audit programmes
Create audit programmes for a period — the 2027 annual programme, say — with objectives, scope, audit criteria and schedule. Internal audits, supplier audits and combined audits sit in the same tree, each with its sessions and findings. You name auditors and owners per audit; external auditors get access per object and by link.
ISO 19011 advises putting resources where risks are high and performance is low. The fulfilment level and the risk assessment in Complaica show where that is.
02 / 07 · Audit plan and sessions
Conduct audit sessions
Split an audit into sessions — per process, site, clause or interview slot. In the session, auditors rate every requirement as conform, partial, nonconform or not applicable; the session’s progress is visible at any time. The requirements come from the standard’s catalog; documents and evidence already sit on the objects.
Sessions take place on site, remotely or both — ISO 19011:2026 gives expanded guidance on that.
03 / 07 · Findings
Register findings and nonconformities
From the session you create a finding right at the requirement: a nonconformity or an observation, with status, severity, evidence and owners. All findings of an audit and of a programme stand in one filterable list.
04 / 07 · Actions
Corrective and preventive actions
Nonconformities become actions with owners, deadlines and status — correction, corrective action and, where a standard asks for it, preventive action. You define the workflow yourself — for instance, that an action is closed only after it has been checked; every status change is recorded with author and date. In the follow-up audit the earlier rating stays visible at the requirement.
05 / 07 · Audit reports
Produce audit reports
The audit report sums up an audit’s objectives, scope, criteria, findings and conclusions and moves through its status up to issue. Audit programme, audit and the audited standards are recorded on the report.
06 / 07 · Management review
Management review
Audit results, open nonconformities and the state of corrective actions go into the management review as inputs, as ISO 9001 and ISO 27001 require in clause 9.3. Conclusions and the activities decided are recorded on the review, and its history stays traceable.
07 / 07 · Records
Audit records and audit readiness
ISO 19011 advises keeping audit related records (clause 5.5.7): on the programme, on each audit, on findings and actions. In Complaica they sit on the objects and requirements; dashboards show how ready objects and requirements are before the next internal or external audit.
From Excel checklists to audit management software
Audits can be run with checklists in Excel and reports in Word — until findings from several audits, actions with deadlines and a second standard come together. Five points where Complaica organises the work differently.
| Excel and Word | Complaica | |
|---|---|---|
| Audit programme | An annual plan as a spreadsheet, dates in the calendar. | Programmes with their audits, sessions and findings in one tree; status and progress per audit. |
| Checklists | Questions copied again for every audit, ratings in cells. | The requirements come from the standard’s catalog; the rating stays at the requirement and is visible in the next audit. |
| Findings and actions | An action list, followed up by hand. | Findings become actions with owners, deadlines, status and an effectiveness check. |
| Audit reports | A Word document per audit, copied out of the spreadsheet. | The report rests on the audit’s data and moves through its status up to issue. |
| Several standards | One checklist per standard, maintained twice. | Combined audits across ISO 9001, ISO 27001, NIS2 or the GDPR on the same objects. |
Kinds of audit and several standards
Internal audits, supplier audits and preparing for the certification audit run in the same audit programmes — for every standard you keep in Complaica.
Every standard ships with its requirements catalogue; your own catalogues can be added at any time.
- Internal audits (first party)
The organization audits itself — as ISO 9001, ISO 27001 and the other management system standards require in clause 9.2.
- Supplier audits (second party)
Audits at external providers; in Complaica suppliers are objects with their processes, risks and findings.
- Certification audits (third party)
The certification body audits under ISO/IEC 17021-1. Complaica provides the evidence, reports and state of actions for it.
- Combined audits
Two or more management systems in one audit, such as ISO 9001 and ISO 27001; the audit report records the audited standards.
SaaS or on-premises
Complaica runs where your organisation needs it — the licence costs the same either way.
- SaaS, hosted in Germany
The SaaS edition is operated in Germany; you work in the browser, with no infrastructure of your own.
- On-premises in your infrastructure
You run Complaica in your own environment — for organisations whose data may not leave the house.
- Bring your existing data
Import and export from and to Excel and through the REST API; our specialists support the move of your data free of charge.
Audit consulting to ISO 19011
Consulting along the audit process — from the audit programme to the management review, as far as you need it.
- Setting up the audit programme
Set the programme’s objectives, risks, scope and schedule and create it in Complaica.
- Internal audits
Conduct or accompany internal audits to ISO 19011 — for ISO 9001, ISO 27001, NIS2 and other standards.
- Supplier audits
Plan and conduct audits at external providers, follow up findings and actions with the supplier.
- Preparing for certification
Provide evidence, reports and open actions the way the certification body wants to see them.
- Management review
Prepare the inputs from audits and actions and accompany the management review.
What customers say about Complaica
“We can do everything we need in one tool”
Complaica is extremely user-friendly and customising it is child’s play. We can take care of ISO compliance and data protection with it — we can do everything we need in one tool. For us, Complaica is better than the alternatives on the market and cheaper at the same time.
More …Less
Complaica is extremely user-friendly and customising it is child’s play. We can take care of ISO compliance and data protection with it — we can do everything we need in one tool.
For us, Complaica is better than the alternatives on the market and cheaper at the same time.
“The optimised compliance process”
One of the features we like best about Complaica is the optimised compliance process. The user interface has a clear, structured design that offers more usability and encourages a higher working speed. This not only gives new users a steep learning curve, it also lets experienced users minimise their effort. In every phase of the security management lifecycle, recurring tasks such as scoping, structure analysis, modelling and even the tracking of risks and measures are supported by a wealth of functionality. On top of that the platform’s performance is great — it is stable and excellent in terms of speed.
More …Less
One of the features we like best about Complaica is the optimised compliance process. The user interface has a clear, structured design that offers more usability and encourages a higher working speed. This not only gives new users a steep learning curve, it also lets experienced users minimise their effort.
In every phase of the security management lifecycle, recurring tasks such as scoping, structure analysis, modelling and even the tracking of risks and measures are supported by a wealth of functionality.
On top of that the platform’s performance is great — it is stable and excellent in terms of speed.
“The guided approach played a decisive role for us”
We were new to compliance and to implementing ISO 27001, and had to go through the complicated certification process. Given the regulatory complexity, we wanted to find the best way for us to get started. Our project manager (aka security officer) had never worked with such compliance standards and rules before. So we decided on support from a third party — Complaica, to be precise. The guided approach played a decisive role for us. Complaica had all the detailed explanations for the compliance check and the risk analysis, including practical suggestions.
More …Less
We were new to compliance and to implementing ISO 27001, and had to go through the complicated certification process.
Given the regulatory complexity, we wanted to find the best way for us to get started. Our project manager (aka security officer) had never worked with such compliance standards and rules before.
So we decided on support from a third party — Complaica, to be precise. The guided approach played a decisive role for us. Complaica had all the detailed explanations for the compliance check and the risk analysis, including practical suggestions.
Streamline compliance tasks with AI assistance
With the optional AI integration (MCP), Complaica answers questions about ISO 19011 and the audited standards, suggests audit questions, words findings and corrective actions and sums up audit results. Assessment and decisions stay with the auditors.
- 01Answer questions about ISO 19011 and the 2026 edition
- 02Suggest audit questions for a requirement
- 03Word findings and corrective actions and assign them
- 04Sum up an audit’s results for the report and the management review
- 05Explain how to use Complaica — which feature does what
ISO 19011 in brief
ISO 19011 is the international guideline for auditing management systems — recommendations, not a requirements standard, and nothing is certified against it. The fourth edition, published in May 2026, mainly expands the guidance on remote auditing methods (from ISO/IEC TS 17012) and on virtual locations in Annex A.
- 4 Principles of auditing
Integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based and a risk-based approach.
- 5 Managing an audit programme
Objectives, risks and opportunities, scope, resources and records of the programme; monitoring and improvement.
- 6 Conducting an audit
Preparing, conducting, findings and conclusions, the report, completion and follow-up.
- 7 Competence of auditors
Behaviour, knowledge and skills of auditors and audit team leaders, and their evaluation.
- Annex A
Additional guidance for auditors, among other things on remote auditing methods and virtual locations.
ISO information as of 25 October 2026
Frequently asked questions about internal audit management software
What is audit management software?
Audit management software runs the audit process in one system: audit planning in programmes and audits, ratings per requirement in audit sessions, findings, action tracking, audit reports and the management review. Instead of keeping checklists, action lists and reports apart, auditors and owners work on one data set.
Who is Complaica’s internal audit software for?
For management system auditors and for QM, ISMS and compliance teams who run internal and supplier audits under ISO 9001, ISO 27001, NIS2, TISAX, Grundschutz++ or their own rules. It is built for management system audits, not for financial audit.
How does an internal audit run in Complaica?
You create the audit in the audit programme with scope and criteria, split it into sessions, rate every requirement, record findings at the requirement and create actions for nonconformities. The audit report moves through its status up to issue; the results go into the management review.
How are findings and actions tracked?
Findings — nonconformities and observations — stand with status and severity in a filterable list per audit and programme. Actions carry owners, deadlines and status and appear on the timeline and the board; every status change is recorded with author and date.
Can external auditors work in Complaica?
Yes. Internal and external participants — auditors, suppliers, consultants — work in the same system; access is granted per object and by link.
Can audits cover several standards?
Yes. An audit programme can hold audits for different standards, and the audit report records the audited standards. Combined audits of two management systems — ISO 9001 and ISO 27001, for instance — are also described in ISO 19011.
How do internal audit and management review fit together?
ISO 9001 and ISO 27001 require in clause 9.3 that audit results go into the management review. In Complaica audit reports, open nonconformities and the state of actions are ready for it; conclusions and activities are recorded on the review.
What is ISO 19011, and can it be certified?
ISO 19011 is the international guideline for auditing management systems: principles, managing an audit programme, conducting audits and auditor competence. It gives recommendations and cannot be certified against; what is certified is the management system, under ISO 9001 or ISO 27001 for instance. Complaica is not “certified to ISO 19011” either — the software supports the processes the guideline describes.
What is new in ISO 19011:2026?
The fourth edition of May 2026 replaces ISO 19011:2018. The main changes: expanded guidance on remote auditing methods, taken from ISO/IEC TS 17012, and an expanded Annex A on remote auditing methods and virtual locations. The terms rest on ISO 9000:2026.
Can existing audit checklists be moved over?
Yes. Complaica imports and exports data from and to Excel and through the REST API; documents are filed on the object. Our specialists accompany moving your data at no charge.
Is Complaica available as SaaS or on-premises?
Both. The SaaS edition is hosted in Germany; on-premises, you run Complaica in your own infrastructure. The licence costs the same either way.
Sources References and legal sources
3 sources · ISO 19011, ISO 9001, ISO/IEC 27001 Show Hide
Norms & standards
Only the version published in the respective official journal is legally binding. Standards are available from the publishers named.
Audit management with Complaica
Ask for a demo or the price list — or talk to us about your audit programme and moving your existing checklists over.
Thank you.
We will get back to you within one business day.
Not sent.
That did not work. Please check the fields or email us directly.