Specification
Audit Programme Specification
This specification defines the GRC Documentation Library's automated audit programme: the set of machine-checked rules that gate every change to the library, the mechanisms by which the rules are enforced, the surfaces on which they run, and the conditions under which gates are added, modified, or retired.
- Type
- Specification
- Version
- 1.17.343
- Date
- 2026-11-07
- Owner
- Governance Library Maintainer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Core Governance
- Review frequency
- Annual, and upon addition or removal of any audit gate
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Design principles
- 4. Enforcement surfaces
- 5. Gate categories
- 6. Gate inventory (current)
- 7. Phase-completion gating
- 8. Audit programme failure handling
- 9. Adding a new gate
- 10. Modifying or retiring a gate
- 11. Relationship to the Citation Verification Specification
- 12. Out-of-scope acknowledgements
- 13. Framework alignment
- Pinned AIQT runtime checks
Frameworks it maps to
- ISO/IEC 27001:2022 Annex A.5.36 (Compliance with policies, rules and standards for information security)
- NIST CSF 2.0 GV.OC (organizational context)
- COBIT 2019 BAI06 (Managed IT Changes)
Related documents
- Citation Verification Specificationgovernance
- Document Index and Classification Registergovernance
- Governance Library Chartergovernance
- CHANGELOG.md (opens in a new tab)source
- TODO.md (opens in a new tab)source
Next
All Documents