Skip to content
TrustMosaic

Governance

MeshTechAudit

IT audit and IT general controls, with access reviews, change management and system testing in the same plan as the audit.

If your IT audit still works like this

  • Access reviews on an exported spreadsheet?The list arrives outdated, and the manager's approval sits in an email.
  • IT audit outside the annual plan?IT engagements run in parallel and don't show up in the audit universe coverage.
  • Change testing without system evidence?A ticket screenshot doesn't prove the change was approved before going to production.
  • IT controls disconnected from business risks?The ERP access failure doesn't show up in the payment fraud risk.

What MeshTechAudit does

  • IT general controls matrix

    Access, changes, operations and development, for each relevant system.

  • Access reviews

    Campaigns in which each manager confirms or removes access, with the system's list attached.

  • Change testing

    A sample of changes with approval, testing and deployment checked.

  • Relevant systems

    A system inventory with owner, criticality and linked controls.

  • In the audit plan

    IT engagements go into the same MeshAudit annual plan.

  • Link to risks

    An IT deficiency points to the business risks it affects.

Access review

The manager confirms access where it is listed.

The system's user list goes into the campaign, each manager confirms or requests removal, and the result becomes evidence for the control.

Changes

Each change tested with evidence from the system.

The sample comes from the change log, and each item is checked: approval before production, testing and separation between developer and deployer.

Illustrative screens with fictitious data.

In the language of IT auditors

IT general controls organized as in SOX/ITGC, with references to COBIT and ISO 27001.

The AI suggests, the auditor decides

Mesh Intelligence flags access that doesn't match the job role and suggests the change sample. The test conclusion belongs to the auditor.

Fits with

  • MeshAuditFrom the annual plan to follow-up: programs, work papers, findings and action plans in one flow, with regulatory profiles such as BACEN and ANS.
  • MeshControlDesign, testing and effectiveness of internal controls, linked to the risks they mitigate.

Questions from IT auditors

How does the access list come in?

By loading a file exported from the system, or through a connector when available.

Does it work for external SOX audits?

Yes. Tests, samples and evidence are organized the way the external auditor expects to receive them.

Do managers need a license to review access?

No. People who only review access join as respondents.

See MeshTechAudit with a case from your industry

The demo is led by the founder, who has seven years of internal and external audit experience.

Modules are licensed separately. The platform comes with all of them.