An audit is a list of questions. The difficulty is that every answer has a different owner, every answer needs evidence, and every piece of evidence produces another question.
AuditDesk is the working layer between an auditor and the company. Requests arrive with scope, control references, owners, reviewers and due dates. Evidence stays versioned beside the answer. Questions and returns stay on the same thread. The closed cycle becomes the starting point for the next one.
The spreadsheet is not the audit
A request list usually begins in a spreadsheet, then breaks apart. Attachments land in email. Screenshots arrive in chat. Follow-up questions reach the coordinator but not the evidence owner. A reviewer accepts a newer version while someone else is still looking at the old one. Next year, the same requests arrive and the organization starts from zero.
The request, the answer, the evidence and the decision are one record — not four conversations.
One desk for the cycle
Each audit moves through planning, fieldwork, review, reporting and closed. The dashboard shows active cycles, open and overdue requests, submissions waiting for review, acceptance rate and evidence volume. Coordinators can see progress by area and owner, record reminders for overdue work, and export the accepted evidence pack as a CSV.
Scoped
Every request has a reference, control, area, priority, owner, reviewer and due date.
Attributable
Every answer, upload, question, return, acceptance and reminder records who acted and when.
Reusable
A cloned request points directly to its predecessor and the evidence accepted in the previous cycle.
Evidence with history
The evidence room handles files as metadata, links, screenshots, exports and notes. Adding an artifact with the same name creates a new version and marks the old one superseded; nothing silently disappears. The current artifact is clear, and the history remains available when a reviewer needs to understand what changed.
The review loop
Owners work from a personal queue. They add an answer and evidence, then submit. Submission freezes the record until a reviewer accepts it or returns it with a reason. Questions live on the request thread. A return puts the item back in the owner's queue; resubmission creates another explicit event. Not-applicable decisions also require a reason.
Answer the request and attach evidence from the source system.
Hand a stable record to the assigned reviewer.
Accept, ask a question or return with a concrete reason.
Keep the decision and its evidence ready for the next cycle.
The reusable record
Closing an audit freezes it. Cloning a cycle copies the request list and links every new request to the prior one. Owners can see last year's accepted artifacts without treating them as automatically valid this year. The control library cuts across audits to show the latest accepted record for each control and how often it has been used.
How it is built
AuditDesk uses the System32 house stack: a Go backend with standard-library routing and SQLite, and a Next.js 16 / React 19 frontend built with shadcn/ui and Tailwind v4. The demo workspace contains fourteen people, five audit cycles, 180 scoped requests, versioned evidence, reviewer threads and full lifecycle histories. It includes dashboard, audits, requests, queue, library and activity views, shared System32 sign-in plumbing, responsive dark and light themes, reminders and evidence-pack export.
AuditDesk is available now in the System32 catalog. Start from a blank request list or clone the last cycle.