Can SCOUT import our existing risk and control matrix?

Yes. Import it from Excel, map the columns, and SCOUT keeps your wording. It then checks each item against your library and reports the risks the matrix may not cover.

Who performs the audit tests?

Your auditors. SCOUT drafts the procedures and tracks progress, keeps operating tests locked until the design test is concluded, and leaves the conclusions to the engagement lead.

Does SCOUT work with our GRC system?

Yes. Litmus can sit on top of your GRC system and bring your engagements in, so the audit plan stays aligned with your system of record.

SCOUTFieldwork

A risk-based plan your reviewer can trace.

SCOUT rates the risks for an engagement, finds the criteria for each in your library and drafts the procedures, or starts from the risk and control matrix you already have. Then it keeps fieldwork on track, with review at every step.

Book a demo The whole suite

Approved SCOUT plan with a Needs your attention panel and a risk assessment rating likelihood and impact. — Real SCOUT output, from a demonstration organisation built on synthetic documents.

How it works

SCOUT, step by step.

Start from the matrix you already have

Import your risk and control matrix from Excel. SCOUT keeps your wording, checks each item against your library, and lists the risks the matrix may not cover, for you to add or leave out.

SCOUT import report for an imported risk and control matrix: two procedures without a supported citation, and two risks the matrix may not cover, one partially covered and one not covered.

Fieldwork on rails

The approved plan becomes a checklist. Assign procedures, submit work for review, approve or return it. Operating-effectiveness tests stay locked until the design test is concluded, unless the engagement lead records why not.

Fieldwork checklist: the design test for risk R6 is in progress, and its two operating tests show Locked until design concludes.

Plan from the risks

SCOUT rates each risk for likelihood and impact, searches your library for the criteria behind it, and drafts design and operating tests. Where it finds no criteria or no control, it says so.

Review before anything moves

The engagement lead approves the plan before fieldwork starts. Every version is kept with a field-by-field comparison, and review comments stay pinned to the risk or procedure they’re about.

Findings and workpapers

A chat grounded in your library suggests findings in the five-element format — condition, criteria, cause, effect, recommendation — for you to confirm, and a quality review grades each element of the draft.

Stays with the auditor

Approving the plan, recording each conclusion, and confirming every finding. SCOUT drafts and tracks; the engagement lead decides.

What you get

Engagement plan (.docx)
Risk and control matrix (.xlsx)
Workpapers (.docx)
Findings in the five-element format (.docx)

Straight answers

Can SCOUT import our existing risk and control matrix?: Yes. Import it from Excel, map the columns, and SCOUT keeps your wording. It then checks each item against your library and reports the risks the matrix may not cover.
Who performs the audit tests?: Your auditors. SCOUT drafts the procedures and tracks progress, keeps operating tests locked until the design test is concluded, and leaves the conclusions to the engagement lead.
Can a reviewer see what changed in a plan?: Yes. Every version of a plan is kept with a field-by-field comparison, and review comments stay pinned to the risk or procedure they refer to.
Does SCOUT work with our GRC system?: Yes. Litmus can sit on top of your GRC system and bring your engagements in, so the audit plan stays aligned with your system of record.

NextPEN — draft the report

The litmus test for trust.

See it on your own kind of audit work.

A working session, not a slide deck. Bring your IT and security team; their questions are welcome from the first meeting.

Book a demo