QULDEXResources · Glossary
What is a workflow state transition in an audit?
What does a state transition mean?
An audit passes through stages. Without defined transitions, work drifts: a report is drafted before testing is finished, or an audit is closed with actions still open.
Defining the conditions for each move turns good practice into a control. The record of each transition then shows an auditor that the process was followed.
What defines a transition?
The stage the record is in and the stage it may move to.
What must be true first, such as all tests recorded or all findings graded.
The role that authorises the move, and what is recorded.
What do audit stage gates look like?
Three transitions in an internal audit.
| Transition | Condition and approver |
|---|---|
| Planning to fieldwork | Audit plan agreed with the auditee; approved by the audit sponsor |
| Fieldwork to reporting | Every planned test has a recorded result; approved by the lead auditor |
| Reporting to closure | Report issued and corrective actions agreed, each with an owner and date; approved by the head of audit |
This is an illustration written for this page, not a customer record.
Where do frameworks expect controlled stages?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clause 9.2.2 | The audit programme defines criteria, scope, frequency, methods, responsibilities and reporting. |
| ISO 27001 | Clause 8.1 | Processes are planned, implemented and controlled, with criteria for each. |
| SOC 2 | CC8.1 | Changes move through authorisation, testing and approval before implementation. |
| ISO 19011 | Clause 6 | An audit proceeds through initiating, preparing, conducting, reporting, completing and follow-up. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What goes wrong without controlled transitions?
Skipped stages
An audit is marked complete with tests unrecorded.
Instead: make the conditions a hard check.
Anyone can move it
Stages are changed by whoever is working on the record.
Instead: limit each transition to the right role.
No record of the move
The stage changes with no trace of who or why.
Instead: log every transition.
How does QULDEX handle this?
Plan, test, record findings and report in eight phases, with every step recorded against the audit.
Workflow State Transition: common questions
What is a stage gate in an audit?
A checkpoint between two stages where defined conditions must be met, and often an approval given, before work can continue.
How many stages should an audit have?
Enough to control the work without slowing it. ISO 19011 describes six activities from initiating to follow-up; many teams use a similar number.
Can a transition be reversed?
Yes, if the workflow allows it, for example returning an audit from reporting to fieldwork. The reversal should also be approved and recorded.
Sources
- ISO 19011:2018, Guidelines for auditing management systems
- ISO/IEC 27001:2022, Information security management systems: Requirements
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
- ISO/IEC 27002:2022, Information security controls
Eight audit phases, each with its own gate
Controls, evidence, findings and corrective actions in one audit workspace.