MetricStream Audit Management

MetricStream Audit Management (marketed as Internal Audit Management, alongside a companion SOX Compliance Management / Financial Controls product) is part of MetricStream Connected GRC platform. It is built for internal audit functions at large, complex organizations that need to run a risk-based audit program: defining an audit universe of auditable entities, planning and scoping audits against a centralized risk framework, scheduling auditors and tracking their time, executing fieldwork with workpapers and checklists, and managing issues and remediation through to closure.

The product organizes work around a multi-dimensional audit universe and integrates audit planning with risk assessment data so auditors can see prior audit history and current risk ratings for each entity before scoping a review. Fieldwork is supported with configurable workpaper templates, an offline briefcase mode for auditors working without connectivity, checklist configuration, and Microsoft Office document attachment. AI/ML is used to recommend related issues, classify findings, and suggest action plans during issue management. A companion SOX Compliance Management module handles Section 302/404 control testing, certifications and sub-certification reporting, and can be deployed alongside or independently of the audit module.

Both products sit on the shared Connected GRC platform, which provides the underlying risk/control data model, an AppStudio no-code configuration layer, built-in analytics/dashboards, and OpenAPI-compliant REST APIs (200+ built-in GRC APIs) for integrating with other enterprise systems. MetricStream does not publish named ERP (SAP/Oracle/NetSuite/etc.) connectors specific to the audit or SOX products; its documented out-of-the-box marketplace connectors instead cover CMDB, ITSM, vulnerability-management and threat-intelligence tools such as ServiceNow, BMC, Jira, Qualys, Rapid7 and Tenable.