Every station of internal audit, with its real screen

This is Raqeebo from the inside, station by station. The screenshots are real, with demo data (they still carry its former name, RAQIB).

Request a demo See pricing

Risk-based annual plan
The plan starts from the audit universe and risk scores, and is measured against real team capacity.
- An audit universe of entities that are scored and rank the plan
- Available against committed hours, and coverage per risk level
- No approval beyond capacity without a written gap statement; the plan locks once approved
Risk and control registers
Residual risk is derived from controls, not typed in.
- Inherent, residual and target risk on a scale you define
- Controls with tested design and operation; an untested control reduces nothing
- Key risk indicators (KRIs) with thresholds; a breach sends a notification
Risk heatmap
The risk picture on one screen.
- A 5x5 impact and likelihood matrix
- What falls outside risk appetite shows with no manual calculation
- From a cell to the risks inside it
Process maps
Every step of a cycle linked to its risks and controls.
- Draw the cycle step by step
- Link each step to its risks and controls
- A step with a risk and no control shows at once
Engagements and workpapers
Phases cannot be skipped, and a closed engagement cannot be edited.
- Planning, then fieldwork, then reporting, then closing
- An audit program and workpapers with preparer and reviewer, and evidence uploaded with a fingerprint
- Document requests to the auditee, and team hours against budget
Findings and corrective actions
A finding has all five elements, and closing is the auditor's call.
- Criteria, condition, cause, effect, recommendation: no incomplete finding is issued
- A corrective action has an owner, a due date and progress; overdue shows by date
- The action owner cannot write the verification date; the auditor verifies and closes
Fraud and whistleblowing
Scheme-based assessment, and a reporting channel anonymous by design.
- Fraud risk assessment per cycle, by known schemes and exposure
- A public reporting form with no identity field and no IP logging
- The channel ships closed; opening it is a decision recorded by name, and each report gets a case file
Combined assurance map
Who covers what, from proven work only.
- Management, the second line, internal audit and external assurance per risk
- Risks nobody covers, or covered only by management's own word
- Overlap: several parties covering the same thing
Board report
One dated paper that does not change once captured.
- Figures captured and stored with their date, each with its source
- Drill down from every figure to the rows behind it
- The chief audit executive's written conclusion before approval, and a Word report with real tables
Indicators dashboard
What needs your attention today.
- Plan execution and engagements in progress
- Open findings by severity
- Overdue actions, and risks outside appetite

Also in Raqeebo

Auditee portal
Each department sees and answers its own findings and actions only, and uploads remediation evidence; the scope is enforced on the server. Auditee accounts are free.
Single sign-on and two-factor
Sign in with your organisation's account via OIDC, two-factor authentication, and eight roles with permissions you set.
Governance and compliance
Versioned policies with staff acknowledgement, a delegation-of-authority matrix, committees with quorum, conflicts of interest, and compliance frameworks linked to risks.
Quality assurance
Self-assessment, auditee surveys, and activity indicators computed automatically.
A tamper-evident audit log
Every change goes into a hash-chained log; editing a row breaks the chain and shows.
Your hosting or ours
A cloud subscription, or a perpetual licence installed on your own servers from a single package.

Fieldwork on a phone

An auditor on site starts a visit and uploads evidence from a phone; anything captured offline is kept on the device and syncs when the connection returns.

Request a demo