Audit Reports

Scope

Audit reporting has to be current, explainable, and aligned with the actual evidence state. This public guide keeps the operator-facing reporting model while excluding private export mechanics.

Overview

Meridian generates two reports:

1. Audit Report — a per-cycle artifact summarizing findings and remediation for a single audit.
2. Compliance Readiness Report — a program-level posture snapshot for leadership.

Both reports return structured data that the frontend renders in a print-friendly layout, but their export paths are different in the shipped product:

• Audit Report — open the structured viewer and use browser print/export.
• Compliance Readiness Report — generated PDFs are available through Report Builder and scheduled-report downloads where documented.

Audit Report

When to use it

• Audit read-outs to leadership or the engagement team.
• Pre-handoff packaging before marking an audit cycle complete.
• Post-audit retrospectives tracking remediation against findings.
• Identifying repeat findings across cycles.

Access

Navigate to an audit cycle detail page and click View Report, or go directly to the relevant workflow.

Requires Meridian.audit permission. Auditors and account admins have access; view-only users and compliance managers (without audit permission) do not.

Sections

Summary metrics — four large-number cards at the top:

• Total findings
• Material weaknesses
• Repeat findings (pulled out because they indicate prior remediations that failed)
• Overdue MAPs

Remediation Status — a one-line status breakdown: open / in progress / implemented / verified / closed / no MAP. The “no MAP” count is the number of findings WITHOUT an attached MAP and should be zero before you mark the audit complete.

Repeat Findings — a separately highlighted section listing every finding with is_repeat = true. Each entry links back to the finding detail page and shows its MAP status. Non-empty repeat sections are a red flag — they mean a prior cycle’s remediation did not stick.

Findings by Classification — four sections (rendered in descending severity order):

• Material Weakness — audit-blocking failures; a single material weakness typically prevents certification
• Significant Deficiency — a deficiency, or combination of deficiencies, that is less severe than a material weakness yet important enough to merit attention by those responsible for oversight
• Deficiency — meaningful gaps that do not rise to significant deficiency level
• Observation — minor issues worth noting for management awareness

Each finding entry includes its ref, classification, materiality, MAP status, linked control, and description. MAPs that are overdue show an overdue badge inline.

Reading the MAP badges

Badge	Meaning
MAP: open	MAP exists, no work started
MAP: in_progress	Work in progress
MAP: implemented	Remediation is done; waiting on auditor verification
MAP: verified	Auditor has verified the fix
MAP: closed	Manager has closed the loop
NO MAP (red)	Finding has no MAP — blocks remediation tracking
overdue (red)	Target date passed while status is still open or in progress

Printing

Use Download PDF only when the server marks the assurance summary ready for external issuance. The viewer shows reviewed scope, evidence freshness/hash coverage, test coverage, blockers, and separate scope/state/report-content hashes. When blocked, Export internal draft requires an explicit confirmation and produces a visibly marked, audited draft that must not be sent as an assurance artifact. Browser Print remains available for local review.

Compliance Readiness Report

When to use it

• Monthly leadership reporting on program posture.
• Pre-audit readiness checks before starting a new cycle.
• Tracking progress over time across frameworks, controls, evidence, risks, policies, training, and MAPs.
• Board-level compliance updates.

Access

Navigate to a program detail page and click View Readiness Report, or go directly to the relevant workflow.

Requires Meridian.view — any authenticated user with access to the program can see it.

Sections

Framework Coverage — per-framework breakdown of covered/partial/gap requirements. A requirement is “covered” only if it has a full mapping to an implemented control in this program. A requirement mapped to a partially_implemented control counts as “partial”, not “covered” — this is intentional to avoid green-washing gaps.

Control Summary — counts of controls by status plus test pass/fail totals.

Evidence Freshness — fresh / expiring_soon / stale breakdown based on evidence valid_until or, when not set, age relative to the 30-day freshness threshold.

Open Risks — count of open risks by level (critical / high / medium / low). Levels use residual_score when set, otherwise inherent_score.

Remediation (MAPs) — the same MAP stats widget shown on the program dashboard: total, by status, and overdue.

Open Findings — count of findings NOT in remediated or closed across all audit cycles in the program, broken down by classification.

Training — count of training requirements and completion rate, computed using the same proxy structure.

Reading the numbers

• Zero requirements_gap across all frameworks is the goal.
• Evidence stale > 0 is a red flag — stale evidence won’t pass an audit.
• Open risks critical > 0 should drive immediate attention.
• Open findings material_weakness > 0 typically blocks certification.
• MAPs overdue > 0 signals slipping remediation.

Printing

The structured viewer still supports browser print, but Meridian also ships generated PDF support for the readiness report through Settings → Reports & Analytics → Report Builder and through scheduled-report downloads after a run succeeds.

Known Limitations

• Proxy rates for policies and training. Without a canonical headcount from Portal, ack rates and completion rates are proxies, not true percentages. They’re still useful for trend-tracking, but don’t present them to an external auditor as “N% of staff are compliant.”
• No historical snapshots. Reports reflect current state. There’s no “report as of 2026-01-01” yet. Historical snapshotting is deferred until there’s demand.
• Audit report export remains browser-based. Use the audit report viewer’s Print action or your browser print/export flow. Generated PDF endpoints exist for supported report-builder and scheduled-report flows, but the audit-detail viewer itself does not expose a primary Download PDF button.