Unit 05 — Audit & Compliance
Meridian covers compliance evidence, programs, SOX, internal audit, vendor risk and auditor work. Its 24 frameworks run from SOC 2 and ISO 27001 to PCI DSS, FedRAMP Moderate, NIS2 and the EU AI Act, with more than 1,700 mappings between them. A rule-based engine scores control fit and finds gaps without calling any external API. AI helps draft text but never decides whether a control passes.
Add a second framework and Meridian shows how much your existing controls already cover. Control Intelligence scores each candidate control on requirement overlap, framework domain, governance peers, evidence overlap and text similarity, and flags gaps and near-duplicates. Frameworks we don't include can be built or imported through OSCAL.
An audit cycle moves through planning, fieldwork, reporting and complete, and saved test executions can't be edited. A cycle can't close while any control test lacks executions in the fieldwork window, unless someone overrides it, which needs a reason and creates an audit record. Evidence packages are reproducible ZIPs with a SHA-256 manifest, and share tokens show their URL once. Internal audit applies the same rules to portfolio planning, engagements, assurance mapping and committee reporting.
SOX programs run COSO controls across financial accounts, linked to PCAOB assertions. In walkthroughs the preparer can't approve their own work, enforced in the backend. §302 sub-certifications go to named respondents, and only they can complete or decline them. Deficiency aggregation, escalations, roll-forward and representation letters take the program to year end.
External auditors join with a one-time code and work in a read-only portal limited to one cycle. Every download is SHA-256 verified and every page view logged. Vendor risk covers the whole lifecycle, including questionnaire campaigns. When a finding is finalized or a control test fails, the remediation bridge opens a Jira ticket, syncs its status and moves the management action plan on when it closes.
Meridian is in early access and works on its own for compliance programs, SOX, internal audit, vendor risk and access reviews.