In the AI Compliance Assistant you run audits and management reviews in two continuously used tools, reached through the cards Conduct internal audits and Management Review on the AI overview. An audit runs as a session through the steps Planning, Execution and Reporting up to the approved audit report; a management review works through twelve steps with figures and ends in the signed protocol. Both results are stored as records under Documentation → Records, and the actions derived from them live in the tasks area as tasks, CAPA tickets or change workflows.
Open the audit area
Open internal audits
Open the AI Compliance Assistant in the sidebar and click the card Conduct internal audits below the chapter list. The page Internal AI Audit shows a strip of figures at the top with Planned, In execution, Completed and Open findings, followed by the sections Ongoing audits, Planned audits and Completed audits. The default window is ±12 months; All shows every session. The link Define audit scope leads back to the planning pages of the chapter Evaluation & Improvement.
Open or create a session
For a planned audit, click Open in its row under Planned audits; the row carries scope, date and Lead auditor from the audit programme. Start ad-hoc audit immediately creates a session without a scheduled date, for example for a first walkthrough or an event-driven check. Record external audit documents an assessment by an external body; if a system’s conformity assessment runs through a notified body, Cenedril proposes its details from the conformity page. Both buttons open the new session directly.
Plan the audit
Set the frame of the session
The session lists the steps 1. Planning, 2. Execution and 3. Reporting on the left; Back to audit programme returns to the overview. In the Planning step, enter the Start and optionally the End under Audit programme, plus the Location, the Lead auditor and the Audit objective. The Audit methods, the Audit criteria and the line Audit programme owner come from the audit programme, the chosen scope and the AI role register; nothing is captured again here. For an external audit, a separate block with Organization, Framework, Certificate no. and Valid until appears.
Add appointments
Under Audit plan, click into the calendar or on Add appointment. In the editor Edit appointment, set Date, From and To, enter the Room and add the topics of the appointment via Add topic. The Type of a topic is ISO clause, Control or General (such as opening meeting, document review or closing meeting); for controls, choose via Select criteria the checkpoints covered in this appointment. Under Auditees, name the people who will be interviewed. Save places the appointment in the plan, Delete appointment removes it. Below the table, Text summary of the plan renders the plan as text and Plan as CSV exports it as a file.
Save the plan, send invitations, start the audit
Click Save. Then Send invitations emails the auditees of each appointment with time, room and topics; these people need a user account with an email address, otherwise Cenedril reports that no addresses were found. Start audit becomes active once start date, lead auditor and at least one appointment with a valid time are present. The status changes to In execution and the plan is read-only from now on.
Run the audit
Check the follow-up from previous audits
In the Execution step the sidebar shows the sub-entries Follow-up, Overview and one entry per appointment. Open Follow-up first. Under Follow-up from previous audits you find the corrective actions for the same scope in two sections: the open actions with their due-date follow-up, and the recently closed actions awaiting an effectiveness review. Leave a note per item and click Mark as reviewed or Confirm effectiveness. If there are no items, the page reports No outstanding actions from previous audits.
Rate an appointment and record findings
Select an appointment in the sidebar. Each checkpoint shows the requirement with the buttons Conforming and Non-conforming and a field for the Auditor note. Ratings are saved as you go; the figures Answered, Non-conforming, Findings and Evidence at the top count along. Via Add finding you create a finding under a checkpoint or under Other observations for this appointment and classify it: Major nonconformity, Minor nonconformity, Observation, Improvement potential, Positive aspect or Remark. From a finding, Spawn CAPA creates a ticket in the corrective-action workflow directly; the finding description is carried over. Under Evidence for this appointment, use Upload evidence to attach proof; Cenedril computes a checksum on upload and stores it permanently. Once every checkpoint of the appointment is rated, click Close appointment.
Move to reporting
Under Overview you see all appointments one below the other as well as the section Ad-hoc findings (no appointment link) for observations outside the agenda. Click To reporting at the top. The dialog Move to reporting? lists appointments that are not yet closed and reminds you that execution stays editable. With Move to reporting the status changes to In reporting.
Approve the report
Fill in the report
The Reporting step summarises under Ratings summary the number of rated checkpoints as well as Conforming and Non-conforming; Show all ratings opens the table with topic, requirement, rating and note. The Findings section counts the findings per classification. Under Auditor questions, answer Overall conclusion, Recommendations and next steps and Other remarks. For What is the overall audit result? choose Passed, Passed with conditions or Failed; without this the audit cannot be completed. The Report text (optional, free format) adds a free narrative; findings, ratings and evidence are embedded in the record regardless.
Set approval and recipients
Under Audit report approval, choose how the report is approved. Automatic approval approves it immediately on completion. Simple approval (manual) creates it as a pending record that an authorised person later approves under Documentation → Records. With legal signature sends a signature request; for this, choose the Signer and, for people without a user account, enter the Signer email. Under Report recipients you see the owners of the audited areas from the AI role register; individual people can be deselected. People without a user account receive no notification.
Complete the audit
Save draft stores the current state of the report. Click Complete audit & create report and confirm the dialog Complete audit? with Complete. Cenedril creates the report as a frozen record with ratings, findings, linked CAPA tickets and evidence and opens it under Documentation → Records. The audit cannot be changed afterwards.
Result: the audit appears under Completed audits as a tile with the findings per classification, the link View report and the approval state: Automatically approved, Approval pending or Approved, or Awaiting signature or Signed. While a signature is pending, Resend signature request triggers a new signature request.
Start a management review
Open the review area
On the AI overview, click the card Management Review. The page is titled AI Management Review; the link To planning leads to the chapter’s planning page, and the Recommendations below explain flow, steps and data sources. The card Next planned review shows the next date with Start Review once it is startable, otherwise Startable from with the date; after the date, Overdue appears. The button Impromptu Review starts a session immediately, for example after a serious incident or a new high-risk system. Under Last Completed Review you see Date, Type, Action Items, Attendees and the state of the Signatures; View Protocol opens the session. The History lists all previous reviews.
Select attendees
On start, the dialog Select Attendees opens. For a planned session the standing attendees from the planning are preselected; via Search person… you add or remove people from the asset register. For people without a user account, a field for the email address appears, to which the signature request is sent later. Click Start Review; the session opens at the first step.
Run the session
Go through the steps with their figures
The session lists the twelve agenda steps on the left: Previous Actions, Context & Strategic Alignment, Interested Parties & Complaints, AI policy, AI Objectives, Risk Management, Incidents & Observations, Internal Audit, Nonconformities & CAPA, AI Systems & Providers, Competence & Training and SoA & Control Status, followed by Summary & Completion. Each step shows its figures from the assistant and from operations, next to them the Previous value from the last completed review and a jump into the source page. An area without data reports This area has not been set up yet.; the session can still continue. If a step was deferred in the last review, an orange note points this out.
Make a decision and create actions
Under Decision, the round ticks per step Accepted (no actions needed) or a combination of There is room for improvement (continual improvement), Corrective action required (nonconformity identified), AI management system change required (process, scope, or policy), Risk assessment needs to be updated, More resources are needed (personnel, budget, tools) and Training or awareness gap identified; Accepted clears the other boxes. The reasoning goes under Notes on the decisions. Via Add action item, an action arises directly from the step in one of three forms: Simple action creates a task, CAPA ticket opens a ticket in the corrective-action workflow with root cause analysis and effectiveness review, Change (ISO 6.3) starts a change workflow with assessment, approval, implementation and verification. Enter Title, Assigned to, Due date and Priority and confirm with Create, Create CAPA ticket or Create change workflow.
Confirm or defer the step
Click Confirm & Continue to save the decision and open the next step. If a topic cannot be dealt with in this session, choose Defer to next review & Continue; the step counts as handled and is marked orange in the next review. Back returns to the previous step.
Complete the review
The step Summary & Completion counts Steps resolved, With flags and Action items and lists the Decisions per step. Complete Review & Create Protocol becomes active once all steps are confirmed or deferred and the foundations exist; otherwise Not all steps have been resolved yet. or AI management system foundations missing with the affected areas appears next to it. On completion, Cenedril freezes the figures as a snapshot, generates the protocol, creates the record under Documentation → Records and opens it. Every attendee with an email address receives a signature request at the same time. The completed session then shows only the link View evidence record to the record.
Result: the review appears on the AI Management Review page under Last Completed Review and in the History; under Signatures each attendee carries a grey chip that turns green after signing, and with the last signature the record counts as approved. The created actions live in the tasks area and appear in the next review in the step Previous Actions with their state.