Security Audits

Schedule, conduct, and track security audits to identify vulnerabilities, assess security threats, and ensure aviation security compliance.

Create security audit plans, assign audit teams, record security findings, manage corrective actions, and close out audits. Monitor security audit progress and generate audit reports.

1 Overview

What this page does

The Security Audits page manages the full lifecycle of security audits within your aviation security programme. From scheduling and planning through to conducting audits, recording security findings, tracking corrective actions, and formally closing out completed audits.

Who uses this page

Security auditors, security managers, aviation security officers, audit coordinators, and team members with security auditor or reviewer roles.

What you see here

Page Regions
  • Search and filters: Find audits by code, name, team member, or date
  • View toggles: Switch between Active and Cancelled audits
  • Audits table: View and manage all security audits
  • Expandable rows: Review findings and corrective actions for each audit
Key Concepts
  • Security Audit: Systematic evaluation of security measures and compliance with aviation security regulations
  • Threat Assessment: Evaluation of security vulnerabilities and potential threats
  • Finding: A security observation or non-conformance requiring corrective action
  • Close-out: The formal completion process after security gaps are addressed

2 Audit Process Overview

The following diagram illustrates the typical security audit lifecycle from creation through to completion:

1
Schedule Audit
Create new audit and assign team
2
Conduct Audit
Go through checklist, add findings & observations with initial risk assessments
3
Finalise Audit Optional
Sign-off that auditing process is complete (with review/endorsement if reviewers assigned)
4
Address Findings
Corrective actions approved with residual risk assessments
5
Link to Risk Register
Findings linked to Risk & Hazard Register if applicable
6
Close Audit Required
Final step when all findings closed (with review/endorsement if reviewers assigned)

3 Primary Workflows

3.1 Create a new security audit

When to use

Create a new security audit when scheduling a security audit according to your security audit plan or when conducting an ad-hoc security audit in response to a security event, threat intelligence, or regulatory requirement.

Steps

  1. Click Add new audit in the top-right corner
  2. Complete the security audit details in the window that opens:
    • Audit name: Short descriptive name (e.g., "Q2 Access Control Security Audit")
    • Audit type: Select from configured security audit types (e.g., Access Control, Cargo Security, Cybersecurity)
    • Area: The security domain being audited (e.g., Perimeter Security, Passenger Screening)
    • Entity conducting audit: Organisation or department conducting the security audit (optional)
    • Entity being audited: Organisation or department being audited (optional)
    • Template: Select a pre-configured security audit checklist template (optional)
    • Start and end dates: Security audit period
    • Bases: Select relevant operational bases or security zones
    • Aircraft: Select relevant aircraft if scope includes aircraft security (optional)
    • Team members: Assign security auditors and reviewers with appropriate access levels and security clearance
  3. Click Save to create the security audit

Result

The security audit appears in the Active audits table with status "Pending Start". An audit code is automatically generated. Team members receive notification of their assignment.

3.2 Conduct a security audit (record findings)

When to use

Use this workflow to perform the security audit, work through checklist items, and record security findings as you identify vulnerabilities, non-conformances, or observations related to security management.

Steps

  1. Locate the security audit in the Active audits table
  2. Click the Audit items button (envelope icon) in the "Audit items" column
  3. The audit detail page opens with:
    • Groups: Audit checklist organised into logical security domains
    • Checklist items: Individual security items to review
    • Finding entry: Record security findings for each item
  4. For each checklist item:
    • Review the item description and security requirements
    • Mark as Compliant, Non-Compliant, Not Applicable, or Observation
    • If non-compliant or an observation, click Add Finding
  5. When recording a security finding:
    • Enter finding description (focus on security implications and threat exposure)
    • Select compliance type
    • Assess threat and risk:
      • Identify the threat category
      • Assess pre-mitigation risk (likelihood × consequence)
      • Document existing security controls
      • Assess post-mitigation risk
    • Assign responsible person for corrective action
    • Set due date for corrective action response
    • Save as Draft or Submit the finding
  6. Continue through all checklist groups until the security audit is complete

Result

Security findings are created, assigned to responsible persons who receive notifications, and appear in the expandable row beneath the audit in the main table.

3.3 Working with audit checklists

When you click Audit items for an audit, you navigate to the audit checklist interface where you conduct the actual audit work.

Checklist structure

Audit checklists are organized hierarchically:

  • Groups: Major sections of the audit (e.g., "Flight Operations", "Ground Handling", "Documentation")
  • Items: Specific audit points within each group
  • Findings: Non-conformances or observations identified for specific items

Navigating the checklist

The checklist interface displays:

  • Expandable groups: Click a group header to expand and view its items
  • Progress indicators: Visual indicators show which items have been completed
  • Item cards: Each item displays its description, reference number, and current outcome
  • Action buttons: Edit item outcome, add findings, attach documents

Auditing an item

To audit a checklist item:

  1. Click the Edit button (pencil icon) on the item card
  2. The audit item window opens showing:
    • Item description: What is being audited
    • Reference number: Regulatory or procedural reference
    • Custom fields: Section-specific data fields (if configured)
    • Outcome selection: Choose Compliant, Findings, or Not Applicable
    • Comments: Add auditor observations
    • Attached documents: Upload evidence or supporting documentation
  3. Select the appropriate outcome:
    • Compliant: Item meets all requirements with no issues
    • Findings: Non-conformances or observations identified (requires adding findings)
    • Not Applicable: Item does not apply to this audit context
  4. If you select Findings, the window expands to show finding entry sections
  5. Click Save to record the outcome

Adding findings to an item

When you select Findings as the outcome, additional sections appear:

  1. Click Add Finding to create a new finding for this item
  2. A finding card appears with the following fields:
    • Finding description: Detailed description of the non-conformance or observation
    • Compliance type: Select from configured types (e.g., Non-Compliance, Observation, Positive Finding, Opportunity for Improvement)
    • Hazard/Risk assessment: Assess security threat level and potential impact if applicable to the finding
    • Root cause analysis: Optional analysis of underlying causes
    • Corrective action: Immediate actions taken during audit
    • Recommended action: Suggested longer-term corrective actions
    • Attached documents: Evidence, photos, or supporting documentation
  3. Complete the required fields (marked with asterisks)
  4. Save the finding as Draft (returns to list for later completion) or Submit (creates corrective action request)

Creating corrective action requests from findings

When you submit a finding (not save as draft), the system:

  • Automatically creates a Corrective Action Request (CAR) linked to the finding
  • Assigns the CAR to responsible person(s) you specified
  • Sends email notifications to assigned respondents
  • Displays the CAR code in the audit findings table
  • Tracks the CAR through its lifecycle (draft, pending review, approved, implemented)

Multiple findings for the same item are numbered (e.g., "First finding", "Second finding") and each generates its own CAR.

3.4 Managing findings and corrective actions

After creating findings during an audit, you can manage them through the expandable rows in the main audits table.

Viewing findings

  1. Click the expand button (arrow icon) next to an audit in the audits table
  2. The findings sub-table appears showing all findings for that audit
  3. Each row displays:
    • Status badges: Current corrective action status (Draft, Pending Review, Approved, Overdue, etc.)
    • Review buttons: If you're a reviewer, buttons to review pending corrective action plans
    • Edit button: Modify the finding (auditors only, not available if audit is closed)
    • CAR Code: Corrective Action Request code (click to view full details)
    • Finding code & description: Click to view complete finding details
    • Requestor: Who created the finding
    • Respondents: Who is responsible for corrective actions
    • Messages: Communication thread with unread message count
    • Hazard/Risk: Risk assessment status and details
    • Cancel/Restore: Deactivate or reactivate the finding

Editing findings

To edit a finding after creation:

  1. Expand the audit row to show findings
  2. Click the Edit button (pencil icon) for the finding
  3. The finding window opens with all previously entered information
  4. Make your changes
  5. Save as Draft or Submit (updates the corrective action request)

Reviewing corrective action plans

When respondents submit corrective action plans, reviewers see Review buttons in the findings table:

  1. Click the Review button for a pending corrective action
  2. The review window opens showing:
    • Original finding details
    • Proposed corrective action plan
    • Proposed implementation timeline
    • Supporting documentation
  3. Choose to:
    • Approve: Accept the proposed plan
    • Reject: Return for revision with comments
  4. Add review comments explaining your decision
  5. Submit your review

The corrective action workflow progresses through multiple stages:

  • Corrective Action Plan (CAP): Initial plan review
  • Short-term Corrective Action Implementation (SCAI): Review of immediate actions
  • Long-term Corrective Action Implementation (LCAI): Review of sustained corrective measures

Communicating about corrective actions

Use the Messages button to communicate with corrective action respondents:

  1. Click the Messages button (message icon) for a finding
  2. The message thread window opens
  3. View previous messages in the thread
  4. Type your message in the text box
  5. Optionally attach documents
  6. Click Send

All participants (requestors, respondents, and audit team) can see and contribute to the message thread. Unread messages are indicated by a badge count on the messages button.

Cancelling findings

To cancel a finding that was created in error:

  1. Expand the audit row to show findings
  2. Click the Cancel button (ban icon) for the finding
  3. Enter a reason for cancellation in the confirmation window
  4. Click Confirm

Cancelled findings remain visible but are marked as cancelled. The associated corrective action request is also cancelled. You can restore a cancelled finding by clicking the Restore button.

3.5 Edit a security audit

When to use

Edit security audit details when you need to change the scope, dates, team members, or other audit metadata. You cannot edit an audit that is closed or has a close-out request in review.

Steps

  1. Locate the security audit in the Active audits table
  2. Click the Edit audit button (pencil icon) in the "Edit audit" column
  3. Update the security audit details in the window that opens
  4. Click Save to apply changes

Result

The security audit is updated with the new details. Team members receive notifications if their assignments changed.

3.6 Finalise a security audit

When to use

Finalise a security audit when all audit checklist items have been completed, but some findings still have pending corrective actions. Finalisation is an optional step that allows you to formally sign-off that the auditing process itself is complete and corrective action requests have been issued, even though the corrective actions are not yet fully implemented and closed.

Steps

  1. Ensure all security audit checklist items have been audited
  2. Ensure all findings have been recorded and corrective action requests have been created
  3. Locate the security audit in the Active audits table
  4. In the "Finalize / Close" column, click the Finalise Audit button
  5. In the finalisation request window:
    • Enter executive summary of the audit process and findings identified
    • Provide findings summary describing the corrective actions requested
    • Note any audit conclusions or observations
    • Optionally use Musket Autopilot (AI assistant) to generate summaries based on audit data
    • Attach supporting documents (optional)
    • Select reviewers from team members with review access
    • Add any additional comments for reviewers (optional)
  6. Save as Draft or Submit for review

Result

The finalisation request is submitted to the selected reviewers. The audit status shows "Pending finalisation review". Once all reviewers approve, a table with signatures and stamps of the auditors, reviewers, and endorser is included in the exportable PDF audit report. The audit status shows "Finalised" and the audit record becomes read-only, though corrective actions can continue to be worked on until they are all closed.

Review process

Reviewers receive a notification and see a Review button in the "Finalize / Close" column. Reviewers can:

  • Approve: Finalisation is accepted; formal sign-off is recorded in the audit record and PDF report
  • Reject: Finalisation is returned to requestor with comments for revision

3.7 Close out a security audit

When to use

Close out a security audit when all audit checklist items have been completed AND all findings have been fully addressed (all corrective actions have been approved or findings have been cancelled/marked as no action needed). Close-out is the required final step to formally close and archive the audit record.

Steps

  1. Ensure all security audit checklist items have been audited
  2. Ensure all findings have been fully addressed: all corrective action plans and implementations have been approved, or findings have been cancelled/marked as no action needed
  3. Verify all threat and risk assessments are complete
  4. Locate the security audit in the Active audits table
  5. In the "Finalize / Close" column, click the Close out button (appears when all findings are closed)
  6. In the close-out request window:
    • Enter executive summary (include security compliance status and threat assessment)
    • Provide audit conclusions (highlight security findings and vulnerability trends)
    • Provide findings summary describing how all findings were addressed
    • Note any limitations or scope exclusions
    • Optionally use Musket Autopilot (AI assistant) to generate summaries based on audit data
    • Attach supporting documents (optional)
    • Select reviewers from team members with review access
    • Add any additional comments for reviewers (optional)
  7. Save as Draft or Submit for review

Result

The close-out request is submitted to the selected reviewers. The audit status shows "Pending close out review". The security audit is locked from further editing until the close-out is approved. Once all reviewers approve, a table with signatures and stamps of the auditors, reviewers, and endorser is included in the exportable PDF audit report. The audit status shows "Closed" and the audit record becomes read-only and archived.

Review process

Reviewers receive a notification and see a Review button in the "Finalize / Close" column. Reviewers can:

  • Approve: Close-out is accepted; security audit is formally closed and archived
  • Reject: Close-out is returned to requestor with comments for revision

3.8 Export security audit report

When to use

Export a security audit report to generate a PDF document containing the audit details, checklist items, security findings, threat assessments, and corrective actions. Use this for formal audit reports, management security reviews, regulatory compliance documentation, or authority submissions.

Steps

  1. Locate the security audit in the Active audits table
  2. Click the Export audit button (PDF icon) in the "Export audit" column
  3. Select the audit report configuration from the dropdown (if multiple configurations exist)
  4. The PDF report is generated and opens in a new window or downloads to your device

Result

A formatted PDF security audit report is generated containing all audit information including threat assessments according to the selected report configuration.

3.9 Cancel a security audit

When to use

Cancel a security audit when it is no longer required or cannot be completed. Cancelled audits are moved to the "Cancelled" view.

Steps

  1. Locate the security audit in the Active audits table
  2. Click the Cancel button (ban icon) in the "Cancel" column
  3. Enter a reason for cancellation in the confirmation window
  4. Click Confirm

Result

The security audit is cancelled and moved to the Cancelled view. Team members receive notifications. The audit can be restored later if needed.

4 Windows and Forms

The Security audits page uses several windows and forms to capture and display information. This section describes each window and its purpose.

4.1 Create/Edit Audit window

Opens when you click Add new audit or click the Edit audit button for an existing audit.

Window sections

Section Fields Description
Basic Information • Audit name
• Audit type
• Area
• Start date
• End date 		Core audit identification and scheduling information
Audit Entities • Entity conducting audit
• Entity being audited 		Optional organizational context for multi-entity operations
Scope • Bases
• Aircraft (if applicable)
• Aircraft types (if applicable) 		Physical and operational scope of the audit
Template • Audit template selection Optional pre-configured checklist. If selected, audit items are auto-populated
Audit Team • Team members list
• Access level (Auditor / Reviewer)
• Reviewer capabilities 		Assign team members with specific roles:
• Auditor: Can conduct audit, edit items, create findings, submit close-out
• Reviewer: Can review and approve/reject close-out and finalisation requests

Validation rules

  • Audit name is required
  • Audit type is required
  • At least one team member with Auditor access is required
  • Start date cannot be after end date
  • At least one base must be selected

4.2 Audit Item window

Opens when you click Edit on a checklist item during audit conduct (from the AuditGroups page).

Window sections

Section Content When Visible
Item Details • Description (read-only)
• Reference number (read-only)
• Custom fields (if configured) 		Always
Outcome • Compliant radio button
• Findings radio button
• Not Applicable radio button
• Comments text area
• Attached documents 		Always
Findings Entry Multiple finding cards with:
• Finding description
• Compliance type
• Hazard/Risk assessment
• Root cause
• Corrective action taken
• Recommended action
• Requestor
• Respondents
• Due dates
• Documents 		Only when "Findings" outcome is selected

Working with findings in the window

  • Click Add Finding to create additional findings for the same item
  • Each finding is numbered (First finding, Second finding, etc.)
  • Click Remove on a finding card to delete it before submission
  • Save individual findings as Draft or Submit
  • Submitted findings automatically create corrective action requests

4.3 Finding Modal window

Opens when you click Edit on a finding from the findings sub-table (expandable rows in main audits table).

Purpose

Allows auditors to modify findings after they have been submitted. Changes update the associated corrective action request and notify respondents if significant changes are made.

Key fields

  • Finding description: Detailed non-conformance or observation description
  • Compliance type: Classification of the finding
  • Hazard/Risk section: Assess security threat level and potential impact if applicable to the finding
  • Root cause analysis: Analysis of underlying factors
  • Immediate corrective action: Actions taken during audit
  • Recommended corrective action: Suggested long-term actions
  • Respondents: Who is responsible for addressing the finding
  • Due date: Deadline for corrective action response

4.4 Close-out Request window

Opens when you click Close out or Finalise Audit in the "Finalize / Close" column. The same modal window is used for both operations with the same fields.

Close-out vs Finalisation

The same window is used for both close-out and finalisation requests, but they serve different purposes:

  • Finalisation request (OPTIONAL): Used when all audit checklist items are complete, but findings still have pending corrective actions. Provides formal sign-off that the auditing process is complete and corrective action requests have been issued. Findings can continue to be worked on after finalisation.
  • Close-out request (REQUIRED): Used when all audit checklist items are complete AND all findings are fully closed (corrective actions approved/cancelled/no action needed). This is the final step to formally close and archive the audit record.

Window fields

Field Required Description
Executive Summary Yes High-level summary of audit outcomes, key findings, and overall conclusions. Can be generated with Musket Autopilot.
Findings Summary Yes Summary of findings identified and corrective actions requested (for finalisation) or how findings were addressed (for close-out). Can be generated with Musket Autopilot.
Audit Conclusions Yes Detailed conclusions about compliance status, effectiveness of controls, and audit results
Limitations No Any scope limitations, exclusions, or constraints that affected the audit
Supporting Documents No Attach audit reports, evidence summary, or other supporting materials
Reviewers Yes Select one or more team members with Reviewer access to review the request
Comments No Additional notes or context for reviewers

Review workflow

Selected reviewers review requests sequentially:

  1. First reviewer receives notification and sees Review button
  2. Reviewer can Approve (passes to next reviewer) or Reject (returns to requestor)
  3. If rejected, requestor revises and resubmits
  4. After all reviewers approve, the close-out/finalisation is complete

Signatures and PDF export

Once a close-out or finalisation request is fully approved by all reviewers, a signature table is automatically included in the exportable PDF audit report. This table contains:

  • Auditor signatures: Names and digital stamps of audit team members who conducted the audit
  • Reviewer signatures: Names and digital stamps of reviewers who approved the close-out/finalisation
  • Endorser signature: Name and digital stamp of the final endorser/approver
  • Timestamps: Date and time of each signature

This provides formal proof that the audit has been properly conducted, reviewed, and signed-off by authorized personnel.

4.5 Close-out Review window

Opens when a reviewer clicks Review for a pending close-out or finalisation request.

Window sections

  • Request details: Shows all information submitted by requestor (summary, conclusions, documents)
  • Review decision: Radio buttons for Approve or Reject
  • Review comments: Required field to explain approval or rejection decision
  • Audit status summary: Read-only display of audit metrics (items audited, findings, CARs)

Review considerations

When reviewing a close-out or finalisation request, consider:

  • Are all audit items completed?
  • Are all findings properly documented with corrective action requests?
  • For close-out: Are all findings fully closed (all corrective actions approved/cancelled/no action needed)?
  • For finalisation: Is the audit checklist complete and are corrective actions properly requested (even if still pending)?
  • Is the executive summary accurate and complete?
  • Do the conclusions align with the audit evidence?
  • Are any limitations or scope exclusions properly documented?

Impact of approval

When all reviewers approve a close-out or finalisation request:

  • Your signature and digital stamp are recorded in the audit record
  • A signature table is generated in the exportable PDF report showing all auditors, reviewers, and endorsers with timestamps
  • The audit record becomes read-only (for close-out) or the auditing process is formally signed-off (for finalisation)
  • This provides formal proof of proper audit conduct, review, and authorization

4.6 Corrective Action Review window

Opens when you click a Review button for a pending corrective action plan in the findings sub-table.

Purpose

Allows authorized reviewers to evaluate and approve/reject corrective action plans and implementations submitted by respondents.

Review stages

Corrective actions progress through multiple review stages:

  1. CAP Review: Review of the proposed Corrective Action Plan
    • Evaluate: Is the planned action adequate to address the finding?
    • Review: Timeline, resources, responsibilities
  2. SCAI Review: Review of Short-term Corrective Action Implementation
    • Evaluate: Were immediate actions completed as planned?
    • Review: Evidence of implementation, effectiveness
  3. LCAI Review: Review of Long-term Corrective Action Implementation
    • Evaluate: Are sustained corrective measures in place?
    • Review: Long-term effectiveness, process improvements

Window contents

  • Finding details: Read-only display of original finding
  • Proposed action: Respondent's submitted corrective action plan or implementation evidence
  • Risk assessment: Assess security threat level and potential impact if applicable to the finding
  • Supporting documents: Evidence uploaded by respondent
  • Review decision: Approve or Reject
  • Review comments: Required feedback for respondent

4.7 Corrective Action Message window

Opens when you click the Messages button for a finding in the findings sub-table.

Purpose

Provides a threaded communication channel between audit team members and corrective action respondents.

Features

  • Message history: Chronological display of all messages in the thread
  • Sender identification: Each message shows who sent it and when
  • Document attachments: Attach files to messages for evidence sharing
  • Unread indicators: New messages are highlighted until you read them
  • Participant visibility: All team members and respondents can see all messages

Common uses

  • Request clarification on corrective action plans
  • Provide additional context or guidance
  • Share evidence or documentation
  • Discuss implementation challenges
  • Confirm completion of corrective actions

4.8 Audit Read-Only window

Opens when you click an audit code in the audits table.

Purpose

Provides a comprehensive read-only view of audit details without the ability to make changes. Useful for reviewing audit information, sharing with stakeholders, or viewing audits you're not assigned to (if you have appropriate permissions).

Displayed information

  • All audit metadata (name, type, dates, scope)
  • Audit team members and their roles
  • Audit status and progress
  • Associated findings summary
  • Audit logs (who created, modified, closed, finalised)

5 Feature Reference

This section provides detailed reference information for all features and interface elements on the Security audits page.

5.1 Page actions and controls

Top toolbar actions

Action Location Description Access Required
Add new audit Top-right corner Opens window to create a new security audit Security Auditor or Security Investigator role
Active / Cancelled toggle Center of toolbar Switches view between active audits and cancelled audits All users with access to page
Audit Status Report Top-right of table Generates comprehensive status report showing all audits and their progress Users who can see all audits (managers, administrators)

View toggles

The page has two main views accessed via radio buttons in the toolbar:

  • Active: Shows all audits that are scheduled, in progress, or completed but not cancelled
  • Cancelled: Shows all audits that have been cancelled and removed from active work

5.2 Search and filters

The search bar at the top-left allows you to quickly find security audits. Searchable fields include:

  • Audit code
  • Audit name
  • Security audit type
  • Team member names
  • Entity names

Additional filters available via the FilterInput component:

  • Date range: Filter by security audit start date period
  • Items assigned to me: Show only audits where you have review actions pending
Pagination controls

When the audits table contains more than 15 items (or your configured page size), pagination controls appear below the table:

  • Items per page: Change how many audits display per page (15, 30, or 45)
  • Page numbers: Click page numbers to navigate through results
  • Previous/Next: Navigate to the previous or next page
  • First/Last: Jump to the first or last page of results
  • Page indicator: Shows current page and total pages (e.g., "Page 2 of 8")

5.3 Security audits table

The main audits table displays all active or cancelled security audits based on the selected view toggle. The table includes:

Column Description Notes
Expand/Collapse Toggle to show/hide security findings Shows count of findings and pending review items
Code Auto-generated unique security audit identifier Click to view audit details in read-only mode
Audit items Button to open audit checklist and conduct security audit Only available to team members with auditor access
Edit audit Button to edit security audit metadata Disabled if audit is closed or in close-out review
Finalize / Close Status and actions for close-out and finalisation Shows status badges or action buttons based on audit state
Audit name Descriptive name of the security audit
Audit type Category of security audit (e.g., Access Control, Cargo Security) Configured in Security Settings
Entity conducting audit Organisation/department conducting the security audit Optional; only shown if any audit has this set
Entity being audited Organisation/department being audited Optional
Template Security audit checklist template used Optional; only shown if any audit uses a template
Area Operational area being audited
Team Security audit team members Hover over icon to see full list of team members
Bases Operational bases in scope Multiple bases shown as comma-separated list
Aircraft Aircraft in scope Optional; shown as badges if configured
Resources Security audit resource tracking (e.g., costs, hours) Only shown if enabled in audit settings
Items audited Count of checklist items completed/total Shows progress through security audit checklist
Start Date Security audit start date
End Date Security audit end date
Audit status Current workflow status See status glossary below
Export audit Generate PDF security audit report Uses configured audit report configuration
Cancel / Restore Cancel active audit or restore cancelled audit Requires reason for cancellation

5.4 Expandable findings rows

Click the expand/collapse button on an audit row to reveal all security findings associated with that audit. The findings sub-table includes:

Column Description
Status Corrective action request status badges
Review Buttons to review pending corrective action plans or extension requests
Edit Edit the security finding details (available to auditors only)
CAR Code Corrective Action Request code (click to view details)
Finding Finding code and description (click to view full finding details)
Requestor User who created the corrective action request
Respondents Users responsible for addressing the corrective action
Messages Communication thread for the corrective action (shows unread count)
Hazard/Risk Risk assessment status and controls@GetHazardRiskNote()
Cancel/Restore Cancel or restore the security finding

6 Status Glossary

Security audit statuses indicate the current stage of the audit workflow:

Status Meaning Next Action
Pending Start Security audit scheduled but not yet started Begin conducting audit via "Audit items" button
In Progress Security audit is being conducted; checklist items being completed Continue audit activities and record security findings
Pending close out All audit items complete AND all findings closed; waiting for close-out request submission Assigned auditor should submit close-out request to formally close audit
Pending close out review Close-out request submitted and awaiting review Reviewer should approve or reject close-out request
Close out rejected Close-out request rejected by reviewer Requestor should revise and resubmit close-out request
Closed Security audit formally closed and archived (all items audited and all findings resolved) No further action; audit is complete and read-only
Pending finalisation All audit items complete BUT findings still pending corrective actions; waiting for optional finalisation request Assigned auditor may submit finalisation request to sign-off auditing process while CARs continue
Pending finalisation review Finalisation request submitted and awaiting review Reviewer should approve or reject finalisation
Finalisation rejected Finalisation request rejected by reviewer Requestor should revise and resubmit finalisation request
Finalised Security audit process formally signed-off; corrective actions may still be in progress Continue working corrective actions until all closed, then proceed to close-out

7 Rules & Permissions

Access rules

  • Only users with the Security Auditor or Security Investigator role can access this page
  • Team members can only see audits where they are assigned as a team member
  • Users with administrator or security manager roles can see all security audits
  • Only team members with "auditor" access can conduct audits, edit audits, create findings, and submit close-out/finalisation requests
  • Only team members with "reviewer" access can review and approve/reject close-out and finalisation requests
  • Additional security clearance requirements may apply based on your organisation's security policies

Workflow rules

  • Security audits must have at least one team member with auditor access@GetTeamRequirementAddition()
  • Finalisation (OPTIONAL): Can be done when all checklist items are audited, but findings still have pending corrective actions. Signs-off the auditing process while work continues on CARs.
  • Close-out (REQUIRED): Can only be done when all checklist items are audited AND all findings are fully closed (corrective actions approved/cancelled/no action needed). This is the final step to archive the audit.
  • Once a security audit is finalised, the audit record becomes read-only but corrective actions can continue until all are closed
  • Once a security audit is closed out, the entire audit record becomes read-only and archived
  • Close-out and finalisation requests require at least one reviewer from the audit team
  • Cancelled audits can be restored by team members with auditor access

8 Understanding Audit Workflow States

Security audits progress through various workflow states during their lifecycle. Understanding these states helps you know what actions are available and what happens next.

Workflow State Badges

You'll see various badges in the audit table showing the current workflow state. These badges reflect the audit's position in the close-out and finalisation workflows:

State Badge What It Means Available Actions
Active Auditing States
(No badge) Audit is active and available for conducting; checklist items can be audited Conduct audit, Edit audit details, Create findings
Finalisation Path (OPTIONAL - when findings still pending)
Pending finalisation All checklist items complete, findings still have pending corrective actions; finalisation request can be created Create/edit finalisation request, Submit for review, Continue working on corrective actions
Finalisation rejected Finalisation request was rejected by a reviewer Edit and resubmit finalisation request
Pending finalisation review Finalisation request has been submitted and is awaiting reviewer approval Review finalisation (reviewers only), View audit (others), Continue working on corrective actions
Finalised Auditing process formally signed-off; audit record read-only but corrective actions continue View audit (read-only), Work on corrective actions until all closed, then proceed to close-out
Close-out Path (REQUIRED - final step when all findings closed)
Pending close out All checklist items complete AND all findings closed; close-out request can be created Create/edit close-out request, Submit for review
Close out rejected Close-out request was rejected by a reviewer Edit and resubmit close-out request
Pending close out review Close-out request has been submitted and is awaiting reviewer approval Review close-out (reviewers only), View audit (others)
Closed Audit formally closed and archived; all checklist items audited and all findings resolved View audit (read-only), Export report

Typical Audit Workflow

Most audits follow one of these progressions depending on whether findings require ongoing corrective actions:

Option 1: Direct Close-out (when all findings are quickly resolved)
  1. Create audit: Set up audit details, team, and checklist
  2. Conduct audit: Audit checklist items, record outcomes, create findings
  3. Resolve findings: All corrective actions are completed and approved
  4. Request close-out: Submit close-out request when all items audited AND all findings closed
  5. Review close-out: Reviewer approves or rejects the close-out
  6. Complete: Audit is closed and becomes read-only
Option 2: Finalisation then Close-out (when corrective actions take time)
  1. Create audit: Set up audit details, team, and checklist
  2. Conduct audit: Audit checklist items, record outcomes, create findings
  3. Request finalisation (OPTIONAL): Submit finalisation request to sign-off auditing process while findings still have pending corrective actions
  4. Review finalisation: Reviewer approves or rejects finalisation
  5. Continue corrective actions: Work continues on corrective action plans and implementations
  6. Request close-out: Once all findings are closed, submit close-out request
  7. Review close-out: Reviewer approves or rejects the close-out
  8. Complete: Audit is closed and becomes read-only

9 Complete Corrective Action Lifecycle

When a finding identifies a security issue, a corrective action request (CAR) is created to address it. Corrective actions progress through three distinct implementation stages, each requiring review and approval.

CAR Creation

When you create a finding during an audit, a corrective action request is automatically generated. The finding describes what went wrong, while the CAR focuses on how to fix it.

The Three Implementation Stages

Stage 1: CAP

Corrective Action Plan

The respondent develops and submits a plan describing:

  • Root cause analysis
  • Proposed corrective actions
  • Immediate actions (if any)
  • Long-term preventive measures
  • Timeline for implementation
  • Resources required
Stage 2: SCAI

Short-term Corrective Action Implementation

The respondent implements and submits evidence of:

  • Immediate corrective actions taken
  • Evidence of implementation (photos, documents, records)
  • Verification that the issue is addressed
  • Any interim measures in place
Stage 3: LCAI

Long-term Corrective Action Implementation

The respondent implements and submits evidence of:

  • Systemic changes to prevent recurrence
  • Updated procedures or training
  • Effectiveness verification over time
  • Final closure documentation

Review and Approval Workflow

Each stage follows the same review workflow:

  1. Submission: Respondent completes the required information and submits for review
  2. Review Assignment: The security auditor or investigator is notified of the pending review
  3. Review Decision: Reviewer examines the submission and either:
    • Approves: Accepts the submission and moves to the next stage
    • Rejects: Requests revisions and returns to respondent with comments
  4. Revision (if rejected): Respondent addresses feedback and resubmits
  5. Re-review: Process repeats until approved

Extension Requests

If the respondent cannot complete a stage by the due date, they can request an extension:

  1. Respondent clicks Request Extension button
  2. Provides justification and proposes new due date
  3. Reviewer receives notification and reviews request
  4. Reviewer approves (granting new due date) or rejects (keeping original date)

Message Threads

Throughout the corrective action lifecycle, all parties can communicate via message threads. Use messages to:

  • Ask clarifying questions about the finding or required actions
  • Provide additional context or guidance
  • Explain rejection reasons in detail
  • Share supporting documents or evidence
  • Coordinate implementation activities

Viewing Corrective Action Status

You can view corrective action progress in multiple locations:

  • Expandable rows in Audits table: Shows current status and pending reviews
  • Your Security Findings & Requests page: Lists CARs assigned to you as respondent
  • Review Security Corrective Actions page: Shows CARs awaiting your review as auditor/investigator
  • Finding detail view: Complete corrective action history and timeline

Corrective Action Status Values

Status Stage Description Who Can Act
Not Started CAP CAR has been created but respondent hasn't started work Respondent
In Progress Any Respondent is working on the submission (draft state) Respondent
Pending Review Any Submission has been made and awaits reviewer decision Reviewer
Rejected Any Reviewer rejected the submission; respondent must revise Respondent
CAP Approved CAP Plan approved; respondent can begin SCAI Respondent
SCAI Approved SCAI Short-term actions approved; respondent can begin LCAI Respondent
Fully Approved LCAI All stages approved; corrective action is complete None (complete)
Cancelled Any Finding or corrective action has been cancelled None

10 Hazard & Risk Assessment Details

Risk assessment helps evaluate security threats and vulnerabilities identified during security audits. While not strictly mandatory, performing risk assessments allows you to prioritize corrective actions based on the level of threat to aviation security.

When Risk Assessment is Required

Security audits: Risk assessment is highly recommended for all security findings to evaluate threat levels and vulnerabilities. While not strictly mandatory, it should be performed for any finding that could impact aviation security.

The Risk Assessment Process

Risk assessment involves evaluating both the likelihood (how often it might occur) and severity (how bad the consequences would be) of a hazard.

Step 1: Identify the Hazard

Select or create a hazard that describes the unsafe condition or deficiency:

  • Search existing hazards: Use the hazard library to find previously identified similar hazards
  • Create new hazard: If no match exists, create a new hazard with a clear description
  • Hazard categories: Assign appropriate category (e.g., Access Control, Screening, Cargo Security, Insider Threat)
Step 2: Initial Risk Assessment

Assess the risk before any corrective actions:

  • Likelihood: How likely is this hazard to result in an incident? (Frequent, Occasional, Remote, Improbable)
  • Severity: What are the potential consequences? (Catastrophic, Hazardous, Major, Minor, Negligible)
  • Risk Index: System calculates risk level from matrix (e.g., 3A, 4C)
  • Risk Level: Displayed as Intolerable, Tolerable, or Acceptable

Risk Matrix

Your organization's risk matrix defines how likelihood and severity combine to produce a risk index. A typical 5x5 matrix might look like:

Severity →
Likelihood ↓		 Catastrophic Hazardous Major Minor Negligible
Frequent 5A 5B 5C 5D 5E
Occasional 4A 4B 4C 4D 4E
Remote 3A 3B 3C 3D 3E
Improbable 2A 2B 2C 2D 2E
Extremely Improbable 1A 1B 1C 1D 1E

Red (Intolerable) - Immediate action required Yellow (Tolerable) - Action required with timeline Green (Acceptable) - Monitor and review

Residual Risk Assessment

After corrective actions are implemented, assess the risk after controls are in place:

  1. CAP Review: During CAP review, consider whether the proposed actions will adequately reduce risk
  2. SCAI/LCAI Implementation: Respondent implements corrective actions
  3. LCAI Review: The reviewer should assess whether the corrective actions have adequately reduced the security threat
  4. Risk Comparison: Compare initial vs residual risk to verify effectiveness
  5. Tolerability Check: Confirm residual risk is within acceptable limits

Marking Hazard & Risk as Not Applicable

In some cases, a finding may not involve a hazard or risk assessment (for non-security administrative findings). When creating or editing a finding, you can check "Hazard & Risk not applicable" if:

  • The finding is purely administrative or documentary
  • There is no safety impact or consequence
  • The issue is a technical non-compliance without safety significance

11 Audit Resources & Cost Tracking

Track the resources, costs, and time invested in conducting security audits. This helps with budgeting, resource allocation, and demonstrating the value of your audit program.

What Are Audit Resources?

Audit resources track both direct costs and time spent on audit activities:

  • Personnel time: Hours spent by auditors, team members, and auditees
  • Travel costs: Airfare, accommodation, ground transportation
  • Materials: Audit supplies, printing, equipment
  • External costs: Third-party auditor fees, consultant charges
  • Overhead: Indirect costs allocated to the audit

How to Track Resources

From the Audits table:

  1. Click the Resources button in the audit row (button icon with calculator/money symbol)
  2. The Audit Resources window opens
  3. Click Add Resource to create a new resource entry
  4. Complete the resource details:
    • Resource type: Personnel, Travel, Materials, External, Overhead
    • Description: What the resource is for
    • Quantity: Number of units (e.g., hours, items)
    • Unit cost: Cost per unit
    • Currency: Select currency if multi-currency enabled
    • Date: When the cost was incurred
  5. Click Save to add the resource
  6. Repeat for all resources used in the audit

Currency Handling

If your organization operates in multiple currencies:

  • Enter costs in original currency: Record each cost in the currency it was paid
  • Exchange rates: System uses configured exchange rates for conversion
  • Base currency reporting: All costs are converted to your organization's base currency for totaling
  • Exchange rate date: System uses the exchange rate effective on the date the cost was incurred

Viewing Resource Summary

The audit resources window shows:

  • Individual resources: Each resource entry with details
  • Total by type: Subtotals for Personnel, Travel, Materials, etc.
  • Grand total: Overall audit cost in base currency
  • Budget variance: If budget was set, shows over/under budget

Resource Reports

Use resource data for:

  • Audit program budgeting: Plan future audit costs based on historical data
  • Cost-benefit analysis: Compare audit costs to value of findings/improvements
  • Resource allocation: Identify resource-intensive audit types
  • Management reporting: Demonstrate audit program investment and ROI

12 Audit Activity Logs

Every action taken on an audit is automatically logged, creating a complete audit trail of all activities. This supports accountability, traceability, and regulatory compliance.

What is Logged?

The audit log captures:

  • User actions: Who performed each action (auditor or auditee)
  • Activity description: What was done (created, edited, submitted, approved, etc.)
  • Timestamp: Exact date and time of the action
  • Logger type: Whether action was by auditor or auditee (different icons)

Viewing Audit Logs

To view the audit log:

  1. Open the audit (click anywhere in the audit row to open the read-only view)
  2. Scroll to the Audit Logs section at the bottom of the window
  3. View the chronological list of all activities

Common Log Entries

Activity Description Logger Type
Audit created Initial audit record was created Auditor
Audit updated Audit details were edited Auditor
Status changed to [status] Audit status transitioned Auditor
Checklist item audited Outcome recorded for checklist item Auditor
Finding created New finding was recorded Auditor
Finding updated Finding details were edited Auditor
Close-out requested Auditor submitted close-out request Auditor
Close-out approved Reviewer approved close-out Auditor
Close-out rejected Reviewer rejected close-out with comments Auditor
Corrective action submitted Respondent submitted CAP/SCAI/LCAI Auditee
Corrective action reviewed Auditor approved/rejected submission Auditor

Using Audit Logs

Audit logs are valuable for:

  • Compliance verification: Demonstrate who did what and when
  • Dispute resolution: Clarify sequence of events if questions arise
  • Process improvement: Analyze how long activities take
  • Accountability: Track individual contributions and responsibilities
  • Regulatory audits: Provide evidence of audit processes to regulators

13 Troubleshooting & Common Questions

Access & Visibility Issues

Possible reasons:

  • Not a team member: You can only see audits where you're assigned as a team member, unless you're an administrator or security manager
  • Wrong section: Verify you're looking at the correct section (Quality vs Safety vs Security vs DG)
  • Viewing Cancelled instead of Active: Check your view toggle setting
  • Date filter: The audit date might be outside your selected date range
  • Insufficient permissions: You need Security Auditor or Security Investigator role

Audits become locked at certain stages:

  • Once an audit has a close-out or finalisation request pending or approved, most details cannot be edited
  • Findings can be edited before they're submitted, but after submission editing is restricted
  • You must be assigned as Auditor role (not just Reviewer) to edit
  • If close-out is rejected, the audit returns to active conducting state and editing is restored

Solution: If you need to make changes, either edit before requesting close-out, or have the close-out rejected to regain edit access.

If findings already exist for an item:

Once you create one or more findings for an audit item, the outcome is automatically set to "Findings" and cannot be changed back to "Compliant" or "Not Applicable". This prevents inconsistency between the recorded outcome and documented findings.

Solution: If you want to change the outcome, you must first cancel all findings associated with that item, then you can change the outcome.

Findings have draft and submitted states:

  • Draft: While working on a finding, it's saved but not visible to respondents
  • Submitted: Once you click "Submit", the finding becomes official and creates the corrective action request

Finding draft findings: Return to the audit item detail view where you were creating the finding. Your draft should still be there, allowing you to continue editing or submit it.

Common rejection reasons:

  • Incomplete checklist: Not all audit items have been audited (still showing "-" in outcome column)
  • Pending corrective actions: One or more findings have corrective actions that haven't been fully approved (CAP/SCAI/LCAI)
  • Inadequate summary: Close-out summary doesn't adequately describe audit results and conclusions
  • Missing evidence: Required documents or evidence not attached
  • Quality concerns: Reviewer believes additional audit work is needed

Next steps: Review the rejection comments from your reviewer, address their concerns, then submit a new close-out request.

Multi-finding workflow:

  1. When auditing an item, set the outcome to "Findings"
  2. In the findings section that appears, create and submit your first finding
  3. After submitting, you'll see an "Add Another Finding" button
  4. Click it to create additional findings for the same audit item
  5. Each finding creates its own separate corrective action request
  6. All findings are tracked under the single audit item

Error Messages

Error Message Cause Solution
"You do not have permission" Missing required role or not a team member Request Security Auditor/Investigator role from administrator, or ask to be added to audit team
"Audit cannot be edited in current status" Audit has close-out or finalisation request pending or approved Have close-out rejected to regain edit access, or create a new audit
"All findings must have approved corrective actions" Trying to close-out with pending CARs Wait for all corrective actions to be fully approved (CAP, SCAI, LCAI) before requesting close-out
"Hazard is required for security findings" Mandatory hazard assessment not completed Select or create a hazard and complete initial risk assessment before submitting finding
"Team member must be assigned to an audit role" Adding team member without specifying Auditor or Reviewer Check either Auditor or Reviewer checkbox when adding team member
Navigation
Settings

Theme

Other settings coming soon...

An unhandled error has occurred. Reload 🗙
Interactive features loading...