--- title: "One Audit Finding, From the Plan to Closure" description: "Record audit findings, run corrective actions on a Kanban board, collect evidence and remind owners for ISO 9001, 27001, 20000-1 and CMMI in Microsoft 365." url: https://www.virtosoftware.com/use-cases/iso-audit-capa-microsoft-365/ language: en-US last_modified: 2026-10-14T00:00:00+02:00 translations: de: https://www.virtosoftware.com/de/use-cases/iso-audit-capa-microsoft-365/index.md --- # One Audit Finding, From the Plan to Closure One audit finding from the audit plan to a closed record, in one SharePoint site and one Teams team. A demo built with the Virto M365 Productivity Kit for an IT and engineering services company that holds ISO 9001, ISO/IEC 20000-1, ISO/IEC 27001 and CMMI Level 3. Available at: SharePoint Microsoft Teams Microsoft Azure Illustrative audit finding marked Major: Access review not performed, with the status Closed. Trusted by Industry Leaders Warner Bros. Disney Sony UC Berkeley Motorola Teck Resources US Treasury University of Pittsburgh NASA Stockholms Stad FedEx Zespri and over 8,000 businesses worldwide ## Eight Steps, Five Apps, One Site Each step is a Virto app or a standard Power Automate flow on top of ordinary SharePoint lists. The screens are from our demo site, and every step shows a different sample item. Step 1 · Plan ### Every compliance date on one calendar #### Four lists, one view Audits, due dates, policy reviews and training come from four lists; each event stays the item of its own list, with its permissions. #### Switch a source off The legend is clickable: audits alone, or everything due before the next surveillance audit. ![Virto Calendar App, month view of October on the Compliance Calendar: an internal ISO 20000-1 audit on the 13th and a management review on the 21st in blue, corrective-action due dates on the 10th, 15th, 17th, 24th and 29th in red, an approved policy review in purple, training records in green, and the legend Audits, Corrective action due, Policy reviews, Training due at the top](https://www.virtosoftware.com/images/use-cases/iso-audit-capa-microsoft-365/compliance-calendar.webp) The Compliance Calendar in October: audits in blue, corrective-action due dates in red, policy reviews in purple, training in green. Step 2 · Record ### A finding is recorded in under a minute #### One form for every finding Source, standard, clause, department, description and the evidence attached, on an ordinary SharePoint list. #### Fields follow the role Severity and the triage fields are shown to the quality manager only; employees see only the findings they raised. ![The Raise a Finding form built with Virto Forms Designer App, as the quality manager sees it: Finding CUI banner marking missing on 3 contract deliverables, Source Internal audit, Proposed Severity Major, Date Found 10/13/2026, Standard ISO 27001, Clause A.5.13, Department Program Management, a Description, an Evidence Link row, the quality-manager fields Repeat Finding, Customer Notification Required and QM Triage Notes with the hint Internal notes of the Quality Manager. Not shown to employees, and an Attach file button with the hint Audit evidence: screenshots, exports, signed records](https://www.virtosoftware.com/images/use-cases/iso-audit-capa-microsoft-365/finding-form.webp) The Raise a Finding form with a sample ISO 27001 finding, as the quality manager sees it: the fields everyone fills in, the severity and triage fields below, and the attachment. Step 3 · Notify ### A Major finding reaches the quality team within a minute #### A rule with one condition The alert fires only when the proposed severity is Major; a Minor finding still creates an action, quietly. #### Into the channel, with a link The card arrives through the channel's own Workflows webhook and opens the finding in one click. ![Card posted by Workflows to the General channel of the Demo team in Microsoft Teams: Major finding raised, the VirtoSoftware logo, the text A Major finding has been raised, Post-incident review not done for the 18 Sep portal outage, A corrective action is created automatically and appears in the CAPA Board backlog, and a table with Finding, Description, Source Internal audit, Standard ISO 20000-1, Clause 8.6.1, Department Service Desk and Date Found](https://www.virtosoftware.com/images/use-cases/iso-audit-capa-microsoft-365/teams-card.webp) The card Virto Alerts & Reminder App posts to the quality channel in Teams when a Major finding is raised; the same rule emails the Quality Manager. Step 4 · Act ### One board for all four standards #### Columns are the status Backlog to Closed is the Status column of the Corrective Actions list, shown as a board. #### A lane per standard Swimlanes come from the Standard column, and a WIP limit of five keeps Implementing focused. ![The CAPA Board in Virto Kanban Board App: swimlanes ISO 9001 and ISO 27001, columns Backlog, Root Cause, Action Plan, Implementing, Verification, Closed and Rejected, cards with Severity, Source, Finding and % Complete, an orange marker on Major actions, a red marker on overdue ones and the WIP limit 1 / 5 on Implementing](https://www.virtosoftware.com/images/use-cases/iso-audit-capa-microsoft-365/capa-board.webp) The CAPA Board: a lane per standard, columns from Backlog to Closed, an orange marker for Major actions, a red one for overdue ones and a WIP limit on Implementing. Step 5 · Track ### The file from the form is already on the card #### No retyping A standard flow copies the finding into the action, with a due date set by severity: 30 days for a Major finding. #### A folder of its own Each action gets a folder in Quality Documents, and the link sits on the card next to the attachment. ![Bottom of the full view of the corrective action Post-incident review not done for the 18 Sep portal outage in Virto Kanban Board App: % Complete 0, an attachment Access-Control-Procedure in the Attachments section, an Add file button and the Evidence folder link CA-20 evidence with the note Folder in Quality Documents that holds the evidence for this action](https://www.virtosoftware.com/images/use-cases/iso-audit-capa-microsoft-365/card-details.webp) The bottom of a corrective action's full view: the attachment copied from the finding and the link to the action's evidence folder. Step 6 · Evidence ### The whole evidence pack in one upload #### One click from the card The Evidence folder link opens the library in the action's own folder. #### The whole pack at once Bulk Upload takes the export, the sign-off, the ticket and the screenshots in one go, with the library's versions and permissions. ![The Quality Documents library opened in folder CA-1 with the Bulk Upload panel of Virto Multiple Operations: six queued files, Access-Control-Procedure-change-note.docx, Access-review-sign-off-Q3-2026.pdf, Change-ticket-CHG-2026-1042.pdf, Group-membership-after-review.png, Q3-access-review-ENG-file-shares.xlsx and Removed-contractor-accounts.csv, the buttons Add files and Add folder, Total files 6 and the Upload button](https://www.virtosoftware.com/images/use-cases/iso-audit-capa-microsoft-365/bulk-upload.webp) Bulk Upload in the action's folder CA-1: an export, a sign-off, a change ticket, a screenshot, a review sheet and a list of removed accounts, queued in one go. Step 7 · Remind ### Eight rules, and nobody chases owners by email #### Each moment has a rule Assignment, seven days before the due date, ready for verification, a Major finding, a closed finding, policy reviews, training. #### Built from the record The reminder prints the fields of the action with a link back to it, and Preview shows it before you save. ![Virto Alerts & Reminder App, All alerts of the demo site with eleven rules such as CAPA - action reassigned, CAPA - due date reminder, CAPA - ready for verification, Findings - Major finding raised, Findings - your finding is closed, Policy review due in 30 days and Training due in 7 days; in front, the Preview of the reminder Your corrective action is due in 7 days with the action Quarterly access review not performed for engineering file shares and a table of its fields](https://www.virtosoftware.com/images/use-cases/iso-audit-capa-microsoft-365/alerts-preview.webp) The rules of the demo site and the preview of the reminder an action owner gets seven days before the due date. Step 8 · Approve and close ### Verification is the approval step #### Moving the card to Closed is the approval The move belongs to the Quality Manager in the process; a flow then closes the finding and copies the notes into Resolution. #### The author hears about it The person who raised the finding gets an email, a card is posted to the Teams channel, and the version history is the audit trail. ![Card posted by Workflows to the General channel in Microsoft Teams: Your finding has been closed, the VirtoSoftware logo, the finding Peer review records missing in two project sprints, the text The corrective action was verified and closed. The verification notes are in the Resolution field below, and a table with Field Name, Old Value and New Value for Finding, Description, Source External audit, Standard CMMI, Clause PR 2.1 and Department Program Management](https://www.virtosoftware.com/images/use-cases/iso-audit-capa-microsoft-365/finding-closed.webp) The card posted to the channel in Teams when the corrective action is moved to Closed: old and new values side by side, with the verification notes in the Resolution field. ## Key benefits ### No separate QMS The whole cycle runs on SharePoint lists, a library and a Teams team your tenant already has. The apps add the calendar, the form, the board, the bulk upload and the notifications. ### Standard Power Automate only The five flows use the standard SharePoint connector. No premium licence is needed for this setup. ### Your data stays in your lists Lists, documents and events stay in your Microsoft 365 tenant with your permissions. For controlled information, keep the notification bodies to status, dates, owner and the item link. ### One site for all four standards ISO 9001, ISO/IEC 20000-1, ISO/IEC 27001 and CMMI share one calendar, one board and one set of rules. The standard is a column, not a separate system. ### Version history is the audit trail Every list and the library keep versions, so who changed what and when is one click away when the certification body asks. ### The same apps go further Correction versus corrective action, plan approval, due-date extensions, effectiveness reviews, document revisions and management-review reports run on the same lists. This walkthrough is the simplified version. ## What the cycle needs, and what runs it | Real-life scenario | Best fit | Why it works | | --- | --- | --- | | Every compliance date on one calendar — Audits, action due dates, policy reviews and training live in four different lists. | Virto Calendar App | The four lists overlay into one colour-coded calendar with a clickable legend; each event stays the item of its own list. | | A finding recorded the same way every time | Virto Forms Designer App | One form on the Findings list, with attachments and fields shown by role; list permissions let employees see only their own findings. | | Corrective actions by stage and by standard | Virto Kanban Board App | The Corrective Actions list as a board: columns from Status, lanes from Standard, owner, due date, subtasks and the evidence folder on the card. | | The evidence pack uploaded at once | Virto Multiple Operations | Bulk Upload and Bulk Delete in the Quality Documents library, one folder per action. | | Owners reminded without anyone chasing them | Virto Alerts & Reminder App | Eight rules send email and Teams cards for each moment of the cycle, built from the record itself. | | Finding to action, status back, a folder per action | Power Automate, standard connector | Five flows on the standard SharePoint connector create the action, write the status back to the finding, assign the analyst at Root Cause, copy the files and create the folder. No premium licence is needed. | | Read receipts, effectiveness scoring, a portal for the certification body | A dedicated QMS suite | The kit records, tracks, reminds and closes. It does not collect acknowledgements or score effectiveness; if that is the requirement, a QMS suite is the answer. | ## Related products Explore how our set of productivity tools can transform your task management - [Virto Calendar App](https://www.virtosoftware.com/microsoft-365/virto-calendar-overlay-app/): Consolidate events from SharePoint, Exchange, Google, and more into one calendar view for simplified planning. - [Virto Forms Designer App](https://www.virtosoftware.com/microsoft-365/virto-forms-designer-app/): Rebuild the New, Edit and Display forms of SharePoint lists in a drag-and-drop designer, no code. - [Virto Kanban Board App](https://www.virtosoftware.com/microsoft-365/virto-kanban-board-app/): This tool transforms team collaboration through visual task management for consistent stage-by-stage progress. - [Virto Multiple Operations](https://www.virtosoftware.com/microsoft-365/virto-multiple-file-upload-app/): Efficiently upload, manage and delete multiple files and folders in SharePoint with customizable settings. - [Virto Alerts & Reminder App](https://www.virtosoftware.com/microsoft-365/virto-alerts-and-reminders-app/): Email and Teams alerts when SharePoint list items change, and reminders before the dates they hold—one-off or recurring. ## Related use cases Discover our range of use cases to take your planning and coordination to another level ![Compliance Management Software](https://www.virtosoftware.com/images/use-cases/enterprise-compliance-management.webp) ### Compliance Management Software See every audit and filing date in one calendar, move remediation tasks across Kanban boards, and email owners before compliance deadlines, all in Microsoft 365. ![Document Library Change Notifications](https://www.virtosoftware.com/images/use-cases/document-library-change-notifications.webp) ### Document Library Change Notifications When a policy in a SharePoint library is approved, its readers get an email with a link; one folder can have its own rule, and a weekly table lists what changed. ![Notifications Automation for Government](https://www.virtosoftware.com/images/use-cases/notifications-automation.webp) ### Notifications Automation for Government For government, legal and finance teams: Virto Alerts & Reminder App sends email and Teams reminders before the deadlines kept in your SharePoint lists and alerts owners when items change.