Hi everyone, I’m pretty new to the audit software world—I usually live in data pipelines with Airflow and dbt, so this is a bit outside my comfort zone 😅
My company is starting to look at IT General Controls (ITGC) audits, and someone suggested AuditBoard. From a data person’s perspective, I’m really curious how it handles evidence collection. In my world, evidence would be like log files, user permission exports, or pipeline run histories.
* Does AuditBoard let you connect directly to sources (like Snowflake, BigQuery, or even an SFTP server) to pull evidence automatically?
* Or is it more manual, like uploading PDFs and screenshots?
* How does it track changes or versions if a piece of evidence gets updated?
I’m trying to picture if it would feel like another siloed system, or if it can integrate somewhat with data workflows. Any insights from people who’ve used it would be super helpful—maybe even a rough idea of the setup process? I’m already overwhelmed thinking about mapping controls to evidence manually!
null
It absolutely leans toward the manual upload side for the types of evidence you're describing. While AuditBoard has solid APIs for pushing data into its platform for reporting and issue tracking, the native evidence collection module is primarily designed for manual file attachments, screenshots, and text notes.
You'd typically export your user permission list from Snowflake as a CSV, run your pipeline log, or pull an access report, then manually upload that file to the relevant control. It does maintain version history on those uploaded files, so if you export a new user list next quarter and upload it to the same control, you can see the prior version. The linkage is more about the audit program structure than direct data connections.
For someone used to automated data pipelines, this will feel quite manual and siloed. The integration point is usually on the back end, where you might push finalized audit results out to a data warehouse, not live evidence ingestion. You'll likely need a separate process to automate and store your evidentiary data exports, then manually curate which specific file snapshot serves as the audit evidence for that period.
Data > opinions
That's a great summary of the core evidence workflow. I'd add that the real friction point isn't just the manual upload-it's the loss of context. When you upload a static CSV of user permissions, it's detached from the live system state and the logic used to generate it.
The version history helps, but you're still comparing two point-in-time snapshots without the "why" behind any changes. For true ITGC, sometimes the audit trail *of the evidence itself* matters.
We've built some middle-layer scripts to auto-export, timestamp, and log the query parameters before we upload. It's extra work, but it bridges that gap a bit.
user621 and user835 covered it. It's manual upload for your file types. No direct Snowflake/BigQuery connections.
You'll be exporting CSVs and uploading them. The versioning is basic file-level. It will feel like a silo.
If you're used to data pipelines, you'll need to build your own automation bridge. The API exists for pulling data *out* for reporting, not for pulling evidence *in*.
Benchmarks don't lie.