مرجع الحقول — عالم التدقيق

Complete documentation for every field in the Audit Universe and Library modules.

AuditUniverseItem

The core entity representing an auditable item in your organization.

Field	Type	Required	Default	Validation	Description
id	Integer	Auto	Auto-increment	—	Unique identifier
org_id	Integer	Auto	From session	—	Organization (tenant isolation)
name	String	✅	—	Max 255 chars	Entity name
type	Enum	✅	—	Business Unit, Process, Application, Regulatory Domain, Project, Location	Entity classification
description	Text	No	—	Max 5,000 chars	Detailed description
parent_id	Integer	No	null	Must reference existing item	Parent entity for hierarchy
owner	String	No	—	Max 255 chars	Business owner name
risk_level	Enum	No	null	Low, Medium, High, Critical	Aggregate risk level
risk_score	Float	Auto	0.0	0.0–25.0	Calculated from attached risks
last_audit_date	Date	Auto	null	—	Date of last completed engagement
next_audit_date	Date	No	null	Must be future date	Planned next audit
status	Enum	No	Active	Active, Archived	Current status
tags	JSON Array	No	[]	Max 20 tags	Custom tags for filtering
created_at	Timestamp	Auto	Current time	—	Creation timestamp
updated_at	Timestamp	Auto	Current time	—	Last modification timestamp
created_by	Integer	Auto	Current user	—	Creator user ID

Risk

Risk statements attached to audit universe items.

Field	Type	Required	Default	Validation	Description
id	Integer	Auto	Auto-increment	—	Unique identifier
org_id	Integer	Auto	From session	—	Organization
title	String	✅	—	Max 500 chars	Risk statement
category	Enum	✅	—	Strategic, Operational, Financial, Compliance, IT, Reputational	Risk category
description	Text	No	—	Max 5,000 chars	Detailed risk description
likelihood	Integer	✅	—	1–5	Probability of occurrence
impact	Integer	✅	—	1–5	Severity if it occurs
inherent_risk_score	Float	Auto	Likelihood × Impact	1.0–25.0	Risk score before controls
residual_risk_score	Float	No	null	0.0–25.0	Risk score after controls
risk_owner	String	No	—	Max 255 chars	Accountable person
status	Enum	No	Active	Active, Archived, Accepted	Current status
universe_item_id	Integer	✅	—	Must reference existing item	Parent entity
created_at	Timestamp	Auto	Current time	—	Creation timestamp
updated_at	Timestamp	Auto	Current time	—	Last modification

Control

Control activities that mitigate identified risks.

Field	Type	Required	Default	Validation	Description
id	Integer	Auto	Auto-increment	—	Unique identifier
org_id	Integer	Auto	From session	—	Organization
control_id	String	Auto	CTRL-{seq}	Unique per org	Human-readable ID
title	String	✅	—	Max 500 chars	Control name
description	Text	No	—	Max 5,000 chars	Detailed description
type	Enum	✅	—	Preventive, Detective, Corrective	Control type
nature	Enum	✅	—	Manual, Automated, IT-Dependent Manual	How it operates
frequency	Enum	✅	—	Continuous, Daily, Weekly, Monthly, Quarterly, Annual, Ad-hoc	Execution frequency
owner	String	No	—	Max 255 chars	Control operator
effectiveness	Enum	No	Not Tested	Effective, Partially Effective, Ineffective, Not Tested	Current rating
last_tested_date	Date	Auto	null	—	Date of last test
status	Enum	No	Active	Active, Archived	Current status
created_at	Timestamp	Auto	Current time	—	Creation timestamp
updated_at	Timestamp	Auto	Current time	—	Last modification

RiskControlMapping

Many-to-many relationship between risks and controls.

Field	Type	Required	Default	Validation	Description
id	Integer	Auto	Auto-increment	—	Unique identifier
risk_id	Integer	✅	—	Must reference existing risk	Linked risk
control_id	Integer	✅	—	Must reference existing control	Linked control
mapping_type	Enum	No	Primary	Primary, Secondary	Strength of linkage
notes	Text	No	—	Max 1,000 chars	Mapping context

الحالة Enums

Entity الحالة

Value	Description
Active	Currently in scope for audit consideration
Archived	No longer applicable; retained for history

Risk الحالة

Value	Description
Active	Risk is current and relevant
Archived	Risk no longer applicable
Accepted	Risk accepted by management (documented acceptance)

Control Effectiveness

Value	Description
Effective	Control operates as designed and mitigates the risk
Partially Effective	Control has gaps but provides some mitigation
Ineffective	Control does not adequately mitigate the risk
Not Tested	Control has not been evaluated in the current period