{ "name": "Capanix Audit Framework Requirements", "title": "Audit Framework Requirements", "url": "https://capanix.com/datasets/audit-framework-requirements/", "csv": "https://capanix.com/datasets/audit-framework-requirements.csv", "markdown": "https://capanix.com/datasets/audit-framework-requirements/index.md", "computed_at": "2026-10-18", "license": "https://capanix.com/terms", "headline": "The Audit Framework Requirements carries 6 published figures read from 3 sources' own pages, from 21 to 90 day, read 16 October 2026.", "quotes": [ "The Audit Framework Requirements carries 6 published figures read from 3 sources' own pages, from 21 to 90 day, read 16 October 2026.", "3 of the 27 named sources read in full publish a figure; 24 publish none, read 16 October 2026.", "Audit Framework Requirements, obligation HIPAA: median 60 day across 1 source, read 16 October 2026.", "Audit Framework Requirements, obligation HIPAA: median 6 year across 1 source, read 16 October 2026.", "Audit Framework Requirements, obligation HIPAA: median 12 month across 1 source, read 16 October 2026.", "Audit Framework Requirements, obligation EPA: median 21 day across 1 source, read 16 October 2026.", "Audit Framework Requirements, obligation cGMP: median 3 year across 1 source, read 16 October 2026." ], "citation": "\"Capanix Audit Framework Requirements\", updated 2026-10-18, https://capanix.com/datasets/audit-framework-requirements/.", "changed_since": null, "national": { "unit": "day", "n": 2, "median": 40.5, "min": 21, "max": 60, "p25": null, "p75": null, "mean": 40.5, "units": { "day": 2, "month": 1, "year": 2 }, "published_sources": 3, "named_sources": 29, "read_sources": 27, "not_published": 24, "published_share": 0.111 }, "by_axis": { "obligation": { "HIPAA": { "day": { "n": 1, "median": 60, "min": 60, "max": 60, "p25": 60, "p75": 60, "mean": 60 }, "year": { "n": 1, "median": 6, "min": 6, "max": 6, "p25": 6, "p75": 6, "mean": 6 }, "month": { "n": 1, "median": 12, "min": 12, "max": 12, "p25": 12, "p75": 12, "mean": 12 } }, "EPA": { "day": { "n": 1, "median": 21, "min": 21, "max": 21, "p25": 21, "p75": 21, "mean": 21 } }, "cGMP": { "year": { "n": 1, "median": 3, "min": 3, "max": 3, "p25": 3, "p75": 3, "mean": 3 } } } }, "rows": [ { "source": "HHS OCR HIPAA audit protocol", "url": "https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "obligation": "HIPAA" }, "retrieved_at": "2026-10-16", "quote": "(B) A health plan that does not post its notice on a web site pursuant to paragraph (c)(3)(i) of this section must provide the revised notice, or information about the material change and how to obtain the revised notice, to individuals then covered by the plan within 60 days of the material revision to the notice.", "source_class": "primary-government", "text_sha256": "ac0b72fde58cb419525b865058008d7876fdf5c66cbe7c3095b612b66f24a08a" }, { "source": "HHS OCR HIPAA audit protocol", "url": "https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html", "figure": "6 years", "value": 6, "unit": "year", "vat": null, "axis": { "obligation": "HIPAA" }, "retrieved_at": "2026-10-16", "quote": "Is the documentation of notice of privacy practices and the acknowledgement of receipt by individuals of the notice of privacy practices maintained in electronic or written form and retained for a period of 6 years?", "source_class": "primary-government", "text_sha256": "ac0b72fde58cb419525b865058008d7876fdf5c66cbe7c3095b612b66f24a08a" }, { "source": "HHS OCR HIPAA audit protocol", "url": "https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html", "figure": "30 days", "value": 30, "unit": "day", "vat": null, "axis": { "obligation": "HIPAA" }, "retrieved_at": "2026-10-16", "quote": "(i) Except as provided in paragraph (b)(2)(ii) of this section, the covered entity must act on a request for access no later than 30 days after receipt of the request as follows.", "source_class": "primary-government", "text_sha256": "ac0b72fde58cb419525b865058008d7876fdf5c66cbe7c3095b612b66f24a08a" }, { "source": "HHS OCR HIPAA audit protocol", "url": "https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "obligation": "HIPAA" }, "retrieved_at": "2026-10-16", "quote": "(1) The covered entity must act on the individual’s request for an accounting, no later than 60 days after receipt of such a request, as follows.", "source_class": "primary-government", "text_sha256": "ac0b72fde58cb419525b865058008d7876fdf5c66cbe7c3095b612b66f24a08a" }, { "source": "HHS OCR HIPAA audit protocol", "url": "https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html", "figure": "12 month", "value": 12, "unit": "month", "vat": null, "axis": { "obligation": "HIPAA" }, "retrieved_at": "2026-10-16", "quote": "§164.528(c)(2) The covered entity must provide the first accounting to an individual in any 12 month period without charge.", "source_class": "primary-government", "text_sha256": "ac0b72fde58cb419525b865058008d7876fdf5c66cbe7c3095b612b66f24a08a" }, { "source": "HHS OCR HIPAA audit protocol", "url": "https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": { "obligation": "HIPAA" }, "retrieved_at": "2026-10-16", "quote": "Obtain and review the policies and procedures for notifying individuals of breaches and determine whether such policies and procedures are consistent with §164.404(b); providing notification without unreasonable delay and in no case later than within 60 days of discovery of a breach.", "source_class": "primary-government", "text_sha256": "ac0b72fde58cb419525b865058008d7876fdf5c66cbe7c3095b612b66f24a08a" }, { "source": "HHS OCR HIPAA audit protocol", "url": "https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html", "figure": "90 days", "value": 90, "unit": "day", "vat": null, "axis": { "obligation": "HIPAA" }, "retrieved_at": "2026-10-16", "quote": "-Establishing a toll-free phone number that remains active for at least 90 days.", "source_class": "primary-government", "text_sha256": "ac0b72fde58cb419525b865058008d7876fdf5c66cbe7c3095b612b66f24a08a" }, { "source": "US EPA audit policy (self-disclosure)", "url": "https://www.epa.gov/compliance/epas-audit-policy", "figure": "21 days", "value": 21, "unit": "day", "vat": null, "axis": { "obligation": "EPA" }, "retrieved_at": "2026-10-16", "quote": "A regulated entity has 21 days from the time it discovers that a violation has, or may have, occurred to disclose the violation in writing to EPA via the eDisclosure System.", "source_class": "primary-government", "text_sha256": "44a90687239889d9f40a9b966866c499300093a3aabe29ac5c0ffd9f85d2d3f5" }, { "source": "eCFR 21 CFR Part 211 cGMP for finished pharmaceuticals", "url": "https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211", "figure": "3 years", "value": 3, "unit": "year", "vat": null, "axis": { "obligation": "cGMP" }, "retrieved_at": "2026-10-16", "quote": "(ii) Six months after the expiration date of the drug product if the expiration dating period of the drug product is more than 30 days. (3) For an OTC drug product that is exempt for bearing an expiration date under § 211.137, the reserve sample must be retained for 3 years after the lot or batch of drug product is distributed.", "source_class": "primary-government", "text_sha256": "2c7299f0efe1deae457bbc99754e0d2f480e4c3eddb5c1431746ceabac55e87f" } ], "not_published": [ { "source": "ISO/IEC 27001:2022 (ISO catalogue)", "url": "https://www.iso.org/standard/27001", "retrieved_at": "2026-10-09", "reason": "read in full and no accepted figure on the page" }, { "source": "ISO 9000 family - quality management (ISO)", "url": "https://www.iso.org/iso-9001-quality-management.html", "retrieved_at": "2026-10-09", "reason": "read in full and no accepted figure on the page" }, { "source": "ISO 14000 family - environmental management (ISO)", "url": "https://www.iso.org/iso-14001-environmental-management.html", "retrieved_at": "2026-10-09", "reason": "read in full and no accepted figure on the page" }, { "source": "ISO 45001:2018 occupational health and safety (ISO)", "url": "https://www.iso.org/iso-45001-occupational-health-and-safety.html", "retrieved_at": "2026-10-09", "reason": "every candidate on the page was refused" }, { "source": "ISO 22301:2019 business continuity (ISO)", "url": "https://www.iso.org/standard/75106.html", "retrieved_at": "2026-10-09", "reason": "read in full and no accepted figure on the page" }, { "source": "ISO/IEC 42001:2023 AI management systems (ISO)", "url": "https://www.iso.org/standard/81230.html", "retrieved_at": "2026-10-09", "reason": "read in full and no accepted figure on the page" }, { "source": "ISO 19011:2018 guidelines for auditing management systems (ISO)", "url": "https://www.iso.org/standard/70017.html", "retrieved_at": "2026-10-09", "reason": "read in full and no accepted figure on the page" }, { "source": "ISO/IEC 17021-1:2015 requirements for certification bodies (ISO)", "url": "https://www.iso.org/standard/61651.html", "retrieved_at": "2026-10-09", "reason": "every candidate on the page was refused" }, { "source": "PCI Security Standards Council - PCI DSS", "url": "https://www.pcisecuritystandards.org/standards/pci-dss/", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "PCI SSC document library", "url": "https://www.pcisecuritystandards.org/document_library/", "retrieved_at": "2026-10-02", "reason": "read in full and no accepted figure on the page" }, { "source": "HHS OCR HIPAA audit programme", "url": "https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/index.html", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "HHS summary of the HIPAA Security Rule", "url": "https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "AICPA SOC suite of services (SOC 1, SOC 2, SOC 3)", "url": "https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services", "retrieved_at": "2026-10-09", "reason": "read in full and no accepted figure on the page" }, { "source": "OSHA 29 CFR 1910.119 process safety management", "url": "https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.119", "retrieved_at": "2026-10-16", "reason": "read in full and no accepted figure on the page" }, { "source": "OSHA PSM compliance directive CPL 02-02-045", "url": "https://www.osha.gov/enforcement/directives/cpl-02-02-045", "retrieved_at": "2026-10-02", "reason": "every candidate on the page was refused" }, { "source": "eCFR 29 CFR 1910.119 (authoritative text)", "url": "https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XVII/part-1910/subpart-H/section-1910.119", "retrieved_at": "2026-10-16", "reason": "every candidate on the page was refused" }, { "source": "HSE HSG65 managing for health and safety", "url": "https://www.hse.gov.uk/pubns/books/hsg65.htm", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "HSE managing for health and safety guidance", "url": "https://www.hse.gov.uk/managing/index.htm", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "ICO data protection audit framework", "url": "https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/", "retrieved_at": "2026-10-16", "reason": "read in full and no accepted figure on the page" }, { "source": "ICO audits service", "url": "https://ico.org.uk/for-organisations/advice-and-services/audits/", "retrieved_at": "2026-10-16", "reason": "read in full and no accepted figure on the page" }, { "source": "Regulation (EU) 2016/679 (GDPR) on EUR-Lex", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "retrieved_at": "2026-10-16", "reason": "every candidate on the page was refused" }, { "source": "NIST AI Risk Management Framework", "url": "https://www.nist.gov/itl/ai-risk-management-framework", "retrieved_at": "2026-10-02", "reason": "read in full and no accepted figure on the page" }, { "source": "IAF mandatory documents (audit time, certification cycle)", "url": "https://iaf.nu/en/iaf-documents/", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "FDA guidance: quality systems approach to pharmaceutical cGMP", "url": "https://www.fda.gov/media/71023/download", "retrieved_at": "2026-09-18", "reason": "read in full and no accepted figure on the page" } ], "sources": [ { "url": "https://www.iso.org/standard/27001", "label": "ISO/IEC 27001:2022 (ISO catalogue)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.iso.org/iso-9001-quality-management.html", "label": "ISO 9000 family - quality management (ISO)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.iso.org/iso-14001-environmental-management.html", "label": "ISO 14000 family - environmental management (ISO)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.iso.org/iso-45001-occupational-health-and-safety.html", "label": "ISO 45001:2018 occupational health and safety (ISO)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.iso.org/standard/75106.html", "label": "ISO 22301:2019 business continuity (ISO)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.iso.org/standard/81230.html", "label": "ISO/IEC 42001:2023 AI management systems (ISO)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.iso.org/standard/70017.html", "label": "ISO 19011:2018 guidelines for auditing management systems (ISO)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.iso.org/standard/61651.html", "label": "ISO/IEC 17021-1:2015 requirements for certification bodies (ISO)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.pcisecuritystandards.org/standards/pci-dss/", "label": "PCI Security Standards Council - PCI DSS", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.pcisecuritystandards.org/document_library/", "label": "PCI SSC document library", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html", "label": "HHS OCR HIPAA audit protocol", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/index.html", "label": "HHS OCR HIPAA audit programme", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html", "label": "HHS summary of the HIPAA Security Rule", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services", "label": "AICPA SOC suite of services (SOC 1, SOC 2, SOC 3)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.119", "label": "OSHA 29 CFR 1910.119 process safety management", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.osha.gov/enforcement/directives/cpl-02-02-045", "label": "OSHA PSM compliance directive CPL 02-02-045", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-29/subtitle-B/chapter-XVII/part-1910/subpart-H/section-1910.119", "label": "eCFR 29 CFR 1910.119 (authoritative text)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hse.gov.uk/pubns/books/hsg65.htm", "label": "HSE HSG65 managing for health and safety", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.hse.gov.uk/managing/index.htm", "label": "HSE managing for health and safety guidance", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/", "label": "ICO data protection audit framework", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/for-organisations/advice-and-services/audits/", "label": "ICO audits service", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj", "label": "Regulation (EU) 2016/679 (GDPR) on EUR-Lex", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211", "label": "eCFR 21 CFR Part 211 cGMP for finished pharmaceuticals", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.epa.gov/compliance/epas-audit-policy", "label": "US EPA audit policy (self-disclosure)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.nist.gov/itl/ai-risk-management-framework", "label": "NIST AI Risk Management Framework", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://iaf.nu/en/iaf-documents/", "label": "IAF mandatory documents (audit time, certification cycle)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.fda.gov/media/71023/download", "label": "FDA guidance: quality systems approach to pharmaceutical cGMP", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.fda.gov/food/food-safety-modernization-act-fsma", "label": "FDA Food Safety Modernization Act", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.iso.org/standards.html", "label": "iso.org", "license": "the publisher's own terms; quoted for reporting and comment" } ], "methodology": "Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 3 of the 27 named sources that could be read published a usable figure; 24 published none and are recorded as not published, never filled in; 2 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source in day (a source's median where its page yielded several accepted sentences), so N counts sources, never sentences; 43 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per framework per obligation, each quoted verbatim from the standard owner's or the regulator's own page with its effective date and version: who owns the framework, whether the outcome is a certificate, an attestation or a self-assessment, the count of controls or requirements, the certification cycle and surveillance interval, who may sign, and the re-audit trigger. What nobody publishes is the CROSS-FRAMEWORK comparison computed over those rows: controls per framework side by side, which frameworks share a control theme (so a control evidenced once counts twice), the shortest and longest cycle, which of them a given business actually falls under, and changed-since the last read - which is the news the week a standard version turns.", "embed": "

21 to 60 day

2 published figures, Audit Framework Requirements, across 3 sources, read 16 October 2026

Source: Capanix Audit Framework Requirements
" }