ISO audit: Audit Framework Requirements
The Audit Framework Requirements carries 6 published figures read from 3 sources' own pages, from 21 to 90 day, read 16 October 2026.
Capanix sells its own paid plan in this category (our pricing). It is not counted here: every figure in this index is another provider's own published price, read from its own page.
3 of the 27 named sources read in full publish a figure; 24 publish none, read 16 October 2026.
By obligation
| Breakdown | Median | Range | Sources |
|---|---|---|---|
| obligationHIPAA | 60day | 60 to 60day | 1 |
| obligationHIPAA | 6year | 6 to 6year | 1 |
| obligationHIPAA | 12month | 12 to 12month | 1 |
| obligationEPA | 21day | 21 to 21day | 1 |
| obligationcGMP | 3year | 3 to 3year | 1 |
Every figure, with its source
One row per source: the figure the source's own page publishes, the page, and the day it was read. A figure that is not on a page we read is not on this one.
| Source | Figure | Breakdown | Read |
|---|---|---|---|
| HHS OCR HIPAA audit protocol | 90day | HIPAA | 2026-10-16 |
| HHS OCR HIPAA audit protocol | 60day | HIPAA | 2026-10-16 |
| HHS OCR HIPAA audit protocol | 60day | HIPAA | 2026-10-16 |
| HHS OCR HIPAA audit protocol | 60day | HIPAA | 2026-10-16 |
| HHS OCR HIPAA audit protocol | 30day | HIPAA | 2026-10-16 |
| US EPA audit policy (self-disclosure) | 21day | EPA | 2026-10-16 |
| HHS OCR HIPAA audit protocol | 12month | HIPAA | 2026-10-16 |
| HHS OCR HIPAA audit protocol | 6year | HIPAA | 2026-10-16 |
| eCFR 21 CFR Part 211 cGMP for finished pharmaceuticals | 3year | cGMP | 2026-10-16 |
The sentence each figure was read from (9)
- HHS OCR HIPAA audit protocol, read 2026-10-16:
-Establishing a toll-free phone number that remains active for at least 90 days.
- HHS OCR HIPAA audit protocol, read 2026-10-16:
(B) A health plan that does not post its notice on a web site pursuant to paragraph (c)(3)(i) of this section must provide the revised notice, or information about the material change and how to obtain the revised notice, to individuals then covered by the plan within 60 days of the material revision to the notice.
- HHS OCR HIPAA audit protocol, read 2026-10-16:
(1) The covered entity must act on the individual’s request for an accounting, no later than 60 days after receipt of such a request, as follows.
- HHS OCR HIPAA audit protocol, read 2026-10-16:
Obtain and review the policies and procedures for notifying individuals of breaches and determine whether such policies and procedures are consistent with §164.404(b); providing notification without unreasonable delay and in no case later than within 60 days of discovery of a breach.
- HHS OCR HIPAA audit protocol, read 2026-10-16:
(i) Except as provided in paragraph (b)(2)(ii) of this section, the covered entity must act on a request for access no later than 30 days after receipt of the request as follows.
- US EPA audit policy (self-disclosure), read 2026-10-16:
A regulated entity has 21 days from the time it discovers that a violation has, or may have, occurred to disclose the violation in writing to EPA via the eDisclosure System.
- HHS OCR HIPAA audit protocol, read 2026-10-16:
§164.528(c)(2) The covered entity must provide the first accounting to an individual in any 12 month period without charge.
- HHS OCR HIPAA audit protocol, read 2026-10-16:
Is the documentation of notice of privacy practices and the acknowledgement of receipt by individuals of the notice of privacy practices maintained in electronic or written form and retained for a period of 6 years?
- eCFR 21 CFR Part 211 cGMP for finished pharmaceuticals, read 2026-10-16:
(ii) Six months after the expiration date of the drug product if the expiration dating period of the drug product is more than 30 days. (3) For an OTC drug product that is exempt for bearing an expiration date under § 211.137, the reserve sample must be retained for 3 years after the lot or batch of drug product is distributed.
Read in full, publishes no figure
24 named sources were read in full on the dates shown and print no usable figure. They are counted, never filled in.
- ISO/IEC 27001:2022 (ISO catalogue), read 2026-10-09: read in full and no accepted figure on the page
- ISO 9000 family - quality management (ISO), read 2026-10-09: read in full and no accepted figure on the page
- ISO 14000 family - environmental management (ISO), read 2026-10-09: read in full and no accepted figure on the page
- ISO 45001:2018 occupational health and safety (ISO), read 2026-10-09: every candidate on the page was refused
- ISO 22301:2019 business continuity (ISO), read 2026-10-09: read in full and no accepted figure on the page
- ISO/IEC 42001:2023 AI management systems (ISO), read 2026-10-09: read in full and no accepted figure on the page
- ISO 19011:2018 guidelines for auditing management systems (ISO), read 2026-10-09: read in full and no accepted figure on the page
- ISO/IEC 17021-1:2015 requirements for certification bodies (ISO), read 2026-10-09: every candidate on the page was refused
- PCI Security Standards Council - PCI DSS, read 2026-09-11: read in full and no accepted figure on the page
- PCI SSC document library, read 2026-10-02: read in full and no accepted figure on the page
- HHS OCR HIPAA audit programme, read 2026-09-11: read in full and no accepted figure on the page
- HHS summary of the HIPAA Security Rule, read 2026-09-11: read in full and no accepted figure on the page
- AICPA SOC suite of services (SOC 1, SOC 2, SOC 3), read 2026-10-09: read in full and no accepted figure on the page
- OSHA 29 CFR 1910.119 process safety management, read 2026-10-16: read in full and no accepted figure on the page
- OSHA PSM compliance directive CPL 02-02-045, read 2026-10-02: every candidate on the page was refused
- eCFR 29 CFR 1910.119 (authoritative text), read 2026-10-16: every candidate on the page was refused
- HSE HSG65 managing for health and safety, read 2026-09-11: read in full and no accepted figure on the page
- HSE managing for health and safety guidance, read 2026-09-11: read in full and no accepted figure on the page
- ICO data protection audit framework, read 2026-10-16: read in full and no accepted figure on the page
- ICO audits service, read 2026-10-16: read in full and no accepted figure on the page
- Regulation (EU) 2016/679 (GDPR) on EUR-Lex, read 2026-10-16: every candidate on the page was refused
- NIST AI Risk Management Framework, read 2026-10-02: read in full and no accepted figure on the page
- IAF mandatory documents (audit time, certification cycle), read 2026-09-11: read in full and no accepted figure on the page
- FDA guidance: quality systems approach to pharmaceutical cGMP, read 2026-09-18: read in full and no accepted figure on the page
Methodology
Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2).
3 of the 27 named sources that could be read published a usable figure; 24 published none and are recorded as not published, never filled in; 2 could not be read (blocked, dead or unreachable) and count nowhere.
The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source in day (a source's median where its page yielded several accepted sentences), so N counts sources, never sentences; 43 candidate sentence(s) were refused by a reviewer with the reason recorded.
The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per framework per obligation, each quoted verbatim from the standard owner's or the regulator's own page with its effective date and version: who owns the framework, whether the outcome is a certificate, an attestation or a self-assessment, the count of controls or requirements, the certification cycle and surveillance interval, who may sign, and the re-audit trigger.
What nobody publishes is the CROSS-FRAMEWORK comparison computed over those rows: controls per framework side by side, which frameworks share a control theme (so a control evidenced once counts twice), the shortest and longest cycle, which of them a given business actually falls under, and changed-since the last read - which is the news the week a standard version turns.
43 candidate sentences on these pages were refused by a reviewer; each refusal and its reason is recorded in the review ledger.
Sources (29)
- ISO/IEC 27001:2022 (ISO catalogue)(the publisher's own terms; quoted for reporting and comment)
- ISO 9000 family - quality management (ISO)(the publisher's own terms; quoted for reporting and comment)
- ISO 14000 family - environmental management (ISO)(the publisher's own terms; quoted for reporting and comment)
- ISO 45001:2018 occupational health and safety (ISO)(the publisher's own terms; quoted for reporting and comment)
- ISO 22301:2019 business continuity (ISO)(the publisher's own terms; quoted for reporting and comment)
- ISO/IEC 42001:2023 AI management systems (ISO)(the publisher's own terms; quoted for reporting and comment)
- ISO 19011:2018 guidelines for auditing management systems (ISO)(the publisher's own terms; quoted for reporting and comment)
- ISO/IEC 17021-1:2015 requirements for certification bodies (ISO)(the publisher's own terms; quoted for reporting and comment)
- PCI Security Standards Council - PCI DSS(the publisher's own terms; quoted for reporting and comment)
- PCI SSC document library(the publisher's own terms; quoted for reporting and comment)
- HHS OCR HIPAA audit protocol(the publisher's own terms; quoted for reporting and comment)
- HHS OCR HIPAA audit programme(the publisher's own terms; quoted for reporting and comment)
- HHS summary of the HIPAA Security Rule(the publisher's own terms; quoted for reporting and comment)
- AICPA SOC suite of services (SOC 1, SOC 2, SOC 3)(the publisher's own terms; quoted for reporting and comment)
- OSHA 29 CFR 1910.119 process safety management(the publisher's own terms; quoted for reporting and comment)
- OSHA PSM compliance directive CPL 02-02-045(the publisher's own terms; quoted for reporting and comment)
- eCFR 29 CFR 1910.119 (authoritative text)(the publisher's own terms; quoted for reporting and comment)
- HSE HSG65 managing for health and safety(the publisher's own terms; quoted for reporting and comment)
- HSE managing for health and safety guidance(the publisher's own terms; quoted for reporting and comment)
- ICO data protection audit framework(the publisher's own terms; quoted for reporting and comment)
- ICO audits service(the publisher's own terms; quoted for reporting and comment)
- Regulation (EU) 2016/679 (GDPR) on EUR-Lex(the publisher's own terms; quoted for reporting and comment)
- eCFR 21 CFR Part 211 cGMP for finished pharmaceuticals(the publisher's own terms; quoted for reporting and comment)
- US EPA audit policy (self-disclosure)(the publisher's own terms; quoted for reporting and comment)
- NIST AI Risk Management Framework(the publisher's own terms; quoted for reporting and comment)
- IAF mandatory documents (audit time, certification cycle)(the publisher's own terms; quoted for reporting and comment)
- FDA guidance: quality systems approach to pharmaceutical cGMP(the publisher's own terms; quoted for reporting and comment)
- FDA Food Safety Modernization Act(the publisher's own terms; quoted for reporting and comment)
- iso.org(the publisher's own terms; quoted for reporting and comment)
Cite or embed this figure
Cite or embed this figure
The Audit Framework Requirements carries 6 published figures read from 3 sources' own pages, from 21 to 90 day, read 16 October 2026.
3 of the 27 named sources read in full publish a figure; 24 publish none, read 16 October 2026.
Audit Framework Requirements, obligation HIPAA: median 60 day across 1 source, read 16 October 2026.
Audit Framework Requirements, obligation HIPAA: median 6 year across 1 source, read 16 October 2026.
Audit Framework Requirements, obligation HIPAA: median 12 month across 1 source, read 16 October 2026.
Audit Framework Requirements, obligation EPA: median 21 day across 1 source, read 16 October 2026.
Audit Framework Requirements, obligation cGMP: median 3 year across 1 source, read 16 October 2026.
Cite as: "Capanix Audit Framework Requirements", updated 2026-10-18, https://capanix.com/datasets/audit-framework-requirements/.
Download the CSV (9 rows, computed 2026-10-18)