Vendor Lock-in
Audit evidence often becomes tied to a specific software platform, making migration difficult and expensive.
Open ecosystem · Vendor-neutral specification
An Open Ecosystem for Audit Data
Audit Fabric is an open, vendor-neutral specification for representing, exchanging, preserving, and verifying audit evidence across any audit domain. It complements existing audit standards rather than replacing them.
Audit standards define how audits are performed.
Audit Fabric defines how audit data is represented, exchanged, and preserved.
Own your audit evidence. Exchange it freely. Verify it independently.
01 / Problem
Audit Data Should Belong to Organizations, Not Applications
Every year, millions of audits are performed across manufacturing, automotive, food, forestry, healthcare, energy, sustainability, and other industries. The methodologies are well established.
The problem is not how audits are conducted.
The problem is how audit evidence is stored, exchanged, and preserved.
Today, audit data is scattered across:
- Proprietary audit platforms
- PDFs
- Spreadsheets
- Emails
- Disconnected databases
- Vendor-specific formats
As a result, organizations often lose portability, interoperability, and long-term ownership of their own audit records.
Fragmented Evidence
Findings, observations, corrective actions, attachments, and supporting evidence are frequently spread across multiple systems and file formats.
Difficult Exchange
Sharing audit data between customers, suppliers, certification bodies, regulators, and internal systems usually requires manual work, document conversion, or loss of structured information.
Limited Reuse
Without a common structure, audit information cannot easily be reused for analytics, automation, AI, reporting, or integration with other systems.
APPAudit Software A
APPAudit Software B
PDFPDFs
XLSExcel
DBInternal Database
The auditing profession already has excellent standards that define how audits should be planned and performed.
What is still missing is a common, open, vendor-neutral way to represent and exchange the resulting audit data. That is the problem Audit Fabric aims to solve.
02 / Vision
One Common Language for Every Audit
Audit Fabric provides an open specification for representing audit evidence in a structured, portable, and technology-neutral format.
Whether an audit follows ISO 9001, IATF 16949, FSC, ISO 14001, ISO 45001, or an organization’s own internal methodology, the resulting audit information can be expressed using the same common model.
Audit Fabric does not standardize the audit process.
It standardizes the representation of audit data.
01
Open by Design
The specification is publicly available and can be implemented by anyone without vendor dependency.
02
Vendor Neutral
No organization owns the format. No software vendor controls its evolution. Organizations remain in control of their own audit data.
03
Human Readable
Audit documents remain understandable by auditors, quality professionals, and compliance teams—not only by software. Open formats such as JSON, YAML, or XML can be used where appropriate.
04
Machine Readable
Applications can validate, exchange, search, analyze, and automate audit information without manual interpretation.
05
Extensible
The core supports industry-specific extensions without breaking compatibility, preserving a common foundation alongside specialized attributes.
06
Evidence First
The specification centers on evidence, observations, findings, corrective actions, and traceability—not on any particular software workflow.
ISO 9001
IATF 16949
FSC
ISO 14001
Internal Audits
SHARED REPRESENTATION
Audit Fabric Specification
Structured · Portable · Technology-neutral
Audit Applications
Reporting Tools
Analytics
AI Systems
Long-term Archives
Regulatory Portals
Different audit standards.
Different software.
One shared language.
Audit Fabric makes audit evidence portable, interoperable, and future-proof.03 / How it works
How Audit Fabric Works
Audit Fabric separates audit data from audit software.
Organizations may continue using their preferred audit tools while representing and exchanging audit information through a common, open specification.
The specification stands on its own. Storage, synchronization, and verification technologies are implementation choices—not requirements of the standard.
-
1
Capture
Conduct audits using any methodology and any software—or even manually.
Audit Fabric does not dictate how audits are performed. -
2
Represent
Convert the audit into an Audit Fabric document using the open specification.
- metadata
- criteria
- findings
- observations
- evidence
- corrective actions
- attachments
- traceability
-
3
Exchange
Share the document between organizations, suppliers, customers, certification bodies, regulators, or software systems.
No proprietary conversion is required when implementations follow the same specification. -
4
Verify
Documents may be digitally signed to prove authenticity and integrity.
Fingerprints may optionally be anchored to a distributed ledger such as IOTA. This does not change the specification.
Specification independent from storage
Works with any implementation
Compatible with existing audit methodologies
Supports digital signatures
Optional cryptographic verification
Long-term preservation of audit evidence
Audit ActivityAny method · Any tool
PORTABLE REPRESENTATIONAudit Fabric Document
ShareOrganizations and systems
ArchiveLong-term preservation
ValidateStructure and signatures
OPTIONAL IMPLEMENTATION LAYERIntegrity VerificationDocument fingerprint · IOTA or other suitable technology
Audit Fabric is designed so that organizations can choose the tools they prefer while maintaining a common, portable representation of their audit evidence.
Implement once.
Exchange everywhere.
Verify independently.
04 / The specification
The Specification
The canonical Audit Fabric contract is published as an OpenAPI 3.1 document. It defines the shared audit types from which language-specific interfaces are generated.
Review the OpenAPI contract
or follow its development in the Audit Fabric SDK repository.
05 / Use cases
Use Cases
This section will illustrate how the specification can support different audit domains without replacing their standards.
Reserved for future domain examples and implementation scenarios.
06 / Open governance
Open Governance
Audit Fabric evolves through public contribution, transparent review, and decisions grounded in technical merit and implementation evidence—not organizational affiliation.
Public by default
Proposals, material discussion, decisions, and rationale remain visible in the project repository.
Consensus first
Maintainers seek reasoned agreement and address substantive objections before using a recorded vote.
Evidence-led
Significant additions are supported by representative scenarios and realistic implementation experience.
Stable core
Shared audit concepts belong in the core; domain- and scheme-specific concepts begin as extensions.
Significant changes follow the Audit Fabric Proposal process.
- Idea
- Draft
- Review
- Accepted
- Implemented
- Final
07 / Developer ecosystem
Developer Ecosystem
The Audit Fabric SDK makes the canonical contract available to application developers as generated Java interfaces and dependency-free TypeScript types.
Java projects can use
org.audit-fabric:audit-fabric-sdk:0.1.1-R1 from Maven Central.
UI developers and other implementers can find TypeScript usage, build instructions, and the OpenAPI contract in the
SDK documentation.
08 / Join the initiative
Join the Initiative
Participation is open to auditors, organizations, standards specialists, software teams, and anyone working to make audit evidence portable and interoperable.
Share domain expertise
Test proposals against real audit practices, standards, regulations, and evidence flows.
Build and validate
Use the OpenAPI contract and SDKs, report implementation experience, and contribute examples.
Improve the model
Open an issue or develop an Audit Fabric Proposal for significant specification changes.