The Compliance and Audit Dashboard in Google Sheets turns a single audit log into four slicer-driven analysis pages: Overview, Audit Findings, Compliance Status and Risk Analysis. It also includes a Search page that pulls up any audit record by its ID.
It is built for internal audit managers, compliance officers, risk leads, QA managers and GRC consultants who track audits across departments, regions and regulations such as SOX, GDPR, HIPAA, ISO 27001, PCI-DSS, SOC 2 and CCPA. Everything runs on native Google Sheets features, so the file can be shared with auditors and reviewers by link.
Below is a page-by-page walkthrough using the real sample figures, the exact metrics and slicers on each page, how the key rates are calculated, and how to load your own audit records.
🎥 Watch the Video Tutorial
Get the Compliance and Audit Dashboard
What Problem Does a Compliance and Audit Dashboard Solve?
Audit work produces a lot of rows: one per audit or finding, each with a type, department, risk level, regulation, owner and status. The hard part is answering management’s questions from those rows:
- How compliant are we overall?
- Where are the critical risks?
- Which findings are overdue?
- Which auditor is carrying the heaviest load?
This dashboard keeps all records in one Data sheet and summarises them on four pages, each with its own slicers. Your audit committee pack always reflects the latest data.
Inside the Compliance and Audit Dashboard in Google Sheets: Page by Page
A navigation bar at the top of every page links to Overview, Audit Findings, Compliance Status, Risk Analysis and Search.
1. Overview
Slicers: Year, Audit Type, Region, Compliance.
Key Metrics (sample values):
- Total Audits: 500
- Open Findings: 162
- Critical Risk: 46
- Compliance Rate: 54.4%
Charts:
- Audits by Type (External, Financial, Internal, IT Security, Operational, Regulatory)
- Compliance Status (doughnut)
- Monthly Audit Volume
- Audits by Department (ten departments, from Compliance to Sales)
- Risk Level by Region (North America, LATAM, EMEA and APAC)
2. Audit Findings
Slicers: Year, Department, Risk Level, Resolution.
Audit Findings Metrics:
- Total Findings: 500
- Closed Rate: 46.2%
- Overdue: 53
- Avg Severity: 4.7
Charts:
- Findings by Audit Type
- Resolution Status (Closed, In Progress, Open, Overdue)
- Average Severity Score by department
- Findings per Auditor (ten auditors, from 40 to 58 findings each)
3. Compliance Status
Slicers: Year, Regulation, Region, Department.
Compliance Metrics:
- Compliant: 272
- Non-Compliant: 81
- Pending Review: 81
- Compliance Rate: 54.4%
Charts:
- Audits by Regulation (CCPA, GDPR, HIPAA, ISO 27001, PCI-DSS, SOC 2, SOX)
- Monthly Compliance Status (stacked Compliant, In Progress and Non-Compliant)
- Department Compliance Breakdown
4. Risk Analysis
Slicers: Year, Audit Type, Department, Region.
Risk Analysis Metrics:
- Critical Risks: 46
- High Risks: 128
- Max Severity: 10
- Avg Severity: 4.7
Charts:
- Risk Level Distribution: Medium 41.2%, High 25.6%, Low 24.0%, Critical 9.2%
- Monthly Risk Trend
- Department Risk Profile
5. Search: Audit Record Lookup
Choose an ID in the Enter Audit ID dropdown and the Audit Details panel lists all 12 fields for that record:
- Audit ID, Audit Date, Audit Type, Department
- Risk Level, Compliance Status, Finding Description, Severity Score
- Auditor, Region, Regulation, Resolution Status
For example, AUD-0001 is a Financial audit of Legal dated Jan 10, 2025. It has Medium risk and is Compliant, with the finding “Training records not updated”. Its severity is 5, the auditor is S. Garcia, the region is EMEA, the regulation is ISO 27001 and its status is Open.
6. Data Sheet
The Data sheet is the single source for every page. Its columns are the 12 lookup fields above plus Month and Year helper columns and a count column. In the sample, many Risk Level, Compliance Status and Resolution Status cells are colour-highlighted, which makes problem rows easier to spot.
Metrics Summary
The four analysis pages carry 16 KPI cards and 15 charts. A few metrics, such as Compliance Rate and Avg Severity, appear on two pages. These are the main metrics and how to read them:
| Metric | Page | What it measures | Sample value | Better when |
|---|---|---|---|---|
| Total Audits / Total Findings | Overview / Audit Findings | Audit records in the current filter | 500 | Context only |
| Compliance Rate | Overview, Compliance Status | Share of audits with status Compliant | 54.4% | Higher |
| Open Findings | Overview | Findings still flagged as open (the card has its own rule, so it is not the same as every non-closed finding) | 162 | Lower |
| Closed Rate | Audit Findings | Share of findings with Resolution Status Closed | 46.2% | Higher |
| Overdue | Audit Findings | Findings with Resolution Status Overdue (10.6% of findings) | 53 | Lower |
| Non-Compliant / Pending Review | Compliance Status | Audits failing, or still awaiting review | 81 / 81 | Lower |
| Critical Risks / High Risks | Risk Analysis (Critical also on Overview) | Audits rated Critical or High risk | 46 / 128 | Lower |
| Avg Severity / Max Severity | Audit Findings, Risk Analysis | Average and highest Severity Score | 4.7 / 10 | Lower |
You can check the rates against the sample yourself:
Compliance Rate = Compliant / Total Audits = 272 / 500 = 54.4%
Critical share = Critical Risks / Total Audits = 46 / 500 = 9.2%The Closed Rate of 46.2% matches the Closed slice of the Resolution Status doughnut.
Google Sheets Dashboard vs. Spreadsheet Tracker vs. GRC Platform
| Need | Plain audit tracker sheet | This dashboard | Enterprise GRC platform |
|---|---|---|---|
| Log audits and findings | Yes | Yes (Data sheet) | Yes |
| KPI cards and charts | Build yourself | Included (16 cards, 15 charts) | Included |
| Slicers by department, region, regulation | Manual filters | Included on every page | Included |
| Record lookup by ID | Manual search | Search page | Included |
| Workflow, approvals, evidence storage | No | No | Yes |
| Field-level permissions and audit trail | No | Google Sheets sharing only | Yes |
| Setup effort | High | Paste your data | Formal implementation project |
How to Use It With Your Own Data
- Save your copy. After purchase, use the Google Sheets link in the included guide to save an editable copy to your Drive.
- Match the columns. Line up your audit log with the Data sheet columns (Audit ID through Resolution Status) and keep the headers unchanged.
- Standardise categories. Use one spelling for each Risk Level (Critical, High, Medium, Low), Compliance Status, Resolution Status, Regulation, Department and Region.
- Replace the sample rows. Paste your records over the sample data and keep the Month, Year and count helper columns filled for every row.
- Check the totals. On the Overview, Total Audits should equal your row count.
- Share. Give reviewers view access and keep edit access for the people who maintain the Data sheet.
Real-World Use Cases
- Audit committee pack: An internal audit manager opens the Compliance Status page filtered to the current year and walks the committee through results by regulation and department.
- Findings follow-up: A compliance officer filters Audit Findings by Resolution to see overdue items, then checks Findings per Auditor to balance workload.
- Client reporting for consultants: A GRC consultant loads each client’s audit history into a separate copy and uses the Risk Analysis page to show where critical and high risks cluster.
Best Practices
- Protect the headers. Use Data → Protect sheets and ranges on the Data sheet’s header row, because every chart depends on it.
- Use controlled lists. Add data validation dropdowns for Risk Level, statuses and Regulation so “Critical” never becomes “critical”.
- Update weekly. Overdue and Open counts lose their value if statuses are only refreshed at quarter end.
- Write findings consistently. Short, standard Finding Descriptions (for example “Periodic review past due”) make the records easier to group and search.
- Align definitions with recognised frameworks. Use guidance such as the COSO framework and The IIA standards when deciding how to rate risk and severity.
Limitations: Who Should Not Use It
- It is a reporting dashboard, not a GRC workflow tool. There are no approvals, evidence attachments or automated reminders.
- Access control is limited to Google Sheets sharing. There is no field-level security or tamper-evident change log, which some regulated environments require.
- Very large histories (tens of thousands of findings) will slow a Google Sheets file. A database or BI tool fits that scale better.
Related Templates and Guides
If you only need a simple log, start with the Compliance Audit Tracker in Google Sheets or the Internal Audit Checklist. For more analysis, compare the Audit Findings and Risk Analysis Dashboard, the Compliance KPI Scorecard and the Risk Management Dashboard.
For teams that work in Microsoft’s BI stack, there is also a Power BI version: the Compliance and Audit Dashboard in Power BI.
If you want to learn to build slicer-driven dashboards like this yourself, the Excel Pivot Tables & Dashboards course on NextGenTemplates Academy covers the techniques step by step.
Frequently Asked Questions
What does the Compliance and Audit Dashboard in Google Sheets include?
It has four analysis pages (Overview, Audit Findings, Compliance Status, Risk Analysis), a Search page for looking up any audit record by ID, and a Data sheet. The analysis pages hold 16 KPI cards and 15 charts.
Which slicers are on each page?
Overview has Year, Audit Type, Region and Compliance. Audit Findings has Year, Department, Risk Level and Resolution. Compliance Status has Year, Regulation, Region and Department. Risk Analysis has Year, Audit Type, Department and Region.
How is the Compliance Rate calculated?
It is the share of audits with status Compliant. In the sample, 272 of 500 audits are Compliant, which gives 54.4%.
Which regulations can I track?
The sample covers CCPA, GDPR, HIPAA, ISO 27001, PCI-DSS, SOC 2 and SOX. Because Regulation is a normal data column, you can use your own frameworks or internal policies instead.
What does the Audit Record Lookup show?
Pick an Audit ID and it shows 12 fields: Audit ID, Audit Date, Audit Type, Department, Risk Level, Compliance Status, Finding Description, Severity Score, Auditor, Region, Regulation and Resolution Status.
Can it replace a GRC platform?
For reporting and monitoring in small and mid-size teams, often yes. If you need workflow approvals, evidence management, field-level permissions or a tamper-evident audit trail, you still need a dedicated GRC system.
Wrapping Up
The Compliance and Audit Dashboard in Google Sheets gives audit and compliance teams one shareable file for compliance rate, open and overdue findings, auditor workload and risk concentration, all filterable by department, region and regulation. Load your audit log into the Data sheet, check the Overview totals, and use the Compliance Status and Risk Analysis pages in your next committee meeting.
Get the Compliance and Audit Dashboard in Google Sheets
📅 Last updated: October 2026
