Skip to main content
Xoxoday Empuls conducts formal annual internal ISMS audits aligned with ISO 27001 and SOC 2 requirements, classifying all findings and tracking corrective actions to closure with no unresolved material IT risks on record.
Xoxoday Empuls maintains a structured internal security audit program as part of its ISO 27001–aligned Information Security Management System (ISMS). This program governs how security controls are assessed, documented, and continuously improved across all services and delivery projects — including those supporting employee recognition, rewards, and engagement workflows. Annual Audit Program Internal ISMS audits are conducted at least once per year. Each audit cycle assesses whether security controls, processes, and procedures are effectively implemented, actively maintained, and performing as expected. The audit calendar is approved by senior management and covers both delivery projects and shared services. The Chief Information Security Officer (CISO) leads the planning and maintenance of the audit program alongside the dedicated information security team. This structure ensures clear accountability and impartiality in how audit criteria and scope are defined. How Audits Are Executed A cross-functional internal audit team conducts each audit according to the approved schedule. Auditors review evidence, document findings, and issue formal audit reports accompanied by management responses. Findings are classified into three categories — praises, observations, or non-conformances — providing a graduated view of security posture rather than a binary pass/fail outcome. Corrective and preventive actions arising from non-conformances are tracked to closure in a dedicated audit log. Consolidated reports and supporting evidence are retained in a shared repository, giving your organisation a clear and auditable trail. Metrics and Continuous Improvement Xoxoday Empuls tracks metrics including the number of audits completed, the volume and type of findings, and any identified gaps and their potential impact. These metrics feed directly into management reviews and drive continual improvement across the ISMS, consistent with the requirements of ISO 27001 and SOC 2 Type II. For organisations running Xoxoday Empuls alongside HR systems such as Workday, SAP SuccessFactors, or Darwinbox, this audit discipline confirms that security controls extend into the integrations and data flows connecting those platforms — not just the core application. Current Risk Posture The internal audit procedure was most recently reviewed in May 2024, confirming it remains current and aligned with both ISO 27001 and SOC requirements. No unresolved or material IT risks affecting Xoxoday Empuls are currently open. Issues identified during internal audits are managed through a formal corrective action process and followed up in subsequent audit cycles and management reviews, ensuring nothing falls through the gaps between review periods. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](

Is Empuls ISO 27001 certified for information security?

Understand how Xoxoday Empuls structures its Information Security Management System and what the ISO 27001 certification covers.

Vendor certifications (ISO 27001, SOC 2 Type 2 report)

Learn about Xoxoday Empuls’s SOC 2 Type II audit history, report availability, and what controls are evaluated.