An audit system includes business processes that describe the operations of an enterprise, risks associated with the set of business processes that describe the dangers arising from the set of business processes, and risk controls associated with the risks that are intended to mitigate the effects of the risks. An audit manager can create an audit project from an audit project template derived from the business processes, the risks, and the risk controls. The audit manager can display the associations between the business processes, the risks, and the risk controls. A set of workflow-enabled applications are adapted to implement the business processes and the risk controls. A set of process procedures associated with the business processes provides documentation to employees assigned to perform the business processes. The set of process procedures also provide auditors with documentation on auditing the business processes.