Managing compliance in a healthcare SaaS organization: Internal and external audit practices at Therap

Abstract

This report mainly examines how compliance functions and audit activities are performed at Therap (BD) Ltd., a healthcare SaaS company that deals with sensitive health related information. I did this on my internship between November 2025 and April 2026, where I was working on audit prep, evidence validation, document review, training compliance tracking, aiding with vendor risk, and answering auditors. The report examines how such tasks create actual governance in a regulated technological sector, rather than viewing compliance as a formality. The investigation follows a qualitative paradigm methodologically because it has relied on first-hand involvement, systematic observation, and the examination of non-confidential records. The subject of discussion is the interaction of audit processes, documentation procedures, risk management, and controls, which relate to training in a multi-framework setting due to regulatory requirements, including HIPAA, SOC 2, and others. It also reflects on the overall organizational environment of Therap, where secure systems, coordination, and discipline of processes are essential to the day-to-day affairs. The results indicate that Therap maintains a fairly effective compliance environment, with frequent review cycles, centralized documentation procedure, and team interdependence. Simultaneously, the analysis reveals the following real-world issues, such as delays in evidence gathering, the need to manually map similar requirements across frameworks, cross-team dependencies, and time zone coordination. The issues are not indicative of a weak control environment but rather are a mirror of the complications of multi-framework compliance in a real organizational setting. Lastly, audit work at Therap is not lower than what the outside world requires. They contribute to a better system of governance and risk management within the organization, a high level of accountability, disciplined documentation, and continuous improvement. The report suggests enhancing evidence aggregation, implementing AI automation to eliminate redundant activities, formalizing pre-audit activities, specifying response timelines, and improving monitoring through visualization in the form of dashboards, among other measures.