Auditor portal
Where an invited external auditor works: every client's audits in one list, the evidence, requests, findings and sign-off.
What it is
The auditor portal is where an external auditor works once a client turns it on. It lists every audit the auditor is invited to, across every client that invited them, with the client named on each. Opening an audit shows its steps, evidence, controls, policies, requests, findings and package, for that audit only. The portal has no sidebar, no client settings and nothing else of the client's organization.
Where to find it
Your auditsAn auditor lands here after accepting an invitation, and is sent here from anywhere else in the app once their client has the portal.
Key actions
Review evidence
Evidence lists the audit's evidence with when it was collected, whether it covers the audit period and your decision. Open file downloads an item's file through a link that works for ten minutes; each one opened is recorded on the audit. Accept, flag or mark each item not applicable, and Freeze evidence now when fieldwork starts.
Assess controls
Controls groups the audit's controls by requirement: ISO 27001 clauses and Annex A, or SOC 2 Trust Services Criteria. By control lists the controls to assess as effective, exception noted or not applicable.
Ask for evidence
Requests → New request asks the client for what you need, with a due date and the requirement it is for. When the client submits, accept it or return it saying what is missing.
Record findings, the outcome and sign off
On the audit's page, Record finding adds a nonconformity, observation or opportunity for improvement (ISO 27001), or an exception or observation (SOC 2). Accept or close each one after the client responds. Record outcome sets the result or opinion with the certificate or report details, and Sign off audit completes it once nothing blocks it.
Download the package
Under Audit package, download any version the client exported. Each lists its SHA-256 and manifest digest to compare with the archive.
Tips and gotchas
A client that requires two-factor authentication asks for it before you open its audits. Turn it on in your account settings and open the audit again.
Invitations go to the address the client entered. If an audit you expect is missing, check that it was sent to an address you sign in with.
Related
Last updated on