Auditor workspace
Give your external auditor their own workspace
External auditors log into a time-limited workspace that shows only the evidence, controls and findings in their engagement. They can propose findings there too, so nothing is passed around by email or shared drive.
How it works
Inviting an external auditor creates credentials for a portal set up for that engagement. Inside it they see the evidence, controls and findings within the scope you set, and nothing outside it. Access is time-limited and read only by default; if you choose, the auditor can also propose findings there.
Scoping
Access scoped to each engagement
Each engagement has a defined scope: the frameworks, the controls and the time period. The auditor sees what falls inside it and nothing else.
When the engagement ends, access is revoked automatically, so there are no leftover permissions to clean up.
- Access scoped by framework or by control for each engagement
- Time-limited credentials that are revoked automatically
- Read only by default, with optional access to propose findings
- A separate workspace for each auditor or audit firm
Evidence
Evidence with a history
The question an auditor cares about is whether a record changed after it was submitted. Every action on the evidence they see is written to a tamper-evident activity log, and each entry is linked to the previous one by a hash, so an edit made later breaks the chain and can be detected.
That shows a record has not changed since it was written. Whether the evidence was accurate is still for the auditor to judge.
- Tamper-evident activity log behind every record
- Who attached each item, and when
Findings
Findings proposed in the portal
Auditors can propose findings in the portal, each with a severity, a description and the controls affected. Your compliance team reviews each proposal and accepts or disputes it in the same system.
Findings stay in one place, instead of drifting apart across email threads and Word documents.
- Auditor-proposed findings with severity and scope
- Review by your compliance team, who accept or dispute each one
- Tracking through corrective action to closure
- A full audit trail for each finding
Recommended modules
The auditor portal is part of the compliance and audit module. Evidence, controls and findings come from the same workspace your team uses every day.
Questions
Auditor workspace questions
Do auditors need a Certifyi licence?
No. Auditors receive portal credentials scoped to their engagement. They do not need a full platform licence.
Can I have multiple auditor engagements?
Yes. Each engagement is scoped separately. You can run an ISO 27001 external audit and an internal SOC 2 readiness review at the same time, with each auditor seeing different evidence.
What happens when the engagement ends?
Access is revoked automatically when the engagement period ends. You can also revoke it yourself at any time.
Can auditors export evidence?
Auditors view evidence and its history within the portal. Ask us how export works for your engagement.
Run your next audit through the portal.
Book a demo, and invite your audit firm to join if you like. You will see an engagement set up with scoped, read-only access to the evidence for that engagement, and findings proposed and answered in the same place.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them