Reporting and audit trail
A tamper-evident activity log, and the records your reviews and auditors need
Changes, approvals and evidence uploads are written to a tamper-evident activity log. When the board, an auditor or a regulator asks what happened, you answer from the record in Certifyi instead of a spreadsheet someone last updated three weeks ago.
In short
Actions across your workspace are written to one tamper-evident activity log, which you can search and export.
How the activity log works
Creating a control, uploading evidence, changing a risk score and approving a policy each write an entry to the activity log. The entries form a chain, each linked to the one before it by a hash, so an edit made after the fact can be detected.
You can search the log by module, user, date range and action type, and export it as CSV or PDF for an auditor or regulator. When an auditor asks who changed a control and when, you search the log and show them the entry.
- Entries from compliance, risk, incidents, vendors, assets and personnel
- Each entry records the user, the time, the action and the record affected
- Search and filter on any combination of fields
- Export as CSV or PDF
Reporting from your records
A board or regulator report is only as good as the figures behind it. Take them from the records your team works in, such as the risk register, open incidents and vendor assessments, rather than copying numbers from dashboards into slides.
Keep each report you send with the date it was produced, so you can show later what the board was told and when.
- Sections
- Framework posture, risk register summary, incident figures, vendor compliance and asset inventory.
- Charts and tables
- Taken from the data on the day the report is produced, such as a risk heatmap and compliance status by framework.
- Commentary
- Free-text sections for context, interpretation and recommendations.
The reports most teams produce
Most GRC teams produce the same few reports again and again. The table sets out who each one is for and what it usually contains.
| Template | Audience | What it contains |
|---|---|---|
| Board report | Board or audit committee | Compliance posture, top risks, open incidents, vendor exposure and key metrics |
| Management review | ISMS owner or CISO | The ISO 27001 clause 9.3 inputs, including audit results, corrective actions, risk treatment status and improvement opportunities |
| Audit committee | Internal audit function | Audit programme status, open findings and overdue actions |
| Regulator | Regulatory body | Compliance status by framework and evidence summaries |
Setting a reporting rhythm
Board and management reports usually follow a fixed rhythm, often monthly for management and quarterly for the board or audit committee. Agree the cycle, the recipients and who signs a report off before it goes out, and keep each version that was sent.
- Cycle: monthly, quarterly or in line with board meetings
- Recipients: the board, the audit committee, management or a regulator
- Sign-off: who reviews and approves a report before it is sent
- Record: each version sent, with the date it went out
Giving auditors the evidence
An external auditor needs evidence, not a tour of your dashboards. The evidence register links each item to the controls and frameworks it supports, and an auditor can be given scoped, read-only access to exactly the evidence their engagement covers.
Management reviews
ISO 27001 clause 9.3 requires top management to review the ISMS at planned intervals. Certifyi records each review: the agenda, who attended, the decisions made and the actions agreed, with each step in the activity log.
The template lists the inputs the clause names, such as the status of earlier actions, changes in internal and external issues, audit results, nonconformities and corrective actions, risk treatment status and opportunities for improvement.
Following findings through to closure
Audit findings, lessons from incidents and actions from management reviews all need the same things: a severity, a root cause, a corrective action, an owner and a due date. Close each one with evidence that the fix worked.
| Finding | Source | Severity | Owner | Status |
|---|---|---|---|---|
| Backup test not conducted in Q2 | Internal audit | Medium | J. Rivera | In progress |
| MFA not enforced for admin accounts | External audit | High | L. Chen | Closed |
| Vendor SOC report expired | Management review | Low | A. Osei | Open |
| Incident response playbook gap | Post-incident review | Medium | M. Patel | In progress |
Findings from audits, incidents and reviews, each with a severity, an owner and a status. Example data, not a customer record.
What it covers
The activity log and the records behind it sit in the same workspace your team already works in.
-
Current figures
The risk register, incidents and vendor records show the current position, not a slide deck someone updates by hand.
-
Tamper-evident activity log
Change an old entry and the chain no longer checks out, so edits made later can be detected.
-
Findings in one list
Findings from audits, incidents and management reviews, each with a severity, owner and due date.
-
Auditor access
Auditors open their engagement with scoped, read-only access to its evidence, so nobody has to email zip files.
-
Management reviews
Agenda, attendees, decisions and actions for each ISO 27001 clause 9.3 review.
Related modules
Actions in these modules are recorded in the activity log.
How Certifyi helps
How Certifyi handles reporting and the activity log
One activity log to answer who did what and when.
-
Tamper-evident activity log
Searchable and exportable, with each entry chained to the one before it.
-
Auditor and vendor portals
Auditors see the evidence for their own engagement, with scoped, read-only access. Vendors answer questionnaires in the vendor portal instead of by email.
-
Management reviews
ISO 27001 clause 9.3 reviews with an agenda, decisions and tracked actions.
Questions
Reporting and activity log questions
Can our reports follow our own format?
Tell us which reports you produce today and we will show you where the figures for each one sit in Certifyi. The activity log itself can be searched and exported as CSV or PDF.
Can external auditors access the platform directly?
Yes. Each auditor is invited to an engagement and gets scoped, read-only access to the evidence and controls in it, and nothing else in your workspace.
What does tamper-evident mean here?
Each log entry carries a hash that ties it to the entry before, so altering one after the fact breaks the chain. It shows a record is unchanged since it was written, not that its content was true.
Can I schedule reports to go out automatically?
Not as a built-in schedule today. Agree the cycle first: many teams report monthly to management and quarterly to the board, with a sign-off step before anything goes out, and prepare each report from the records in Certifyi when it is due.
Does the management review template follow ISO 27001?
It lists the inputs clause 9.3 names: the status of earlier actions, changes in internal and external issues, feedback on performance including audit results and corrective actions, risk treatment status and opportunities for improvement. Your auditor still judges whether the review itself was adequate.
See the activity log behind your next audit
Book a walkthrough and we will follow a control change through the tamper-evident activity log with you, from who made it to when.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them