By role · External Auditor
Assessment quality, not logistics.
Two doors lead here. A scoped read-only role for a named account reads compliance, the control library, the documents and the risk register; an invitation code opens the six-tab auditor portal with no platform account at all.
What this replaces
- Weeks of the engagement go to chasing document owners for screenshots.
- A shared drive of evidence with no date on any of it.
- Somebody hands you an admin login because scoping a read-only one was too hard.
What you do here
- 1Read the compliance module end to end.Framework status, cycles, findings and obligations open read-only — the same records the team works, not a copy.Compliance dashboard
- 2Inspect the control library itself.The catalogue opens read-only. You check a control's own record rather than a screenshot pasted into an email.Control library
- 3Trace a risk without touching it.Register, dashboard and the relationship graph are open; treatment plans and the scoring parameters are not.Risk register
- 4Read the reporting tabs your licence covers.Control Assurance, Executive and the rest render read-only; the add-on tabs follow the licence.Reporting
- 5Enter through an invitation code, not a login.The auditor portal is a separate door from the seeded read-only role: a code, an engagement, no platform account.Auditor portal
- 6Pull evidence, raise findings, export the file.Six tabs run the engagement: Overview, Evidence, Findings, Comments, Requests, Export. The request list stops living in email.Auditor portal
What changes
- Two access paths: a scoped read-only account, or an invitation code with no account at all.
- The invitation portal holds six tabs; Requests, Comments and Export replace the status-chasing thread.
- The audit log exports as a file you take away with the working papers.
Read-only accessControl libraryAudit cyclesFindings reviewAudit log exportAuditor portalPBC requests
Where the role stops
This role reads widely and writes nothing. Compliance, the control library, the documents, the register and the reporting tabs open; the invitation portal is the only door that writes.
Works with
- Compliance OfficerMap one control to several frameworks, take the audit cycle from scope to certificate upload, then close each finding against a verify step instead of an opinion.COMPLIANCE
- CISOFour teams, four numbers, one board meeting. Here the board pack, the maturity grade, the budget line and the permission matrix all read off the data your team already works in.STRATEGY
- Risk ManagerSpreadsheet registers miss the connections. Set the scoring methodology once, then let every entry hold the controls, processes, incidents, KRIs and vulnerabilities it actually touches, with treatment plans and formal acceptances on the record.RISK
Ready to move
beyond legacy GRC?
14-day free trial. No credit card. Cloud or on-premises.