Audit engagements
Define the period and applications an auditor needs to review. An engagement keeps that scope together with its available records. The page also lists closed engagements.
Create and attest an engagement
Confirm no other engagement is active
Only one engagement can be active for the organization. Check whether the current review has ended before deactivating it to start another.
Define the scope
Name the engagement, set its review dates, and select the applications included in the audit. Use a name that identifies the audit or review period.
Review before activation
Confirm the dates and application list with the audit owner. After activation, open the engagement records to verify that the intended work is in scope.
Share read-only access
An Administrator or Compliance Officer can create a time-limited guest link. Select only the data the recipient needs: session records, annotations, governance measures, compliance reports, or evidence packages. Set an expiration from 1 to 30 days.
Copy the share URL when it appears and send it through an approved private channel. Do not publish it or include it in a shared document with a wider audience.
An engagement or guest link can expose sensitive session and governance records. Confirm the recipient, scope, and expiration before sharing it.
Deactivate an engagement
Deactivate the active engagement when the review ends. It remains in Past Engagements with its dates, application scope, and history. Deactivation does not delete the underlying records.
Auditor verification
An assigned Auditor can review the engagement, export evidence when permitted, and verify a submitted compliance snapshot. Verification records the Auditor, role, time, and scope checksum without changing the snapshot.
Auditors cannot create, edit, close, or share engagements. They cannot create or update findings and attestations. Access remains limited to assigned engagements and applications.
One person can prepare the engagement under an Administrator or Compliance Officer role, then switch to Auditor and verify it. The evidence records both actions and the role used for each action. This role switch does not establish independent review.