Auditor guide

Use VeriProof to review evidence for the applications, period, and engagement you are authorized to access.

Auditor access is read-only. Record requests, findings, and conclusions through the approved engagement process.

Confirm scope

Before reviewing evidence, confirm:

the engagement and framework;
the applications and environments;
the start and end dates;
the evidence population and sampling method;
known exclusions; and
the people authorized to receive exported records.

Review a record

Open the application and session in scope.
Check the captured steps, decisions, policy results, and provenance.
Distinguish declared values from derived values.
Note missing or partial evidence.
Link the record to the applicable control or finding.

Content appears only when the integration captured it and your engagement permits access.

Review measures

Before interpreting a measure, check its definition, application profile, dates, filters, and source coverage. A high score alone does not establish compliance.

The underlying records help distinguish a change in application behavior from a change in policy results or evidence coverage.

Verify an evidence pack

Use the public verifier with the exported pack and a separately trusted evidence-signing public key. Follow verifier installation and key verification before running this command:


veriproof-verify --pack evidence-pack.zip --trusted-evidence-public-key evidence-signing-public.pem

The verifier checks the manifest and the configured provider’s proof. Read its result to determine whether the exported content matches the recorded commitments.

A successful integrity check does not prove that the captured data was complete, accurate, lawful, or compliant.

Record findings

For each finding, state:

the requirement or control;
the evidence reviewed;
the affected scope and period;
the observed condition;
the conclusion and rationale; and
any missing evidence or follow-up request.