ISMS & Risk

Auditor workspace

Between full access and a folder of PDFs

Today auditors get either a full user account or a folder of PDFs. The account gives too much, the folder hands the evidence over for good. The auditor workspace is the path in between: an access with a start, a hard end and a named auditor, without a user account and without write rights. The auditor opens a link that is shown nowhere in the interface and receives a six-digit one-time code at the registered address. The workspace shows a frozen audit state with the released areas, a request list with documents and questions, and at the end a sealed handover record.

ISO 27001TISAXBSIGDORAPCI DSS
Features

Your benefits

1

Revocation takes effect immediately, even mid-session

The access has a hard end. Expiry or revocation close the workspace immediately, and every call, including the refused ones, is in the log. The auditor sees content only once the scope is set, and only the areas that were released.

2

Page images with watermark, original only on decision

When attaching a document you decide per document whether the auditor sees only watermarked page images or may download the original file. The default is the page image. The evidence stays in-house while the review is still complete.

3

The request list is the thread

What the auditor wants to see is a list, created or imported as CSV. Each request carries DMS documents, released areas or a reason why there is no document. The auditor accepts or asks for more; questions reach the responsible person, internal notes stay internal.

Capabilities

All capabilities at a glance

  • Workspace per audit with audit type, auditor, language, time window; draft without link until access is issued
  • Two-part token by e-mail plus six-digit one-time code, no user account
  • Scope from a frozen audit state, all or selected areas; live data only for open findings and approved exceptions
  • Request list with CSV import, documents from the DMS, reason where no document exists
  • Watermarked page images by default, original download releasable per document
  • Questions on the thread with notification of the responsible person, internal notes kept apart
  • Immutable access log, refused accesses included, every release and every withdrawal
  • Sealed handover record as PDF with the auditor’s confirmation of receipt
  • For ISO 27001 stage 1 and surveillance audits, TISAX AL 2, Section 39 BSIG, DORA Art. 30, PCI DSS, IDW PS 951 and customer audits
Result

The auditor sees exactly what belongs to the audit, for exactly as long as the audit lasts, and you can evidence every look.

Experience Auditor workspace live

Schedule a no-obligation demo – we will show you the module with your own use cases.