Auditor Access

Set up an audit, invite your external auditors with scoped, time-boxed access, and work through their reviews and evidence requests, without adding them as full team members.

Overview

When it's time for an audit, you don't have to hand an auditor a full account or email evidence around. Set up an audit in Concord, invite the firm's auditors into it, and they work in their own Auditor Portal: they see only the frameworks in that audit, record their review of each control, comment, and request evidence. Access is time-boxed, and you can revoke it at any time.

An invited auditor has no standing access to anything else in your organization, so adding one never exposes the rest of your account.

Auditor access comes with the frameworks add-on. See Adopting Frameworks to set that up first.

Setting Up an Audit

Go to Data Hub → Controls & Audits → Audits and choose Add Audit. An audit records:

The audit firm
The frameworks being audited (one or more)
The audit period

The Audits tab shows each audit with its frameworks, period, status, auditors, and open evidence requests.

Inviting an Auditor

Owners and Admins can invite auditors. Choose Invite Auditor from the audit, or from the Auditors tab.

Choose the Audit, if it isn't already selected.
Enter the auditor's Email.
Choose their Permissions: View Documents and Comment.
Set when access Expires. It defaults to 90 days from today.
Choose Send Invite.

The auditor receives an email invite to sign in, and lands in the Auditor Portal for that audit.

What the Auditor Sees

In the Auditor Portal, the auditor sees the Controls and Requirements in the audit's scope. Opening a control shows:

Review: their own review of the control, with a status of Not Reviewed, In Review, Accepted, Needs More Info, or Exception, and a discussion thread shared with your team. Their review is separate from your control's own status.
Evidence: the evidence attached to the control.
Tests: the control's tests and results.
Requirements: the framework requirements the control maps to.

The auditor's access is read-only. They can review, comment, and request evidence, but can't change controls, evidence, or settings.

Evidence Requests

When an auditor needs more, they choose Request Evidence on a control's Evidence tab and describe what they need. The request becomes a task on that control's Tasks tab for your team to work, and open requests show on the audit. Once you attach the evidence, it appears under the request for the auditor.

Managing and Revoking Access

Manage auditors on the Auditors tab:

Edit access to change an auditor's audit, permissions, or expiry date, including extending or shortening their access.
Revoke access to end it immediately.
Reinstate access to restore a revoked auditor, with a new 90-day expiry.

When the expiry date passes, access closes on its own. There's no separate cleanup step.

Next Steps

Adopting Frameworks: adopt the frameworks the audit covers.
Controls and Evidence: the controls and evidence the auditor reviews.