About

An auditor is a person who reviews your evidence for an audit. In ControlMap, an auditor is a user with the Auditor role. They sign in, see only the audits they are given, and review each data request in it. They can't create or edit audits. This article explains how auditors work in ControlMap, how to give one access, and lists audit firms you can look at when you need an outside auditor.

What an auditor sees

After an auditor signs in, ControlMap opens their Audits list straight away. What they get:

• A sidebar titled "Auditor workspace" with one item, Audits. There are no other pages.
• The audits they are assigned to, under the tabs All, Active and Completed, with a Search audits box. There is no Create Audit button.
• Inside an audit, the data requests they have access to. A request that is still "Awaiting Submission" shows "Awaiting evidence submission." instead of its evidence.

Give someone the Auditor role

Auditors have to exist as users before you can add them to an audit.

1. Select the account menu (your company logo and name, top left) › Account Settings › Users.
2. Select Add user.
3. Fill in Email and Full name. Optionally fill in Job title, Department and Sign-in preference.
4. In Role, choose Auditor.
5. Select Invite.

Only Super Admins see Account Settings for a client, along with MSP partner users who are Super Admins or Compliance Managers. Add an Auditor user only when an audit needs one.

Add auditors to an audit

Super Admins, Compliance Managers and users with the Auditor role can all be picked as auditors. Choose the option that fits:

• When you create an audit, use the optional Auditors field.
• On an existing audit, select the row menu › Edit audit › Auditors, then save.
• On one data request, open it and use Properties › Auditors.
• On many data requests at once, tick the rows and use Auditors in the bar that appears.

Send a data request to the auditor

1. Open the audit from Audits, then open the data request.
2. Make sure at least one auditor is assigned. Without one, the button says "Assign an auditor before submitting".
3. Set Status to Completed once the evidence is ready.
4. Select Submit to auditor. The auditor is emailed, and the request's Status changes to With Auditor with Audit status Submitted.

To take a request back, select Withdraw from auditor. The request returns to In Progress with Audit status Awaiting Submission.

Review a data request as an auditor

1. Select Audits, open an audit, then open a data request.
2. Review the request. You can also fill in the Quick evaluation tab.
3. On the Properties tab, set Audit status to Awaiting Submission, Submitted, Accepted, Reviewed or Approved.
4. To return a request to the client, select Send to customer. Its Status becomes In Review and its Audit status becomes Awaiting Submission.

Approved also sets the request's Status to Approved, and it can't be changed after that. Auditors can't edit Owner, Auditors, Class or Category.

Preview what an auditor sees

Super Admins and Compliance Managers can check the auditor's version of an audit without signing in as one. Open the audit and select Preview as auditor. The manager controls are hidden, and the Audit status and Send to customer controls are shown but disabled. It is a read-only look.

Audit firms and assessors

If you need an outside auditor, these firms are a starting point. Check each firm's own website for what it offers, and confirm it fits the framework you are working on:

• SC&H Group: management consulting, audit and tax firm.
• Cobalt: penetration testing platform.
• Accorp Partners: chartered accountants and certified public accountants.
• Prescient Assurance: cybersecurity audit and testing company.
• Accedere: cybersecurity firm covering SOC reports, cloud security and privacy.
• MHM Professional Corporation: Canadian audit firm covering SOC 1, SOC 2 and ISO 27001.
• Resilient IT: a CMMC assessor (C3PAO).