Guides by role
Auditor guide
Read the programme without changing it: where to find scope, evidence, decisions and the log, and how to recount the pack.
Role: Auditor The role is read-only across all domains, people files and the audit log included, and gives the right to export what an audit pack holds (statement, controls, risks, policies, internal audits, external audit, log). It changes none of the app's registers; the only thing it writes is its answers to the external audit's requests. It sees neither settings nor role management.
Good to know
The role is dated: the administrator grants it from Settings › Access, with a mandatory end date (366 days at most). Once the date has passed, it gives no right any more. While it is active, a banner at the top of the screens reminds you: "Auditor access until …: read-only, audit pack export. Each time you open the pack it is entered in the log." Each opening of the audit pack (yours, like anyone else's who is allowed) indeed leaves an "Audit pack opened" line in the log: who, when, nothing else.
If the same person also holds a role that edits (a domain manager, for example), the banner no longer says "read-only" but "reads everything and exports the audit pack, on top of your other roles".
Where to look
| You are looking for | Screen | What you find |
|---|---|---|
| Scope and applicability | Statement of applicability | Justifications, computed state, sealed approved version |
| From control to evidence | Controls, Evidence | State, dated evidence, tests, linked risks |
| The internal audit programme | Audits | Programme of the year, checklists, findings, management review |
| Access reviews | Access reviews | Scope, reviewers, decisions and dates |
| Who did what, when | Audit log | A chain of events whose integrity can be checked |
| Everything, recountable outside the app | Audit pack | Zip, CSV, report, SHA-256 fingerprint manifest (Advanced edition) |
Recounting the pack
- Extract the audit pack zip.
- Open
LISEZMOI.txt: it gives the command to re-check each file's fingerprint. - Compare with
manifeste.json. The manifest's own fingerprint is recorded in the log ("Audit pack generated"). - Read the manifest: if the log check found tampering, it says so.
What the app does not do
- It changes nothing you audit, and certifies nothing: a readiness score is not an audit conclusion.
- The evidence files themselves are not in the zip: it gives their name, size and fingerprint.
- The pack's sections are read one after another: it is not a single snapshot.
Was this page helpful?