Share with an auditor
Reports → Share with an auditor is the one place to give an auditor what they need. Only an organization administrator opens it, and it comes with a paid plan. There are three ways, and an engagement often uses all of them:
An auditor account
For an engagement that runs over weeks. Invite your auditor as a member with the Auditor role (Settings → Team), then grant them access here: the whole organization or one assessment, for as long as you choose (up to a year), and what they can read:
- Systems, AI models and cards, with their datasets and requests
- Assessments and Statements of Applicability
- Findings and the corrective action plan
- Evidence
- Policies and their framework coverage
- The risk register and risk analyses
- Incidents and breach notifications, with the devices each incident involved (name, kind, status and encryption, never the device register itself) and the devices as they stood at each breach decision
An auditor with any active grant can also read your training records, vendors and their agreements, access reviews, system changes and management reviews, where those modules are on, and your agreements with Backsplice (the DPA and the BAA). Systems, policies, the risk register and these records are organization-wide, so a grant limited to one assessment still shows them whole. Everything is read-only: the Auditor role can change nothing. Their sidebar and their Reports page show the areas you granted, plus the program records any engagement reads. Each page of your records they open is recorded in your audit log, and so is every view of a record that may hold protected health information. Expiry is enforced on every request; Renew extends a grant and Revoke ends it at once.
Where you run both a HIPAA program and an AI governance program, a grant to the entire organization shows the records of both. To share one program's assessment, grant that assessment: the assessments, Statements of Applicability, findings and evidence the auditor reads are then limited to it, while systems, policies, the risk register and the records any grant reads still show both programs.
Incidents can name people and describe their health information, so they are offered to auditor accounts only, never to a link, and only with access across the organization.
A read-only link
No account needed. A link opens a read-only portal for one assessment, or for the whole organization, for the days you choose. Anyone holding the link can read what it covers, so send it only to the auditor, and revoke it when the work is done. The link is shown once, when you create it.
A link opens assessments, findings, evidence, policies and the risk register. Systems are shared with auditor accounts only, as incidents are, never through a link.
A package to hand over
- Auditor packet: a time-stamped ZIP of findings, policies, the risk register, evidence and, with the calendar on, the compliance activities (see Auditor packet).
- Corrective action plan: the open findings you choose, with their tasks, owners and dates.
- HHS OCR audit package: what an HHS Office for Civil Rights investigator commonly asks for, with a link to each record (offered with a HIPAA assessment).
- A signed assessment report: open a completed assessment's report to sign and export it. A system that uses AI also has its technical documentation package (EU AI Act Annex IV) on the system's page.