Auditor workspace

An audit workspace, not a shared drive

Create an audit for a framework, a type and a period. Requests are generated from your controls, the auditor works in their own scoped login, and everything they need downloads as one package.

Frameworks Monitoring Integrations People & devices Policies Vendors & risk Access reviews Audits SOC 1 Trust Center AI questionnaires Consultancies

The engagement

Framework, type, period, firm

An audit is a Type 1, Type 2, certification, surveillance, internal or readiness engagement for one framework. A Type 2 needs its observation period. Requests, populations, findings and the auditor’s access all belong to it.

The control matrix lists every control in scope with the criteria it addresses, its test procedure, its health and how much evidence falls inside the period.

Requests

The PBC list, generated from the controls

One request per in-scope control, asking for the evidence that control’s guidance names, assigned to its owner. The team attaches evidence (the request moves to submitted); the auditor accepts it or comments, which moves it to needs info. Only the team attaches evidence; only the auditor or a compliance manager accepts.

Evidence requests (the PBC list): 102 requests generated from the controls, REQ-001 AST-01 Asset inventory through REQ-013 CHG-03, each with its control, status, assignee, due date Dec 12, 2026 and evidence count. — The provided-by-client list, generated from the controls in scope rather than typed from a spreadsheet. Each request asks for the evidence its control’s guidance names.

Populations and samples

Type 2 sampling an auditor can reproduce

The auditor builds a population from new hires, terminations, merged changes, completed access reviews, security incidents, vendors onboarded in the period, or a CSV they provide. Samples are drawn at random with a seed recorded on the audit, or chosen by the auditor, and each sampled item becomes its own request.

Population size	Default sample
1–2	all
3–4	2
5–12	3
13–52	up to 10
53–250	25
more than 250	40

Populations & samples: the ‘Merged changes’ population of 43 items with 10 sampled (northwind/data-pipelines#130, northwind/infrastructure#124, northwind/mobile-app#142, northwind/internal-tools#133…), each sample with its own open request. — Type 2 testing: the full population of merged changes in the period, then a recorded random sample. The draw uses a seed stored on the audit, so it can be reproduced, and each sampled change becomes its own request.

Findings and the package

Deviations tracked, everything in one zip

A finding (observation, deficiency, significant deficiency, material weakness, or an ISO minor or major nonconformity) gets management’s response and a remediation date, and opens an issue so the fix is tracked with the rest of the program.

Download package gives a zip with the control matrix, every request with its evidence files, each population with the sampled items marked, the findings and the system description.

Audit findings: one finding ‘Changes merged without independent approval’ on control CHG-02, severity Deficiency, status Open, management response Awaiting, remediate by Dec 13, 2026. — A deviation found in the sample becomes a finding with a severity, management’s response and a remediation date, and an issue that tracks the fix.

Auditor access

What an invited auditor can and cannot see

	Auditor (invited to this audit)
Audits	Only the ones they were invited to; another audit’s id answers 404
Evidence	Only evidence attached to a request of their audit
Controls, people, vendors, settings	Not visible: the console’s other screens refuse them
Requests	Comment, accept, or ask for more
Populations and samples	Create and draw
Findings	Record; management writes the response
Invitation	A new account with the auditor role and a one-time password, or an existing account given the role

How it works

A request from generation to acceptance

The same seed and population draw the same sample again.

Questions it answers

What you can find out

Each one is answered on a screen you can open, and most can be typed into Ask Assure as they are.

What is still open for the auditor?Requests filtered to open and needs info

Which controls have no evidence in the period?The control matrix’s evidence column

Which changes were sampled?Populations & samples

What did the auditor find?Findings with management’s response

Who from the firm can see this audit?The Auditors tab

Give the auditor everythingDownload package

Outcomes

What teams do with it

Fieldwork in weeks, not months

Requests exist the day the audit does.

Samples nobody argues about

Drawn with a recorded seed, reproducible.

Findings fixed, not filed

Each one is an issue with a date.

Where it stops. InsightAssure prepares the program and the evidence; the opinion is the CPA firm’s, and InsightAssure never issues a report. Sample sizes follow common guidance by population size and can be overridden by the auditor.

SOC 1 Frameworks & controls For consultancies Blog: inside a Type 2 audit