Auditor room and export
The external half of the engagement: your auditor works in a portal of their own — separate sign-in, separate world, scoped to exactly one engagement at a time — and the engagement ends with evidence frozen and exported as a package you can stand behind later.
Invite the auditor
In the expanded engagement panel, the External Auditor Access section has one button that matters: Invite to Portal. Enter the auditor's email (name and firm optional) and send. They receive an invitation email, set up their own portal account with its own password — and optionally two-factor authentication — and sign in at the auditor portal. The invitation expires after 14 days. If the email cannot be sent, the dialog shows a link you can copy and send yourself.
The auditor portal is part of the Enterprise plan. On other plans the invite dialog explains this and links to Billing; you can still run the engagement and record the auditor's decisions yourself with Change Status.
The section then lists every portal auditor on the engagement, with their firm, last sign-in, and a two-factor indicator. Revoke cuts an auditor's access to this audit immediately; if the same person audits you on other engagements, those are unaffected.
Portal access is a real authenticated account per auditor, invited per engagement. The old style of emailing an access link around is retired — a link that anyone can forward is not a defensible access record.
What the auditor sees — and doesn't
The portal holds one engagement at a time, in five areas:
- Overview — the engagement summary and its numbers.
- Evidence review — the request queue, with filters such as Ready for review, Waiting on evidence, and Overdue. Per request the auditor sees the attached evidence, marks which sample items each file answers, discusses it with you, and accepts or rejects it once it is submitted. They can also raise new evidence requests of their own — title, category, control reference, priority, due date — so fieldwork follow-ups land in your queue instead of your inbox.
- Audit program — the auditor's workpapers, each with a test conclusion, the evidence it cites, and a sign-off.
- Closeout — delivery records built from signed-off workpapers.
- Finding follow-ups — findings the auditor is tracking, with a status, an owner, and a due date.
You see the workpapers, delivery records, and follow-ups read-only, in the expanded engagement panel.
What they do not get is your workspace. No modules, no registers, no documents beyond what was attached to their requests. An auditor with several clients on SolveGRC sees one engagement at a time and switches explicitly; nothing bleeds across organizations or across audits.
Every download an auditor takes passes a release gate. Evidence must have been sealed for external release by your side. Files that arrived through a vendor submission also stay blocked while their malware scan is pending, or if the scan flagged them. The auditor can see that a file is attached even when they cannot download it. The consequence for your team: if an auditor reports a file they cannot download, seal it (or wait out the scan) rather than looking for a workaround.
What auditors do in the portal is recorded. The Auditor activity panel lists the latest portal actions across all your audits, not just this one, and can check that the record has not been altered.
Freeze the evidence
When collection is done and the auditor is forming conclusions, use Freeze Evidence in the engagement panel. Freezing locks every evidence request — no uploads, edits, or status changes on your side, and reviews, comments, and new requests pause on the auditor's side, where a banner tells them the audit is frozen. A lock icon marks the frozen audit in your table.
The point is defensibility: the auditor's opinion is about a fixed body of evidence, and the freeze guarantees that body did not shift after the fact.
Unfreeze requires a written reason, and the record keeps who froze, who unfroze, and why — so even the exception is provable.
Export a defensible package
The Evidence Packages section turns the collected evidence into an artifact:
- New Package snapshots every file attached to the audit into a named package, with an integrity hash. It includes files on requests that were not accepted.
- CSV exports the package manifest — the itemized record of what was in the package.
- Files opens each evidence file in its own browser tab, so allow pop-ups for SolveGRC first.
A new package is finalized at once. It is marked exported, with who and when, the first time someone uses CSV or Files. Trace shows the chain captured when the package was made: each request reference, its business unit, the file that answered it, and the review decision and date. A package cannot be deleted while the audit is frozen.
SolveGRC does not require a freeze before packaging, but freeze first and package after every request is accepted. A package cut from frozen evidence, with its manifest, is your record of every file attached to the audit at that moment — the answer when someone asks, this year or three years from now, what the auditor had in front of them. Packages are internal exports: the auditor works from the portal, not from the package.
That is the full engagement: created and scoped, evidence collected against requests, reviewed by the auditor in their own portal, then frozen and exported. Start again at the Overview for the map, or see Reuse and packs for how the same evidence serves customers outside a formal audit.