From empty workspace to audit-ready
This workflow takes a new SolveGRC workspace to the point where an auditor can review your evidence for one framework, such as SOC 2 or ISO 27001. It crosses four modules: Frameworks, Documents and the Evidence Library, Assessments, and Audits. Each stage below says what to do, how to check it is done, and what it hands to the next stage. The module guides it links to cover each screen in detail.
You are done when the audit's framework readiness meter shows every applicable control with accepted evidence, and the evidence is frozen and packaged.
Before you start
- The framework and the audit. Know which framework you are being audited against, the audit period, and who your auditor is.
- Your core documents. Policies, procedures, your last audit report if you have one, and exports from your systems (access reviews, backup logs, vulnerability scans). Files from a previous GRC tool come in the same way as any other file.
- The plan. Inviting an auditor into the auditor portal requires the Enterprise plan. Without it you can still run every other stage and record the auditor's decisions yourself.
The first time an administrator opens the dashboard, choose Get compliant with a framework. The journey card then walks you through activating a framework, uploading your first documents, and assessing your first controls, which are stages 1 to 3 here. This workflow keeps going past the card, through to the audit.
1. Activate and scope the framework
On the Frameworks page, open the Catalog tab and click Activate on your framework. Check the Activating for callout names the right organization, then confirm. Activation creates an assessment for every control in the framework, and that list is your worklist for stage 3.
Next, record which controls do not apply to you. On the Applicability tab, pick the framework under Active framework, select the controls, and choose a Disposition such as "not applicable" or "scoped out" with a Justification. A decision goes through Create draft, Submit for review, and Approve. Only approved decisions take a control out of the score.
Setting a control's status to Not Applicable on its assessment card does not remove it from the score. The control stays in the count of in-scope controls with no credit, so it lowers your percentage. An approved "not applicable" or "scoped out" disposition is what removes it.
You're done when the framework's score card on the Active Frameworks tab reads "n of m in scope" with your excluded controls counted.
This hands on the list of in-scope controls you need evidence for. In stage 5, the audit generates one request per in-scope control and skips the controls you excluded here.
Details: Activate & scope.
2. Bring your evidence in
On the Documents page, click Upload Document. Each upload takes one file (PDF, Word, Excel, text, images, or Visio, up to 50 MB). Set a Document Type such as Policy or Procedure so the Policies register can find your policies later.
Each file is processed and its status moves to Ready. At that point SolveGRC registers it in the Evidence Library automatically, and the Type & Evidence column shows Registered. You do not need to register uploads by hand. If a document still shows Register, click it to register that document yourself. A file whose content is already registered is not registered twice.
You're done when every file you uploaded shows Ready and Registered. The Evidence status filter set to "Not registered" should show nothing.
This hands on registered evidence items, each with an integrity hash taken at registration. They are what you link to controls in the next stage.
Details: Add & classify.
3. Link evidence and assess each control
On the Assessments page, open the Assessments tab, then the Controls sub-tab, and pick your framework in Select Framework. For each control:
- Link the evidence. On the control card, click "Click to link evidence or drag here". In Link Evidence to Control, pick an existing item under Pick existing, or upload a file under Upload new. Set the evidence strength from Weak to Definitive. You can also drop a file straight onto the card. To link one item to several controls at once, use Link to Control from the row menu on the Evidence tab.
- Set the status. Linking evidence does not change a control's status. After a link, SolveGRC re-assesses the control with AI and the card shows "Reassessing based on new evidence…". The result is a suggestion: click Accept suggestion, or choose a status yourself. If you choose a different status from the suggestion, you are asked for a reason, which is kept in the control's assessment history.
The headline score counts controls marked Compliant or Likely Compliant, plus controls satisfied through an approved crosswalk mapping, out of all in-scope controls. Partially Compliant earns no credit.
You're done when no in-scope control is left at Not Assessed, and every control you marked compliant has evidence linked to it.
This hands on a status and a set of linked evidence for each control. The links do not travel into the audit by themselves. Stage 6 explains what to do.
Details: Assess controls.
4. Check the age and quality of your evidence
Before you open the audit, an organization administrator should open Evidence Analytics (under Administration in the sidebar):
- The Quality tab's Evidence Needing Improvement table lists up to 10 Fair or Poor items, by ID, with each one's score, tier, and weakest area. Validating an item's control link raises its quality most: in Assessments, open the Evidence tab, pick the framework, and choose Validate in the link's row menu.
- The Health tab's Stale Evidence Alert lists items registered more than about six months ago. Separately, a nightly check marks items stale once they are 292 days past registration.
Freshness is counted from the day an item was registered in SolveGRC, not from the date of the activity the file records. A two-year-old penetration test uploaded today reads as fresh. Check the dates inside your documents against the audit period yourself.
To replace an old artifact, upload the current version, link it to the same controls, and review the controls again. A control card shows a Stale badge when evidence was linked after its status was set.
You're done when the evidence you plan to show the auditor covers the audit period and none of it appears on the Stale Evidence Alert.
Details: Quality & freshness.
5. Open the audit and generate requests
On the Audits page, click New Audit. Only Audit Title and Audit Type are required, but set Framework to the activation from stage 1. An audit covers one framework, and the framework is what lets SolveGRC build the request list and measure readiness. Add the auditor's contact details, the audit period, and the evidence deadline, then click Create Audit.
Expand the audit's row and click Generate requests in its framework panel. SolveGRC creates one evidence request per in-scope control, unassigned and in Pending status. Running it again only adds requests for controls that do not have one yet.
Assign each request an owner, and it appears in the owner's My Assignments tab. Assigning does not change the request's status.
Import PBC loads your auditor's "provided by client" list, before or after you generate requests. If a row's reference is already used by another request in the audit, the import gives it the next free number and keeps the file's reference in its description. Imported requests carry the control reference as text, so they do not count toward the framework readiness meter.
You're done when the framework panel's readiness caption shows every applicable control as requested, for example "0 of 48 applicable controls have accepted evidence · 48 requested, awaiting".
Details: Run an engagement.
6. Answer each request with sealed evidence
Each generated request starts empty. The evidence you linked to the control in stage 3 is not attached to the request for you. The request shows its control, so the owner can look up the evidence already linked to that control and attach the same items.
Evidence must be sealed before it can be attached. Sealing marks an item as released for external review. In the Evidence Library, use the lock action on the item's row. The Release column shows Sealed or Internal. Files uploaded straight into a request are sealed for you. The Evidence Library shows only your 50 most recently registered items, so for an older file, upload it straight into the request instead.
To attach evidence, open the request's Manage evidence and choose Attach evidence. The list offers every sealed item that has a file, so search for the item by title. If your audit is scoped to business units, requests use Add evidence instead, where you can pick from the sealed Evidence Library or upload a new file.
Attaching evidence moves the request to Submitted.
You're done when every request is Submitted.
7. Bring in the auditor
In the audit's External Auditor Access section, click Invite to Portal, enter the auditor's email (name and firm are optional), and click Send invitation. The invitation expires after 14 days. The auditor sets up their own account, and their access covers this audit only: its requests, the attached evidence, a comment thread on each request, and the option to raise new requests.
The auditor accepts or rejects each submitted request. A rejection must give a reason, and the request goes back to its owner to fix and resubmit. The auditor can download only sealed files, so if they report a file they cannot download, seal it.
Someone on your team with permission to update audits can also set Accepted or Rejected through Change Status. Use this to record the auditor's decisions when they are not working in the portal.
You're done when the readiness caption reads "n of n applicable controls have accepted evidence".
Details: Auditor room and export.
8. Freeze and package the evidence
When the auditor has what they need, click Freeze Evidence. Freezing locks every request, so nothing can be uploaded, edited, or re-reviewed while the auditor forms their conclusions. Unfreezing requires a written reason, and SolveGRC records who froze and unfroze the audit.
Then, under Evidence Packages, click New Package. A package is a snapshot of every file attached to the audit with an integrity hash. It includes files on requests that were not accepted, which is one more reason to package only after every request is accepted. CSV exports the manifest, the itemized record of what the auditor was given. Files opens each file in its own browser tab.
You're done when the package shows exported and you have saved its manifest. If anyone later asks what the auditor was given, that manifest is the answer.
After the audit
Evidence keeps ageing after the audit closes. Keep evidence current between audits is the routine that makes the next audit start from current proof. When you add a second framework, controls you already satisfied can count toward it through approved crosswalk mappings, but evidence links are not copied over. See Crosswalks.