An audit or a certification is coming, and the auditor will ask who had access and when, who decided it, and what proves it. The Organisation Admin prepares it with the Access Manager. The Security Monitor reads the audit log, the incident report and the reviews alongside. It starts with what portierX can prove.
The preparation runs in two parts, first what is open, then the evidence.
Before the audit, put in order what an auditor would otherwise find open.
The Organisation Admin agrees with the auditor which locations and period the audit covers, and reads which records portierX holds for it (What portierX can prove in an audit).
The Organisation Admin checks under Settings, Data Protection that the audit log's retention period covers the whole audit period (Set how long records are kept).
If the last review of the spaces in scope lies far back, the Organisation Admin or the Access Manager starts one and closes it before the audit (Start and close an access review).
Where keys are kept in depots, the Credential Manager or the Access Manager counts each depot (Count a depot).
The Organisation Admin or the Access Manager closes out every incident whose outcome is known (Close out an incident).
The Access Manager or the Credential Manager works through the Returns tab under People and follows up every overdue key (Work through hand-overs and returns).
Then gather the files and screens the auditor asks for.
The Organisation Admin or the Access Manager narrows the Audit Log to the audit period and exports it as CSV or Excel, and for a single person their history from their page (Show who had access and when, Export data from portierX).
The Organisation Admin or the Access Manager exports the Handover Receipts under Reports and opens the receipt of each hand-over the auditor asks about (Run and export a report).
The Organisation Admin, the Access Manager or the Security Monitor exports the Credentials with Reported Incidents report under Reports (Run and export a report).
The Organisation Admin shows under Settings, User who holds which role and what each role may do (Add a user and set their role, Roles and permissions).
The Organisation Admin, the Access Manager or the Security Monitor shows the closed reviews under Reviews, with every row and answer (Access reviews: what they are and how they run).
Under Settings, Data Protection, the audit log's period covers the whole audit period.
Under Reviews, a review of the spaces in scope reads Closed.
Each depot's Counts tab shows a finished count.
The Credentials with Reported Incidents report shows no open incident whose outcome is known.
The Audit Log shows your export as an entry of its own.
