Compliance and audit
An auditor checking your service desk for an assurance report (ISAE 3402 or ISAE 3000, SOC 2) or a certification (ISO/IEC 27001, ISO/IEC 20000) asks the same things again and again: show me every record of a kind in the period, let me pick some, and show me for each one that the control worked. The desk is built so each of those steps is one action, with nothing put together by hand.
[!IMPORTANT] The desk doesn't make you compliant and holds no certification of its own. It keeps the records, enforces or checks the controls you define, and hands the evidence over in a form an auditor can test and check for changes.
The pages are under Settings → Compliance and audit: Process controls, Exceptions, Evidence, Configuration, Exports and the Audit log. Each needs its permission (below), so an auditor sees them without being an admin.
How an audit test works
Most tests of a control follow three steps, and the desk has one action for each:
- The population: every record the control applies to in the period, such as every access request resolved in 2027. Evidence → The population lists and exports it, with its count, filters and a checksum.
- The sample: the records the auditor picks from it, at random or from their own list. Take a sample… keeps the sample with the population's checksum, so it can be shown it was drawn from that population.
- The evidence per record: what happened to each sampled record, and whether the control was met. Evidence pack gives one ZIP with a PDF per record.
The rest of this page goes through what feeds those steps: the controls, approvals, exceptions, the records of each area, who may read what, and how files are checked.
In this section
- Process controls: Rules a case or incident must meet, enforced or checked, and their exceptions.
- Approvals as evidence: Approvals with an emailed code and a fingerprint.
- Population, sample and evidence: From a population to a sample to an evidence pack, per area, and how long it is kept.
- The auditor's access: The Auditor role, the configuration snapshot and conflicts of duties.
- Exports and limits: Exports with checksums, what isn't covered, and who may do what.