The auditor's access
The auditor's access
The Auditor role
The built-in Auditor role reads everything an audit needs and changes nothing: cases, accounts and contacts, reports, the audit log and the export log, users, teams and roles, and with their plugins on incidents, problems, changes, services and the access history. It also holds:
| Permission | What it gives |
|---|---|
Audit evidence (audit.evidence) | The controls and their results, the exceptions, populations, samples and evidence packs. |
Read the configuration (audit.config) | Settings → Configuration. |
Reading is logged (audit.logged) | Every record and list they open goes in the audit log as Read …: "Read case" with the case's reference, "Read the audit log", "Read an evidence sample", and so on, each at most once a minute so the log stays readable. Their exports are in the export log. The lookups the app makes for every page (units, saved views, counts) aren't logged. |
[!IMPORTANT] Auditors see the units they are placed in, like everyone, so place them in the units in the audit's scope. See roles.
Roles for a period
An engagement has an end. When you give a role (on a person's or a team's roles), the optional Until date ends it: the role stops counting at the end of that day, and the hourly job removes it. The access history records it as revoked, like a role taken away by hand (roles for a period).
The configuration and conflicts of duties
Settings → Configuration (Read the configuration) shows the configuration as it is, read-only, in sheets: Roles, Role holders (with when each was given and when it ends), People, Units, Service levels, Automations, Controls, Housekeeping, Forms and Plugins. An auditor reads it instead of going through the settings pages. Download it as Excel or PDF. Its changes over time are in the audit log.
Conflicts of duties lists active people who hold permissions that shouldn't usually go together, and why:
| Holds | And | Why it matters |
|---|---|---|
Work on changes (change.write) | Approve changes (change.approve) | Can ask for a change and approve it (Change Management refuses requesters approving their own, unless switched off). |
Manage users (user.write) | Manage roles (role.write) | Can create people and give them roles. |
Process controls (control.settings) | Audit evidence (audit.evidence) | Defines the controls and prepares the evidence on them. |
Housekeeping settings (housekeeping.settings) | Read the audit log (audit.read) | Can delete the audit log as well as read it. |
Work on cases (case.write) | Approve cases (case.approve) | Works on cases and approves them (the desk refuses approving a case you handle). |
Automation settings (rule.settings) | Process controls (control.settings) | Can change what automations do and the controls that check it. |
Administrators hold every permission, so they are listed apart.