Audit management
Run every audit on one record, with the auditor inside it.
The auditor works inside the platform
An engagement is the record that admits a certification body: it names the firm, the framework and the dates between which they may read your control environment. Nothing outside that window is reachable, and when the end date passes, access stops on its own. The auditor gets a control review board, evidence exhibits, prior findings and a report builder.
Key capabilities
- Engagement scoped to one firm, one framework and a date window
- Access expires automatically; extend is available for thirty days after expiry
- Close at the end of a visit, or revoke immediately with a reason
- The auditor cannot change your responses, your evidence, or read private comments
- Recommendations they raise are proposals your organisation accepts or declines
The three-year cycle, tracked without a spreadsheet
A certificate is not an event. It is a full audit, two shorter check-ins, then a renewal. Certifyi works out where you are in the cycle from the engagements that exist, and shows it two ways: a plain-language cycle map for you, and the ISO/IEC 17021-1 vocabulary the certification body expects, directly below it.
Key capabilities
- Initial audit, surveillance years one and two, then recertification
- Visit type and cycle year derived from history, not a dropdown
- Plain-language cycle map above the formal engagement panel
- Opening the next visit changes only the audit record; controls, evidence and responses stay put
Readiness, scope and fieldwork
Confirm ready for fieldwork tells the certification body that preparation is complete. Retracting it does not touch their access, because the environment moving and the door opening are different facts. The auditor then plans the visit and sets which controls it covers; on a surveillance visit that is a sample, not the whole tree.
Key capabilities
- Readiness confirmation and retraction, independent of access
- Auditor-side fieldwork schedule with activities and dates
- Per-visit scope: the sampling plan for surveillance visits
- Control conclusions: compliant, partially compliant, non-compliant, or not yet recorded
- Messages on the engagement, so a question leaves a record an email does not
Prior findings and the renewal conversation
Because findings, evidence and scope attach to engagements rather than to a document, the renewal auditor can see what was raised, what was fixed and who verified it. That is the conversation that otherwise consumes the first two days of a visit.
Key capabilities
- Prior findings surfaced inside the current engagement
- Verification recorded with how it was verified and what was examined
- An optional date to review whether a fix held
- Conclusion artefacts retained against the engagement
Audit roadmap
Plan internal audits and external visits across the year, link them to the frameworks and controls they cover, and track each from scheduled through fieldwork to closed. An internal audit linked to an external engagement shows the certification body that your internal programme actually ran.
Key capabilities
- Internal and external audits on one calendar
- Links to frameworks, controls and engagements
- Progress notes against each event
- Calendar feed (ICS) and two-way calendar sync
Proof point
Closing and revoking read differently in the record on purpose. Closing is the normal end of a visit; revoking is the relationship changing. A platform that collapses the two loses information an auditor will ask about.
Questions about this
Who runs the audit inside Certifyi?
Your independent auditor, in their own Auditor Workspace on your record. Certifyi hosts the engagement; the opinion stays with the firm.
Does the auditor still email evidence requests?
No. Evidence requests map to controls and the continuously collected evidence is already there, hashed and timestamped.
How are findings tracked?
Findings land next to the control they weaken, with a corrective action, owner and due date checked on a schedule until closure.
Can we use our existing auditor?
Yes. Any licensed CPA firm or accredited certification body can work in the workspace at no seat cost.
Keep reading
Guide
SOC 2 compliance guide
Read the guide →
Product
Auditor Workspace
See the workspace →
Article
Preparing for an auditor evidence request
Read the article →