For external auditors: a client's engagement portal

A client that uses Axis Assure has given you a seat on one of its engagements — an assessment or an audit. You are an external guest of the client's workspace: an account there that can reach the engagements you have a seat on, your own profile and your own sign-in settings, and nothing else.

TL;DR — Use the sign-in link and the first credential the client sent you, choose your password and set up a second factor. You land on Your engagements; open one to read its results, evidence, workpapers and requests. Everything you open is recorded in the engagement's access log, which the client reads. Your access ends on the day the client set, or sooner if they revoke it.

Signing in for the first time

The person who invited you sends you two things, each shown to them only once:

• your first credential — a temporary password, or a link to set your own password;
• the workspace's sign-in link. Use it: your address belongs to your firm, not to the client, so the sign-in page finds the client's workspace only through that link.

1. 1

   Sign in

   Open the sign-in link and sign in with your work email and the temporary password, or set your password through the link you were sent. A temporary password must be changed the first time you use it.

2. 2

   Set up a second factor

   An authenticator app or a passkey. It is required for every external guest, with no grace period: nothing in the workspace opens until it is set up, and your seat grants nothing without it.

3. 3

   Open your engagements

   You land on Your engagements: each engagement you have a seat on, its period, your role, and the day your access ends.

If the client signs in only through its own identity provider, you sign in through that provider too, as a guest there; a password is not accepted. Ask the client how they have set that up for you.

One account per client workspace. If three clients invite you, you have three accounts, one in each workspace. Within one workspace, the same address is one account, whatever the number of engagements.

The engagement portal

Each engagement opens on its Overview: your role and side (assessor, auditee or observer), the last day of your access, what your seat lets you do with evidence files, the engagement's period, and its team — the people with seats on this engagement. You see the engagement's own people, never the client's staff directory.

The portal shows the engagement. Dates are on the client's calendar.

Working the engagement

When your seat lets you do more than read — an assessor, a lead assessor or a quality reviewer — the engagement's page offers Work this engagement. It opens the plan, fieldwork, requests, review, sampling, workpapers and findings, with what your role allows: an assessor records determinations, writes workpapers, freezes a population from a file the engagement was given and draws samples, asks for evidence and raises findings; a lead assessor also plans, starts fieldwork, finalizes and releases; a quality reviewer reviews.

• A determination you record may rest only on evidence shared with this engagement.
• You ask for evidence and raise findings without naming anyone: the client decides who provides the evidence and who remediates a finding.
• Where your side records the engagement (a certification or third-party engagement), what your team records is yours: the client answers it and does not change it.

Asking for evidence

The Requests tab is the engagement's request list (PBC), in its own order, with how many requests are still owed, due within a week, overdue and waiting for your decision.

• Ask for evidence for one item: a title, what to provide, the kind of evidence expected, and a due day. A due day is on the client's calendar: the request is due at the end of that day in the client's time zone.
• Import a list from an XLSX or CSV file whose first row names its columns: Title (or Request, or Item) is required; Instructions, Due, Kind and Order are read when present. Every row is checked first; one bad row and nothing is imported, each problem named with its row.
• One per sampled item asks for evidence about each item of a sample you drew; an item already asked about is skipped. Carry forward the previous list copies the list of the engagement this one follows, with no evidence.
• Deciding. When the client submits evidence, open the request: each piece is described — title, kind, classification, hash, scan verdict — and you accept it, ask for a revision or reject it with a reason. The files open once you accept them: the client shows an engagement only accepted evidence that has cleared its malware scan. If what you open is not what you asked for, ask for a revision; that is still possible after accepting, and it takes the files back.
• You change and close only the requests your side asked for, and you never name who provides the evidence: the client does.

Under the list, What this engagement is shown lists every piece of evidence the client has shared with the engagement, and why — accepted for one of its requests, or disclosed by the client. Files open in the watermarked viewer. The client may take a disclosure back until the engagement is final; it then leaves the list.

Verifying a sample yourself

A sample can be drawn again without Axis, from its record and its population file, with the algorithm in verifying a sample offline. The record holds the method, the seed, the size, the items drawn in order and the population's count and two hashes. The population file is the one the sample was drawn from, byte for byte — unless its details name people of the client's workspace, in which case it holds the item keys alone: its SHA-256 then differs from the record's items hash, its keys hash is the record's, and it verifies. Each download is entered in the chain of custody and the access log.

Viewing and downloading evidence

What you can do with an evidence file depends on your seat, and the Overview says which:

• The viewer's watermark carries your name, your firm, the engagement, the time and the view's reference, across the page and along its foot. It deters copying; it does not stop you reading.
• An original is the exact file the client recorded: its SHA-256 is the one the evidence's record holds. The download link lasts 15 minutes, and each download is entered in the evidence's chain of custody.
• A file that has not cleared the client's malware scan cannot be shown or downloaded yet.

Everything you open is logged

The engagement's access log records when you first open the engagement, each time you read its results, evidence list, workpapers, requests or samples, and each file you view or download, a population file included. The client reads that log. The people who manage the engagement's access are also told when you open it for the first time, and when more than 25 files are viewed or downloaded within an hour.

What you can reach

Your engagements, your own profile and preferences, your second factor, your sessions and your notifications. Any other address in the workspace answers "not found".

Your sessions follow the workspace's rules: you are signed out after 60 minutes without activity, and after 8 hours in any case. When the client revokes your last seat in the workspace, your sessions end at once.

When your access ends

• Your access lasts until the end of the day shown as Access until, on the client's calendar. The client can extend it, or revoke it at any time. Axis does not remind you before it ends: the people who manage the engagement's access are told a week before, so ask them if you need longer.
• When you no longer hold a live seat in that workspace, your account there is suspended and signed out everywhere. If the client gives you a new seat, it is reactivated.
• The client keeps the engagement's record: the seats you held and the access log.

Your data

The portal does not offer a copy of your data or the deletion of your account. To ask for either, contact the client that invited you.