Audit readiness & evidence — found from sitemap — Vanta

Cited by

Facts read from this source

• Evidence statuses Report an error

  “Not Ready for Audit: A document/policy that has not been uploaded or a test that is failing Ready for audit: A document/policy is uploaded and is responsible for passing the test. Approved: Evidence that an auditor has approved Flagged: Evidence that an auditor has flagged N/A: Evidence that has been marked as not applicable (N/A)”

• Na evidence rules Report an error

  “The auditor can mark the evidence as N/A If a customer deactivates a test, the associated evidence will be marked as N/A Additionally, evidence can become N/A if the audit observation period does not include the approval or creation dates of the provided evidence.”

• Resubmit flagged evidence Report an error

  “When auditors flag a piece of evidence, you can update or review it and resubmit it to your auditor directly within Vanta.”

• Request auditor review flagged only Report an error

  “The Request auditor review checkbox only appears on evidence with a status of Flagged. If the checkbox isn’t visible, the evidence hasn’t been flagged by your auditor yet.”

• Test notes visibility Report an error

  “Notes added to tests are visible only to your internal Vanta users and not automatically accessible to auditors.”

• Custom controls visibility Report an error

  “Custom controls imported after the audit's defined end date will not be visible to auditors unless the audit end date is modified to include them.”

• URL evidence access Report an error

  “Auditors can access URLs added as evidence, provided the content is attached to the control/framework under the audit scope. Explicit permissions might still need to be granted for content visibility.”

• Document draft visibility Report an error

  “Auditors will only see document files after the document is marked as complete. If you update a document after it’s been marked as complete, those changes remain in draft and won’t be visible to auditors until the document is marked as complete again.”

• Tsc activation rules Report an error

  “You can activate additional TSCs (e.g., Availability, Confidentiality) after the creation of an audit engagement, but they can not be added or edited if the audit window has started. To include new TSCs after an audit window has begun, you must begin a new audit engagement.”

• Custom evidence requests Report an error

  “Request auditors to create specific custom evidence requests for newly updated or created documents and submit the necessary evidence to the custom request, ensuring complete inclusion in the audit.”

• Flagged evidence tab Report an error

  “From the Evidence section, select the Flag by auditor tab.”

• Observation period planning Report an error

  “Collaborate with auditors to pre-define observation periods and ensure they encompass all relevant updates.”