External Compliance Auditor
The Auditor Workspace is a dedicated, isolated surface used by an external (or third-party) auditor invited into a tenant to attest against either ISO/IEC 42001 or the EU AI Act (Regulation (EU) 2024/1689). The active framework is set per engagement and drives the requirement set, checklist and report. Auditors see no admin panels, no other modules, and no cross-tenant data — only the engagement scoped to their assigned organization.
Role & Access Model
The ExternalAuditor role is a tenant role provisioned by an OrgAdmin and locked to the /auditor/* surface by route-level authorization (get_route_authz) and the TenantGuard. RLS on every auditor table requires the user to have an open engagement on the same org.
- Auditors cannot view other tenants, other engagements, or admin tools.
- All evidence is read-only — auditors never mutate registry data.
- Closing an engagement immediately revokes write access to checklist & findings.
Workspace Sections
Overview
Engagement metadata, scope summary, status, and progress KPIs.
Checklist
Per-requirement verdict picker — Conformant, Minor NC, Major NC, Observation, OFI, N/A — with notes and evidence references. ISO 42001 engagements load 28 clauses + 38 Annex A controls; EU AI Act engagements load up to 25 obligations (Art. 5, 8–22, 23–24, 26–27, 50, 53, 55, 72–73 + Annexes II/III/IV) filtered by the org's role × risk × GPAI profile.
Evidence
Read-only access to AI Systems, Use Cases, Governance Policies, Datasets, AI Risks, and Management Reviews scoped to the engaged tenant.
Findings
Log Minor NC, Major NC, Observation, or OFI findings linked to a specific clause or Annex A control with description and recommended action.
Report
Live audit summary with branded DOCX export (RhindonCyber_ISO42001_AuditReport_*.docx or RhindonCyber_EUAIAct_AuditReport_*.docx) and CSV export of findings.
OrgAdmin Findings Review
OrgAdmins triage auditor findings at /governance/auditor-findings:
- Promote to Nonconformity — converts the finding into a tracked Nonconformity (severity mapped from finding type) and records
NONCONFORMITY_PROMOTED_FROM_EXTERNAL_AUDIT_FINDINGin the org and platform audit logs. - Reviewed — no action — closes the finding with a required justification.
Both actions notify the originating auditor by branded email (logo embedded inline) via the notify-auditor-events edge function. New findings notify OrgAdmins and WorkflowAdmins on the same channel.