Give the auditor read only access to the specific evidence they need, through named accounts that expire when the audit ends, with access logged. Do not hand over admin rights to production systems to speed things up. Share exports and records, not keys.
Decide the scope first
List the systems and folders the auditor needs. Usually that is an evidence folder, a ticketing view and a read only view of a few settings. Rarely does anyone need to log into production.
If an auditor wants to watch a configuration live, do it as a screen share walkthrough with your engineer driving.
The checklist
- Create named accounts for each auditor. No shared logins.
- Use the lowest role that lets them view the evidence.
- Require MFA on those accounts.
- Set an expiry date at creation, ideally just after the report is due.
- Limit access to the evidence area, not the whole drive or workspace.
- Turn on access logging and keep the logs.
- Review the permissions with a second person before sending the invite.
- Remove access promptly when the audit ends and record the date.
Redact what they do not need
Evidence often includes personal data: names, emails, device identifiers. Auditors usually need to see that a control ran, not private details. Where a sample needs real names, share them. Elsewhere, redact or pseudonymise, and note that you did.
Also check exports for secrets. Configuration dumps sometimes include tokens or keys. Scan each file before sharing.
Tell people what is shared
Your own staff may wonder why an outsider can see tickets. Share a short note on what the auditor can access and why. If customer data appears in evidence, check your contracts and confidentiality terms with the audit firm.
Keep a record
Write down who had access, to what, from when to when. Your own access control policy probably says external parties get least privilege. This record is the proof you followed it, and it is a control in its own right.
Where tools help
Safeguard's compliance and evidence automation stores evidence centrally, which makes it simpler to share a defined set instead of whole drives. How you grant access to your auditor still follows your own policy and your audit firm's terms.
Prepare a short onboarding note for the auditor: where evidence lives, who to contact for each area, and how to ask for a new item. Funnelling requests through one channel keeps a record and stops side conversations that nobody can later trace. It also makes the end of the audit easier, because you can show exactly what was shared and when.
Quick check
Can the auditor have admin access to speed things up?
Avoid it. Auditors need to see evidence, not change systems. Use read only roles or exports instead.
Should access end when the report is issued?
Set it to end around then, or sooner if the fieldwork finishes. Remove it as soon as it is no longer needed.
Last reviewed: 19 October 2026.
