Evidence Status
Not Ready for Audit: A document/policy that has not been uploaded or a test that is failing
Ready for audit: A document/policy is uploaded and is responsible for passing the test.
Approved: Evidence that an auditor has approved
Flagged: Evidence that an auditor has flagged
N/A: Evidence that has been marked as Not applicable
The auditor can mark the evidence as not applicable
If a customer deactivates a test, the associated evidence will be marked as N/A
Resubmitting Evidence for Review
When auditors flag a piece of evidence, you can update or review it and resubmit it to your auditor directly within Vanta.
From the left-hand navigation panel, select Audit.
Locate the audit, and select Open audit.
From the Evidence section, select the Flag by auditor tab.
If you have not updated the evidence, select Update evidence to be brought to the specific document or test.
If you have already updated the evidence, click on the evidence and select Comments.
Add a comment, and select the checkbox next to Request auditor review.
This will update the evidence status to Ready for audit.
Send the comment.
Please note: The Request auditor review checkbox only appears on evidence with a status of Flagged. If the checkbox isn’t visible, the evidence hasn’t been flagged by your auditor yet.
Understanding Auditor Visibility in Vanta
Vanta facilitates seamless collaboration during audit processes while maintaining clear boundaries around what data external auditors can access. It's important to understand which elements, such as notes, evidence, and custom controls, are visible to auditors and how to manage this visibility effectively.
Key Principles of Auditor Access
Notes in Tests: Notes added to tests are visible only to your internal Vanta users and not automatically accessible to auditors. To share important justifications or explanations with auditors, you should include them in the supporting evidence or consult your auditor regarding preferred methods of communication.
Custom Controls: Custom controls imported after the audit's defined end date will not be visible to auditors unless the audit end date is modified to include them.
URLs as Evidence: Auditors can access URLs added as evidence, provided the content is attached to the control/framework under the audit scope. Explicit permissions might still need to be granted for content visibility.
Common Challenges and Their Solutions
Issues with Trust Services Criteria (TSCs):You can activate additional TSCs (e.g., Availability, Confidentiality) after the creation of an audit engagement, but they can not be added or edited if the audit window has started. To include new TSCs after an audit window has begun, you must begin a new audit engagement.
Custom Evidence Visibility: Ensure evidence and controls fit within the defined parameters of the audit timeline. Controls added after critical cutoff dates may require adjustments to audit deadlines for visibility.
Final Tips for Effective Audit Management
Keep open communication with auditors about the preferred methods of presenting and sharing relevant evidence.
Regularly verify that attachments, URLs, or documents have the necessary permissions for auditor access.
Plan audit engagements carefully, including the intended inclusions of TSCs or control frameworks, to avoid repetitive engagement setups.