Audit and examinations
Hand your auditor a read-only seat and a file they can verify.
Auditor access, audit evidence and examination readiness in one place. Open an engagement for a period and a framework, see the gaps before you generate anything, then give your auditor a logged, read-only session on a bundle they can check on their own machine.
SOC 2 · 1 Jan to 30 Jun 2026
Fictional engagement. Gaps show before anything is generated.
The problem
Examination readiness, with a compliance audit trail behind it.
An audit goes badly when evidence is scattered, stale or impossible to prove unchanged. The audit section is built for the week before the auditor arrives.
- 01
Scattered
Evidence sits in tickets, inboxes and shared drives, so collecting it for one period takes days.
- 02
Stale
A control looks covered until someone notices the evidence is from last year.
- 03
Unprovable
An auditor has to take a folder on trust, with no way to show it was not edited since.
Step by step
How an engagement runs
One audit period against one framework. Nothing is generated until you ask for the bundle.
- 1
Open the engagement
Choose the framework and the period the auditor has asked about.
- 2
See the gaps first
Controls with missing, stale or failed evidence for the period show before you generate anything.
- 3
Generate the bundle
The evidence, its hashes and the scope and limits are packaged and the bundle is hashed, with a signed PDF.
- 4
Grant a session
The auditor gets a read-only session to verify and download the bundle; every action is logged.
- 5
Verify offline
The exported record carries a verifier the auditor runs on their own machine, with no account and no network.
Capabilities
What sits in the audit section
Audit engagements
A period, a framework, the gaps and the bundle, in one place per audit.
Auditor access
Read-only sessions on one engagement; every bundle opened, verified or downloaded is recorded with the session.
Control frameworks
Import the controls you report against and map evidence types to them; coverage and drift run against the map.
Attestations and proofs
Verification attestations and retention proofs, exportable for a reviewer.
A chained activity ledger
Every action in the account, chained like the decision record, with an incident registry beside it.
A feed for your SIEM
The audit log as a stream your security team can pull into its own monitoring.
Definition
What is audit evidence for a compliance programme?
Audit evidence is the record that shows a control worked during a period: what was checked, when, by whom, with what result, and proof the record has not changed since.
Examination readiness means that record is current, mapped to the controls an examiner or auditor will ask about, and can be handed over without a scramble.
Questions
Does my auditor need an InackGuard account?
No. You grant a session on one engagement. The auditor opens it with the token from the invitation, read-only, and can verify and download the bundle. The token is never stored in their browser.
Can the auditor see everything in our account?
No. A session covers one engagement: its bundle, the controls in its manifest and the datasets the evidence was checked against. Every open, verification and download is logged.
Which frameworks can we map to?
You import the control definitions of the framework you report against, for example SOC 2 criteria. Engagements, coverage and drift run against those controls.
Is Inack itself certified?
Not yet. What we have in place today, and what is on the roadmap, is on the Trust page.
Which plan includes this?
The activity ledger is part of Team. Auditor access, control frameworks and attestations are part of Enterprise. See Pricing.
Walk through an engagement on your own controls.
We will open an engagement with you, show the gaps and verify a bundle offline.
What the session covers
- 01
Choose a framework and a period
The controls you report against, for the period your auditor asks about.
- 02
See the gaps first
Missing, stale or failed evidence per control, before anything is generated.
- 03
Verify the bundle
The way your auditor will, in a read-only session, then offline.