External Auditor Access

External auditors authenticate with two things — a personal access link and a 6-digit verification code — and receive time-limited access to a defined audit scope. This page covers the verification workflow, scope review, and the audit workspace.

Verify access

1. Open the personal access link sent by the QA team. It looks like https://<your-eqms>/auditor-access/<token> and is unique to you.
2. Enter the 6-digit verification code received via email from the QA team.
3. Select Verify Access.

Note

Verification codes are numeric only. The code is valid only for your own access link — it will not work on any other link, and a link will not open without its code. If you did not receive a link or a code, contact the QA team directly.

Caution

You get a limited number of attempts (3 by default). After the last failed attempt the access link is deactivated permanently and the QA team must issue a new invitation. Repeated attempts in a short window are also rate limited, and every attempt — successful or not — is written to the audit trail.

Review the audit scope

After successful verification, the scope review screen displays:

1. Review the audit details: scope description, start and end dates, and duration.
2. Review the Access Scope showing the count of accessible Documents, CAPAs, Deviations, and Audits.
3. Review the Access Limitations panel:
   • Read-only access to specified documents and CAPAs.
   • Access expires automatically after the audit period.
   • All activities are logged for audit trail purposes.
   • Credentials must not be shared with others.
4. Select Proceed to Storyline.

Note

The scope loads automatically as soon as verification succeeds — you don’t need to click anything to trigger it. If it fails to load (for example, a network error), the screen shows the error message and a Retry button instead of spinning indefinitely.

Review the compliance storyline

The storyline provides a view of the compliance landscape:

1. Review the Compliance Summary cards: overall compliance score, total documents, total deviations, and total CAPAs.
2. Review the Risk Assessment: risk level badge (High, Medium, or Low) and identified risk factors.
3. Review the Event Timeline showing the last 10 events chronologically, including document changes, deviations raised, CAPAs created, and audit events.
4. Select Proceed to Access to enter the audit workspace.

Note

As with the scope step, the storyline loads automatically once you reach this screen; a load failure shows an error and a Retry button rather than an indefinite spinner.

Use the audit workspace

Once access is granted:

1. Use the Quick Actions row (Documents, Deviations, CAPAs, Audits) to open the ids within your invitation’s scope. Selecting a resource type lists exactly the ids granted to you; selecting one of those ids fetches its read-only detail (title, status, and type-specific fields such as version or severity).
2. If your invitation grants Read + submit findings, use the Audit Findings Management panel to submit new findings for non-compliances and non-conformities, and to dispute a finding you already submitted.

The workspace also displays:

• Session token (partially masked for security).
• Expiration period (up to 7 days, and never beyond the expiry of the access link itself).
• Access level — Read-only or Read + submit findings, depending on what the QA team granted on your invitation.

Note

Read-only is the default. On a read-only invitation the finding-submission controls are hidden, and the server rejects any attempt to submit or dispute a finding.

Security

Caution

All external auditor activities are logged and monitored. The session token must not be shared with anyone outside the authorized audit team.

Feature	Description
Personal access link	Unique, unguessable link per invitation. It identifies the invitation; the code alone grants nothing.
Verification code	6-digit numeric second factor, valid only for its own access link.
Attempt lockout	3 failed codes deactivate the link permanently.
Rate limiting	Repeated verification attempts from the same client are throttled.
Session token	Unique token generated upon verification, sent as an Authorization: Bearer header (never in a URL).
Time-limited access	Sessions expire after 7 days or at the end of the audit period.
Scope restriction	Access limited to the documents, CAPAs, deviations, and audits the invitation names, all within the inviting organisation. A record the invitation does not name is refused.
Revocation	Revoking an auditor’s session (PUT /api/auditor/sessions/{id}/revoke) also invalidates the access link that issued it, so the auditor cannot verify again to obtain a new session. Any other live session from the same link is closed at the same time, and the link is re-checked on every subsequent request — so revoking it by any route ends access immediately.
Access level	Read-only by default; Read + submit findings only when explicitly granted on the invitation.
Activity logging	All access, verification attempts, and lockouts are recorded in the audit trail.

Set up external access (for QA teams)

External auditor invitations are currently created through the API only (POST /api/auditor/invite, requires the audit.manage_auditors permission) — there is no Admin screen for this yet.

1. Create the audit plan and define the scope.
2. Call POST /api/auditor/invite with the auditor’s name and email, the audit_plan_id, and a scope object naming the specific documents, CAPAs, deviations, and audits in scope. Always set an explicit scope — see the caution above.
3. Set access_level: read_only (the default) or contribute if the auditor needs to raise findings.
4. The response returns a personal access link (access_url) and a 6-digit verification_code.
5. Send the link and the code to the external auditor at their registered email.

Tip

Send the link and the code over separate channels where practical (for example the link by email and the code by phone or SMS). Both halves are needed, so splitting them means a single intercepted message is not enough to gain access.

Tip

Define the audit scope as narrowly as possible. Only include the specific documents, CAPAs, deviations, and prior audits that are relevant to the current audit. This follows the principle of least privilege and reduces the risk of unauthorized data exposure.

External auditor capabilities

Capability	Read-only	Read + submit findings
View documents in the invitation’s scope	Yes	Yes
View CAPAs in the invitation’s scope	Yes	Yes
View deviations in the invitation’s scope	Yes	Yes
View audits in the invitation’s scope	Yes	Yes
Submit new findings	No	Yes
Dispute a finding	No	Yes
Edit existing findings	No	No
Modify any other records	No	No
Upload files	No	No
Access another organisation’s data	No	No

What an unscoped auditor sees

An auditor whose invitation names no records sees an empty storyline, a compliance score of — (not 100%), and a NOT ASSESSED risk badge. “Nothing was in scope” and “everything in scope was compliant” are different statements, and the portal never shows the second when it means the first.

An invitation with no scope grants no records

Access is restricted to the scope recorded on the invitation, and the scope is an allow-list: a record the invitation does not name cannot be read. An invitation created without an explicit scope therefore shows the auditor nothing beyond the audit plan named on the link — the storyline is empty and every record request is refused. Always set an explicit scope naming the documents, CAPAs, deviations, and audits the auditor needs. Cross-organisation access is never possible regardless of scope.

Findings against a record outside the invitation’s scope

The scope allow-list is enforced on raising a finding exactly the same way it is enforced on reading a record. An auditor with Read + submit findings may only reference a document/CAPA/deviation id that their invitation’s scope names — attempting to file a finding against a record outside that scope is refused (403) and nothing is stored. A finding with no resource reference at all (a general observation) is unaffected and always allowed.

Finding lifecycle

A new finding is recorded with status Submitted. If you dispute a finding you raised, the panel asks for a reason and the status changes to Disputed, with your reason stored alongside it. Every submission and dispute is written to the immutable audit trail, attributed to your auditor name and email (an external auditor has no internal user account, so the row is attributed by identity rather than by user id).

Practical example: inviting an external auditor for a supplier qualification audit

Scenario: MedDevice Corp is conducting a supplier qualification audit of CleanRoom Components Ltd. The external auditor, Dr. Anna Petrova from CertiQ Auditing Services, needs access to review relevant quality records before the on-site visit.

QA team setup (performed by Sarah Chen, QA Manager)

1. Sarah creates audit plan AUD-2026-010 (“Supplier Qualification Audit — CleanRoom Components Ltd”) with type Supplier.
2. She configures the external auditor access scope:
   • Documents: SOP-SUP-001 (Supplier Qualification Procedure), SOP-SUP-004 (Incoming Inspection), and the last 6 months of incoming inspection reports for CleanRoom Components.
   • CAPAs: CAPA-2025-018 and CAPA-2025-031 (both related to material quality issues from this supplier).
   • Deviations: DEV-2025-042 and DEV-2026-003 (deviations traced to supplied components).
   • Audits: AUD-2025-015 (previous supplier audit of CleanRoom Components).
3. Sarah generates the invitation with access level Read + submit findings. The system returns a personal access link and a 6-digit verification code: 847291.
4. She emails the access link to Dr. Petrova at a.petrova@certiq-auditing.com and reads the verification code to her over the phone.

External auditor workflow (performed by Dr. Anna Petrova)

1. Dr. Petrova opens her personal access link.
2. She enters verification code 847291 and selects Verify Access.
3. On the scope review screen, she confirms the audit details:
   • Scope: Supplier qualification records for CleanRoom Components Ltd
   • Dates: 2026-04-07 to 2026-04-11
   • Access: 8 Documents, 2 CAPAs, 2 Deviations, 1 prior Audit
4. She reviews the access limitations (read-only, time-limited, activity-logged) and selects Proceed to Storyline.
5. On the compliance storyline, she reviews:
   • Compliance score and risk assessment for the supplier relationship
   • Event timeline showing the history of deviations and corrective actions
6. She selects Proceed to Access to enter the audit workspace.
7. In the workspace, she reviews the scoped documents. She notes a pattern of repeated material certificate discrepancies.
8. Because her invitation grants Read + submit findings, she raises a finding: “Recurring material certificate discrepancies (3 instances in 6 months) suggest inadequate incoming material verification at the supplier’s facility” with severity Major.

Dr. Petrova’s session expires automatically after 7 days (or sooner, if her access link expires first). All her activities — verification attempts, document views, finding submissions, and access timestamps — are recorded in the audit trail.

Related topics

• Audit findings
• Dispute resolution