Share a change control with an auditor

Auditor accounts do not see your change controls by default. An auditor sees a change control only when it has been shared with them, or when they hold a working role on it (they raised it, are assigned it, or are named as an assessor, approver or implementation-task owner). When an auditor needs to review a particular change, an administrator shares that change with them.

A share is read-only. The auditor can open the change request, its assessments, approvals, attachments, validation impact, implementation tasks, lifecycle, History and electronic signatures. They cannot edit, submit, assess, approve, reject, attach evidence, start or complete implementation, verify or close it, and a share never makes them an approver.

Who can share

Sharing needs the change-control administration permission, which the Admin role holds. You can share with an active account in the Auditor or External Auditor role in your organisation. To create an auditor account, see Invite an auditor to review documents.

Share a change control

1. On the left sidebar, select Change Control.
2. Open the change request you want reviewed.
3. Scroll to the Share with auditor section.
4. Choose the auditor from the list. Auditors the change is already shared with are not listed.
5. Select Share read-only.

The auditor sees the change in their Change Control register straight away. On the change request page they see a note saying who shared it with them and when, and that it is read-only. You can share the same change with several auditors.

See who a change is shared with

The Share with auditor section lists every auditor the change has been shared with: who shared it, when, and whether the share is Active or Withdrawn. A withdrawn share stays on the list as a record.

Withdraw access

1. In the Share with auditor section, find the auditor.
2. Select Withdraw.
3. Enter the reason, for example “Audit closed”. A reason is required.
4. Select Confirm withdraw.

The change disappears from the auditor’s register, and its page, History and signatures no longer open for them. To give them access again later, share the change again.

What is recorded

Every share and every withdrawal is written to the change request’s History (its audit trail): who shared or withdrew access, with which auditor, when, and for a withdrawal, the reason you entered.

Note

An auditor that opens a change control that has not been shared with them, or its signatures, gets a “not found” answer, the same as for a change that does not exist. An auditor reads a change’s History only while it is shared with them; holding a working role on a change opens the change but not its History.