Exports and limits
Exports and their checksums
Every list an auditor asks for has an Export menu: the inbox, the Incidents, Problems and Changes lists, and the audit log. It exports the list with its current filters (and for cases and incidents the columns shown) as Excel, CSV or PDF. Every file says what it is:
| Format | Where it says what it is |
|---|---|
| Excel | A sheet About this export with the export's id, who exported it, when, the number of rows, the filters, and the SHA-256 of the rows as CSV. |
| The same on the first page, and the id, who, when and the checksum in the footer of every page. | |
| CSV | The same in the response headers: X-Export-Id, X-Checksum-SHA256 (the file) and X-Rows-SHA256 (the rows). |
[!TIP] The checksum of the rows is the same whichever format was picked, so a CSV and a PDF of the same list can be matched.
Every export, of a list, a population, a sample, an evidence pack, a record's PDF or the configuration, is kept in the export log under Settings → Exports (with who, when, what, the filters, the rows and the checksums) and in the audit log as export.created. The auditor can check the copy they have against it.
Limits
| Limit | What it means |
|---|---|
| Controls check on resolving. | A control's result is recorded when a record is resolved or closed. Records resolved before the control existed, or before it covered them, have no result: the desk doesn't check them afterwards. Start a control before the period it will be tested for. |
| Changing a control doesn't change old results. | Each result names the control's version it was recorded under. |
| A review is due at closing. | The review is written once an incident is resolved, so A review written is checked when the incident closes; on resolving it counts as due. |
| PDFs are Latin text only. | The desk makes its PDFs itself, with no outside service. Text is written as Windows-1252, so characters outside the Latin languages (Greek, Cyrillic, Chinese …) print as “?”. Excel and CSV files keep every character. |
| Populations follow access. | A population, sample or pack only holds records the person who makes it can see. |
| The API needs the admin scope. | The endpoints under /api/v1/audit need a token with the admin scope (audit API), which only Administrators can give. Auditors use the pages. |
Who may do what
| To | Permission | Held by |
|---|---|---|
| Define, change and switch off controls; explain exceptions | control.settings | Administrator |
| See the controls and exceptions; populations, samples and evidence packs | audit.evidence | Auditor |
| Read the configuration and conflicts of duties | audit.config | Auditor |
| The audit log and the export log | audit.read | Auditor |
| Have everything they read logged | audit.logged | Auditor |
| Approve cases when a control asks | case.approve | Administrator |
| Set and lift legal holds on cases, problems and changes | case.legal_hold | Administrator |
Give them to your own roles under Roles.