For auditors
The catalogue keeps what an assurance report (ISAE 3402, SOC 2) asks about the services it covers.
Audit scopes
Under Settings → Service Configuration → Audit, add the reports your services are audited for, like “ISAE
3402 Type 2, 2027”. On a service's page, Suppliers and audit says which of them cover it (setting that needs
service.settings). The Services list filters by scope, and exports can be limited to one, so the auditor's list
matches the system description.
Suppliers
Suppliers in the sidebar is the register of the companies behind your services: what each provides, a contact, its own assurance report (“SOC 2 Type 2, period to 2026-09-30”), and whether your report carves it out (its controls aren't covered; the usual case) or includes it. Name them on the services they are behind, with what they provide there. Export gives the register as a CSV for the system description. A supplier that services name can't be deleted; archive it.
Reviews
Records go stale: an owner leaves, a team is renamed, an approver changes job. So each service's owner confirms its record:
| Services | How often |
|---|---|
| Every service | Once a year |
| Tier 1 services and services in an audit scope | Every six months |
Change both under Settings → Service Configuration → Audit.
- The owner gets an email, and the review is under Reviews in the sidebar: the record as it is.
- The owner answers It is right, or I corrected it with what was wrong.
- After 30 days it is overdue, and the owner is reminded once.
Each account's approver lists are reviewed the same way, by someone with service.approvers. A Service Manager
can also ask an owner to review a record now (the service's menu: Ask the owner to review it).
Every review is kept with what was reviewed, the answer, who gave it and when. Export on the Reviews page gives them all as a CSV.
Exporting the catalogue
Export on the Services page gives the catalogue as it is now, or as it was on any date (taken from each service's history), for every service or one audit scope: code, name, type, status, tier, owner, teams, units, dependencies, service hours and level, accounts, suppliers, scopes, what the accounts are responsible for. As a CSV file, or as a page to print or save as a PDF.
Every export is kept with who made it, when, and a SHA-256 checksum of the file, so the copy the auditor has can be checked against it. The Export dialog lists the earlier ones.