Audit-grade evidence
Audit period management
Tell the platform which audit window you're in. Everything else anchors to it.
An audit period is a named window with a start and end date — for example, “SOC 2 Type II 2026” covering 2026-01-01 to 2026-12-31. Once a period is defined, evidence collection, control scoring, and audit packet generation all anchor to it.
Why periods matter
For Type II audits, the auditor cares about evidence across the entire window, not just today. By tagging every evidence row to a period, the platform can answer period-scoped questions correctly:
- What percentage of controls have current-period evidence?
- Which controls failed within the period?
- What did MFA coverage look like in February?
Defining a period
Open Settings → Audit Periods. Click “New period” and provide a name, start date, end date, and the framework(s) it applies to. You can have multiple periods active at once — for example, a SOC 2 Type II and an ISO 27001 surveillance audit running in overlapping windows.
The active period
Your dashboard always shows controls scored against the active period. The active period is the one that contains today’s date. If multiple periods overlap, the one bound to the framework you’re viewing is used.
Switching context
To view a previous audit’s state, set the period filter on the framework assessment view. The control completion percentages will recompute against that window.Closing a period
When the audit window ends, you don’t need to do anything special — the period simply becomes “past”. The evidence rows tagged to it remain immutable; future syncs write into the next period.
To prepare the closing audit packet, see the audit-grade evidence model and the Audit Packet Export.
Common patterns
- Annual SOC 2 Type II: one 12-month period per audit, named with the year.
- Rolling ISO 27001: one period per surveillance year + a separate three-year recertification period.
- Multiple frameworks: separate period per framework, even when the windows overlap. Keeps the audit packets clean.