Set the organization and audit scope
Define the organization, in-scope frameworks, audit period and policy variables before collecting or exporting evidence.
Configure the workspace
As an administrator, open Settings and set:
- The organization's identity and contact details.
- The frameworks included in the engagement.
- The audit period and system scope.
- The owners and operating details used by policy templates.
The free edition permits ISO 42001 only. The full edition exposes the supported framework set. Adding a framework does not provide the organization's missing evidence.
Set a useful scope
Name the systems, teams and production resources being assessed. Match integration configuration to that scope: production repositories, projects, zones, workspaces and identities should not be left implicit.
For SOC 2, choose the audit type deliberately. For ISO 42001, record the AI management system's boundaries.
Verify
Open the checklist and confirm the selected frameworks and period. Generate one policy draft and review the substituted variables before generating the rest.
Changing scope or an audit period can change the evidence required. Review existing results and collect fresh evidence rather than assuming an earlier passing state still applies.