Auditor sessions are local, read-only sessions. A screen or control unavailable to an auditor may be an intentional persona boundary rather than a product fault.

What this means

The desktop navigation guards auditor access by screen and capability. Auditors can review supported organisation evidence and audit history, but cannot manage access accounts, change owner credentials, alter workspace preferences, or perform write operations. In Auditor Access, they see Read-only access and a notice that only the workspace owner can manage local auditor access.

Common causes

  • The screen or control is owner-only, such as Change Owner Password, Offline Access Recovery, Windows Hello, or Auditor Access management.
  • Backup/restore or other write controls are restricted for an auditor.
  • The selected organisation differs from the one in the review request.
  • The account is an expired, revoked, or not-yet-configured auditor account.

How to fix it

  1. Check the account

    Confirm the sign-in page says Sign in to this workspace and that you used the assigned auditor credentials, not a shared owner account.

  2. Check the organisation and screen

    Confirm the active organisation and open the supported evidence screen, such as Organisation Audit, Documents, or a read-only organisation view.

  3. Request owner action

    If owner configuration is required, record the screen or control and reason, then ask the workspace owner to make the change.

  4. Review auditor state

    The owner can open Workspace Settings > Auditor Access, select Manage auditor access, Set up auditor access, or Refresh auditor state, and review expiry/revocation before asking the auditor to sign in again.

  5. Recheck access

    Recheck the screen after the owner has completed the approved change. Do not retry a write action with a different shared credential.

How to prevent it

Grant a temporary, attributable auditor account with a defined expiry. The app provides a read-only auditor role; the reviewed setup does not offer per-organisation permission selection. Check the active organisation before reviewing its evidence.

Still stuck

Provide the owner with the screen name, page title, visible status, organisation, and non-sensitive error text. Do not send the owner password, recovery code, employee data, or workspace database.