Optional auditor access
Create a temporary local read-only reviewer account without sharing the owner account.
What this is7 sections
Create a separate, temporary local auditor account when an authorised reviewer needs read-only evidence access. Never share the workspace owner account.
What this is
The Auditor Access section in Workspace Settings lets the owner create or reset one local reviewer credential with a username/email, display name, password/passphrase, expiry, and review note/purpose. The section retains prior auditor access records in History and reports states such as active, expired, or revoked.
Before you begin
- Confirm the owner session, organisation, review scope, and engagement end date.
- Agree the reviewer identity and minimum evidence required.
- Have a secure channel for giving the temporary credential; do not put it in a payroll note or export.
Product navigation
Open Workspace Settings > Auditor Access as the workspace owner.
Steps
- Start auditor setup
Select Set up auditor access for a new account, or Manage auditor access/Reset auditor access for an existing account.
- Identify the reviewer
Enter Auditor username or email and Display name, then select Continue.
- Set credentials and expiry
In Set credentials and expiry, enter Password or passphrase (or New password or passphrase) and choose Valid until. Use a password of at least 12 characters and a real expiry date.
- Review the details
Select Review details. Check the reviewer identity, expiry, and scope, and enter Review note or purpose.
- Create or update access
Select Create access or Reset access. For an existing account, Update expiry/note changes only the displayed maintenance fields when that control is available.
- Check the result
Confirm the completion message (Auditor access created, Auditor access reset, or Auditor access updated) and the expiry. Ask the reviewer to sign in with their own credentials and use supported read-only screens.
- End access
At the end of the review, return to Auditor Access and use Revoke access in the security control, or let the recorded expiry take effect. Revocation clears existing auditor sessions. Check the new state and related audit activity.
What to check
The account is attributable to the intended reviewer, has the minimum useful expiry, and is read-only. Verify the reviewer can reach only the required organisation evidence and not owner settings or write actions.
Important boundaries
Auditor access exposes local payroll evidence and does not create a customer-portal account or upload data. It does not authorise payroll approval, statutory submission, or changes to employee records. Keep the credential secret and preserve only the evidence approved for the review.
Common problems
Only the workspace owner can manage local auditor access
Sign in as the owner or ask the owner to perform the change.
An auditor account already exists
Use Reset auditor access rather than creating an untracked second credential.
Reviewer cannot open a page
Use Auditor cannot access a page; do not share owner credentials.