When an internal or external auditor, a certification body or a regulator asks how you control your suppliers, they want to see the controls, the evidence for each supplier and proof the records haven't been changed. SupplierVault gives you ready-made evidence packs, a tamper check of the audit trail, a read-only sign-in for auditors that ends on a set date, and a log of what they looked at.
Evidence packs
On the Audit trail page, find Evidence packs for auditors. Each pack arranges your own records the way auditors test them, control by control, with any gaps shown. There are six:
| Pack | What it covers |
|---|---|
| Supplier controls summary | The core controls: approval before use, bank detail checks, sanctions screening, contract dates, certificates and insurance, and purchase approvals against your sign-off limits. |
| ISO 27001 (A.5.19 to A.5.23) | Information security in supplier relationships, agreements, the ICT supply chain, monitoring and change, and cloud services. |
| Cyber Essentials and supply chain security | Suppliers' certification and the security checks you hold for them. |
| UK GDPR Article 28 processors | Suppliers that process personal data for you, and the evidence for each processor requirement. |
| FCA outsourcing (SYSC 8) | Your outsourcing records, including access and audit rights. |
| Related and connected parties | Declarations, approvals and spend with related or connected suppliers. |
Each section starts with What the auditor looks for, then shows "x of y met" and, for each supplier, Met or Gap with the evidence: who approved, when, and on what. Each pack ends with Integrity of this evidence: the result of the tamper check and, in the live service, the latest history fingerprint.
Packs open in a new tab ready to print or save as PDF. Each download is recorded in the audit trail and the access log.
Suppliers you used before SupplierVault
Suppliers you imported never went through go-live approval in SupplierVault, so packs would show them as gaps. In Settings, the import panel says "N live suppliers have no go-live approval recorded". Select Record as in use before SupplierVault, then click again to confirm. Packs then show "In use before SupplierVault: recorded by name on date", so the auditor can see what happened.
The tamper check
Every entry in the change history, including every audit trail event, carries a fingerprint (SHA-256) of its contents plus the fingerprint of the entry before it, like a ledger. If anyone changed or removed a past entry, the chain would break at that point. History can't be edited or deleted through the app by anyone; it is only removed when an organisation is closed.
- On the Audit trail page, find the Tamper check panel (or, for admins and auditors, account button › Organisation › Audit evidence › Check the audit trail).
- Select Check the audit trail now.
- You'll see "Passed. All N entries since date are intact and in order. Fingerprint: …", or "Failed at an entry dated …" if something is wrong. If it ever fails, email hello@suppliervault.co.uk straight away.
Give the auditor the fingerprint with your pack. If they run the check again later, the earlier entries will still match.
Giving an auditor access
- An admin opens the account button › Team and, under Invite a colleague, chooses the role Auditor (read-only, time-limited).
- Set Auditor access ends on. It's 30 days ahead unless you change it, and can be at most a year.
- Choose their areas if you use access by area, then select Invite.
The auditor can see everything in their areas but change nothing. The team list shows "access until date". After that date they see "Your auditor access has ended". To extend it, an admin changes the date or invites them again. See Inviting your team.
The access log
SupplierVault records:
- each time an auditor signs in
- each document anyone opens
- each audit pack and evidence pack downloaded
- each "Download all data"
Admins and auditors can download it from account button › Organisation › Audit evidence › Download access log. The CSV has the columns When (UTC), Who, Role, What, Detail and Reference.
Which plan includes it
Evidence packs, the tamper check, auditor access and the access log are included in every plan. The packs for ISO 27001, FCA outsourcing and related parties use the records from those compliance packs. The tamper check, auditor sign-in and access log are part of the live service, not the public demo.
Related
- Audit trail and packs
- Retention and legal hold
- Security and your data
- Approval limits and separation of duties