Audit Portal Walkthrough

Who This Guide Is For

You are an assessor, auditor, or reviewer who has received a share link from a client. The link looks like:

Your client generated this link from their dashboard. It gives you read access to their compliance evidence and, depending on scope, the ability to enter findings, request evidence, and generate assessment reports. No account is required on your end.

1. What You Are Looking At

When you open the portal, you see a single-page evidence dashboard organized into sections. A sticky table of contents on the left lets you jump to any section. The sections that appear depend on two factors:

• Your client's framework. An EU AI Act assessment shows article-level conformity sections. A CMMC assessment shows control families. An ISO 42001 assessment shows requirement groups. The portal adapts automatically.
• Your token scope. A basic scope token shows the control matrix, families, findings, and POA&M summary. A full scope token adds agent transparency, lifecycle chains, decision chains, hardware attestation, and Merkle integrity proofs. Your client chooses the scope when generating your link.

If you need data that is not visible in your portal, your client may need to generate a new link with a broader scope or with specific articles included.

2. Reading the Score Cards

The top of the portal shows three headline metrics:

3. Control Matrix

The control matrix is the core evidence table. Each row represents a procedure with its current verdict and evidence chain.

Columns

Filtering and Sorting

• By family: Click a family card above the matrix to filter to that family only.
• By verdict: Use the verdict filter to show only FAIL controls (useful for focusing your assessment on gaps).
• By severity: Sort by severity to prioritize CAT I findings.
• Search: Type a procedure ID or keyword to find specific controls.

Evidence Summary

Each control row includes a human-readable evidence summary. For example:

These summaries are generated from the witness factors and describe what was measured. They are not assessor conclusions.

Assessment Objectives

Expand any control row to see linked NIST 800-53A assessment objectives. Each objective shows:

• Coverage: FULL (SWT3 evidence directly satisfies this objective), PARTIAL (some evidence, supplementary review needed), or NONE (requires manual assessment -- interview, document review, or physical examination).
• Method: TEST, INTERVIEW, or DOCUMENT_REVIEW per 800-53A methodology.
• Description: The specific objective text.

Inherited Controls

Controls with an INHERITED verdict include provider details when expanded:

• Provider name (e.g., Vultr, AWS, Supabase)
• SOC 2 Type report reference
• Inheritance mechanism (e.g., "VPC network isolation")
• Last validated and next review dates
• Stale flag if the provider attestation is overdue for review

4. Framework-Specific Sections

EU AI Act Conformity

If your client's primary framework is the EU AI Act, the portal shows an article-level conformity section. Each article (Art. 9, 10, 13, 14, 15, etc.) displays:

• Conformity percentage (procedures passing out of total mapped)
• Status: COMPLIANT / MONITOR / ACTION_REQUIRED
• Critical flag for high-priority articles
• Days until enforcement date
• Corrective actions (prioritized by severity)

The Annex IV checklist section tracks technical documentation completeness across 15 sections. You can update section status, add reviewer notes, and score each section 0-10 with evidence quality ratings.

CMMC and NIST 800-53

If your client's primary framework is CMMC or NIST 800-53, the portal organizes evidence by control families (AC, AU, CM, SC, etc.). Each family card shows:

• Control count and passing count
• Inherited control count (provider-satisfied)
• Family-level pass rate

The control matrix includes STIG severity (CAT I / CAT II / CAT III), days open for FAIL controls, and POA&M milestone tracking. Expand any control to see linked NIST 800-53A assessment objectives with TEST/INTERVIEW/DOCUMENT_REVIEW method indicators.

ISO 42001 and Other Frameworks

For ISO 42001, NIST AI RMF, SR 11-7, and other frameworks, the portal shows a requirement-level assessment. Each requirement group displays conformity percentages, status indicators (COMPLIANT / MONITOR / ACTION_REQUIRED), and corrective actions prioritized by gap severity. The structure adapts to each framework's native organization (clauses for ISO, functions for NIST AI RMF, sections for SR 11-7).

5. Entering Findings

The Findings Register is where you document your assessment observations. This is your working record within the portal.

Creating a Finding

1. Scroll to the Findings section (or click it in the table of contents).
2. Enter your observation text. Be specific: reference the article, requirement, or procedure.
3. Select a severity:
   • MAJOR: Non-conformity that affects the ability of the management system or product to achieve its intended outcomes. Requires corrective action before certification/authorization.
   • MINOR: Non-conformity that does not affect the ability to achieve intended outcomes but should be addressed. Corrective action within a defined timeline.
   • OBSERVATION: An area for improvement that is not a non-conformity. No corrective action required but recommended.
4. Optionally link the finding to a specific procedure ID (e.g., AI-GRD.1).
5. Optionally attach SWT3 anchor references as evidence citations.
6. Save. The finding is created with status OPEN.

Updating Findings

As the assessment progresses, update finding status:

Every status change, severity change, and observation edit is logged in the portal's audit trail with your assessor identity and timestamp.

Bulk Import

If you have findings prepared in a spreadsheet, you can submit them as a batch via the bulk import endpoint. Prepare a CSV with columns: observation, severity, procedure_id, swt3_anchors. Up to 100 findings per batch. See your client's technical team or the Assessor Onboarding Kit for API details.

6. Evidence Requests and Interviews

Evidence Requests

When you need supplementary evidence beyond what the portal provides, create an evidence request:

• Specify the procedure or article the evidence relates to.
• Describe what you need (policy document, interview access, training records, etc.).
• Track status: pending or received.

Remember: SWT3 anchors cover TEST-method assessment objectives. INTERVIEW and DOCUMENT_REVIEW objectives require traditional evidence collection. The portal's assessment objectives display (Section 3) shows which objectives need manual evidence.

Interviews

Log interview sessions with date, interviewer identity, and linked procedures. Notes are stored in the portal's audit trail and appear in exported reports.

7. Peer Review

For multi-assessor teams, the Review Panel supports structured peer review:

• Submit a review with your name, accreditation body, qualification, and status (APPROVED, CHANGES_REQUESTED, or REJECTED).
• Rejection auto-creates a finding. If you reject a section, the portal automatically creates a MAJOR or MINOR finding based on your comments. This ensures rejected items are tracked in the findings register.
• All reviews are logged with reviewer identity and timestamp.

8. Statistical Sampling

For large control sets, the Sampling section helps you select a statistically representative subset for deep review. The portal provides:

• Random sample drawn from the witness ledger
• Sample statistics and confidence intervals
• Coverage validation across control families

For detailed sampling methodology, see the Assessor Sampling Instructions.

9. Full-Scope Sections

If your token has full scope, additional sections appear. These provide deeper forensic and operational evidence for AI system assessments:

10. Generating Reports

The portal offers several export formats. All exports include a report-level SWT3 anchor for tamper detection.

Report Coherence Validation

Before rendering any report, the portal runs a coherence check. It detects contradictions such as:

• MAJOR findings on controls with PASS verdicts
• Conformity below 80% with a PASS outcome
• Incomplete Annex IV documentation with a PASS outcome
• Rejected peer reviews with a PASS outcome

Contradictions appear as warnings in the report banner. They do not block export but they flag areas where your findings and the automated evidence diverge. Investigate each warning before finalizing your report.

11. Verifying Anchors Independently

Every SWT3 anchor in the portal can be independently verified. This is the core integrity guarantee: you do not need to trust the portal display.

1. Copy any anchor from the control matrix (click the copy icon).
2. Open sovereign.tenova.io/verify in a new tab. No account required.
3. Paste the anchor. The verifier checks the SHA-256 fingerprint against the witness ledger.
4. Result: VALID (anchor exists and is untampered), REVOKED (anchor was later revoked with a reason code), or NOT FOUND.

For a detailed verification walkthrough including manual SHA-256 recomputation, see the Assessor Onboarding Kit.

12. Common Issues