Who this is for: The assigned technical reviewer.
You receive an email and an in-system notification.
Open Audit Records and find the audit — it shows as For Review.
Select Review Audit. The full draft report opens, with Reject with Reason and Approve & Publish at the foot.
Read the report as the recipient will: are the findings supported by the evidence, are the severities right, does the summary follow from the findings?
Choose:
Approve & Publish — the audit is published automatically and immediately. There is no further step, and the auditor cannot make changes between your approval and publication. That is deliberate.
Reject with Reason — you must state the reason. The audit returns to In Progress and the auditor is notified with your feedback. They fix it and resubmit for review.
Write rejections as instructions, not judgements. “Finding F01 states three departments are affected but the evidence names only one — add the register reference” gets a fix. “Evidence insufficient” gets a resubmission with the same problem.