On 12 August 2025 we plan to release a new security feature for controlling access to audits.

It will now be possible to set permissions for users who are Watchers and Approvers on an audit.

Background

Watchers and approvers can be added to audits either during planning or when reviewing the report:

Previously, access to the audit could only be controlled through groups and supplier groups, which made it quite complicated to properly manage access.

What is changed?

Now you can decide which access a user should get if they are set as Watcher or Approver. This is accomplished with two additional scopes on the audit permissions on the user roles page:

It means that if a user is added as Watcher for example, you can decide if the user should get additional access to for example Set and change final conclusion.

Note that the two checkboxes for Read cannot be removed, which means that a user can always open the report if she is a Watcher or Approver on that report.

Implications

This new feature will make it much easier to control access to audits, since users no longer need to be assigned to a group that has access to the audit. From now on, when a user is added as watcher or approver, it will automatically have access to the audit.

Please note that no access will be given when we release this feature, except access to viewing the audit report, which is always granted (you cannot remove those checkboxes in the role settings shown above).