Audits tend to ask the same few questions: who has access to what, who approved it, whether anyone checked, and when leavers lost it. In Folkbase those answers are written down as the work happens, so preparing for an audit means reading records instead of rebuilding them. Folkbase does not certify your company against any framework. It keeps the evidence an auditor asks to see.
Evidence as you go
Most audit prep is reconstruction. Someone pulls user lists from each tool, matches them against a spreadsheet of employees, and chases managers for approvals that happened months ago in chat. The evidence existed at the time, but nobody wrote it down in one place.
Folkbase records it at the moment of the action. A grant is created with its reason attached. A review decision is saved when the reviewer makes it. An offboarding run stamps each grant as it closes. There is no separate step for collecting proof.
Four kinds of record
- Grants that carry their justification. Each grant names the tool, the scope, who granted it, and the role or request that justifies it. It also holds a state: pending, active, suspended, or revoked.
- Access reviews with recorded decisions. An access review snapshots every active grant into a dated review. Reviewers keep or remove each grant, and every decision is saved on the person's record.
- Logged lifecycle transitions. Onboarding, activation, offboarding, and exit are each logged with who ran them, when, and why.
- Offboarding runs stamped per grant. On a person's last day, the run closes every grant and records the time each one closed. The archived record keeps its history intact.
What auditors ask
The questions vary by framework and by auditor, but most of them map to a record that already exists.
| The auditor asks | Where the answer lives |
|---|---|
| Who can open this tool today? | Active grants, filtered by tool in the directory |
| Why does this person have it? | The role or request named on the grant |
| Who granted it, and when? | The grant's history on the person's record |
| Was access reviewed this quarter? | The dated access review and its keep or remove decisions |
| When did a leaver lose access? | The offboarding run, with a close time on every grant |
| Who started this person's onboarding? | The lifecycle log on the record |
A review is a dated snapshot, so "who has what" has an answer tied to the day it was taken. Archived records stay readable after people leave, which matters when the audit period covers someone who is gone.
Each answer an auditor needs already sits on a record, with the time it was written.
Keeping it current
Evidence only helps if it is recent and complete. Three habits keep it that way.
Run access reviews on a schedule, for example quarterly, so each period has its own dated snapshot. Close out leavers through the offboarding run rather than by hand in each tool, so every close time is recorded. Grant extra access through requests, so the reason lands on the grant instead of in a chat thread. The audit trail page shows how the plain-language log reads.
Plan availability
Starter includes the people directory and access grants by role, so every grant records its justification from the first day. Access reviews, onboarding, and offboarding are part of the Growth plan. The full audit log is part of Business. Packaging may change before launch.