Compliance has to be provable after the fact, not just claimed in the moment. EquanimGRC keeps an append-only record of what changed, turns the current state into reports for different audiences, and gives external auditors scoped, read-only access to the workspace itself instead of a pile of exported files.
The audit trail
Every meaningful change — a policy approved, an evidence item mapped, a control updated, a role granted — is written to an audit log: who did it, what changed, and when. The log is append-only, so it is a record of history rather than a view that can be quietly edited. Because every evidence item is attributed to a specific user orservice principal, actions taken by machine agents are logged with the same fidelity as actions taken by people.
Reports
EquanimGRC generates reports from your live state, each aimed at a different reader:
- Executive summary — posture at a glance for leadership.
- Risk assessment — where risk concentrates and what is driving it.
- Gap analysis — controls without sufficient evidence, and what is missing.
- Auditor package — controls, their mapped evidence, and governing policies, assembled for an external assessment.
Each report is generated against current data and recorded with the parameters it was run for, so a report is reproducible and traceable rather than a screenshot in a slide deck.
Auditor access
The auditor role is read-only and built for external assessors. You grant an auditor direct access to your workspace, scoped so they can review controls, evidence, and policies without the ability to change anything. That removes the export-and-email step that usually sits between an audit request and an answer — the auditor reads the source of truth directly. See Getting started for inviting team members and assigning roles.
Assembling an assessment package
When an audit begins, the work you have already done is the package. Controls roll up their mapped evidence and the policies that govern them, organized by framework. Because a single control can map across frameworks, evidence collected for one assessment carries into the next — you prepare once and present many times.