How an Auditor Audits a Company on Safeguard

IntermediateFree7 modules · 23 lessons · ~27 min

About this course

A practical walkthrough of an audit engagement on Safeguard, for external auditors running SOC2 Type 1, SOC2 Type 2 or ISO 27001 engagements and for the compliance lead who works with them. How the auditor gets access, how the engagement and its observation window are set up, how evidence requests are issued and answered, how to read evidence, hashes and samples, how questions and findings are raised and answered, where policies, people, vendors and risks fit, and what the auditor takes away at the end. The auditor forms and issues the opinion; Safeguard records it and does not issue reports or opinions.

What you'll learn

Getting Access

Who Does What in an Audit on Safeguard
The Invitation and the Auditor Role
Signing In and What the Account Can Reach
End Dates, Revocation and the Activity Record

Setting Up the Engagement

Creating the Engagement
Point in Time or Observation Window
Status, Milestones and the Timeline

Requests: The PBC List

The Standard Request List and New Requests
How the Company Answers a Request
Accept, Reject, Reopen and Talk It Through

Evaluating Evidence

01Getting Access4 lessons

Who Does What in an Audit on Safeguard1 min
The Invitation and the Auditor Role1 min
Signing In and What the Account Can Reach2 min

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Reading the Evidence Tab

Automated Tests and Connector Evidence Versus Uploaded Documents

What the SHA-256 Values Prove

Sampling a Population for SOC2 Type 2

Questions and Findings

Asking Questions
Raising a Finding
Responses, Corrections and Closing

Policies, People, Vendors and Risks as Evidence

Policies and Acknowledgements
People: Training and Background Checks
Vendors, the Risk Register and Access Reviews

Wrapping Up

Recording the Opinion
The Audit Package and Verifying It
Closing the Engagement and Independence

End Dates, Revocation and the Activity Record

02Setting Up the Engagement3 lessons

Creating the Engagement1 min
Point in Time or Observation Window1 min
Status, Milestones and the Timeline1 min

03Requests: The PBC List3 lessons

The Standard Request List and New Requests1 min
How the Company Answers a Request1 min
Accept, Reject, Reopen and Talk It Through1 min

04Evaluating Evidence4 lessons

Reading the Evidence Tab1 min
Automated Tests and Connector Evidence Versus Uploaded Documents1 min
What the SHA-256 Values Prove1 min
Sampling a Population for SOC2 Type 21 min

05Questions and Findings3 lessons

Asking Questions1 min
Raising a Finding1 min
Responses, Corrections and Closing1 min

06Policies, People, Vendors and Risks as Evidence3 lessons

Policies and Acknowledgements1 min
People: Training and Background Checks1 min
Vendors, the Risk Register and Access Reviews1 min

07Wrapping Up3 lessons

Recording the Opinion1 min
The Audit Package and Verifying It2 min
Closing the Engagement and Independence2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.