Your auditor. Our job is the requests.
Precept doesn’t include an audit firm. You choose your auditor, you pay them directly, and we never take a fee from one. What we do is make their requests answerable in one place.
Why the auditor isn’t in the box.
An auditor chosen and paid through your software vendor has a conflict of interest, even when nobody intends one. Your report is worth what your auditor’s independence is worth, so we stay out of that relationship.
Your auditor gets a read-only seat at no charge. From it they can open any control in scope, see each piece of evidence with its source and collection date, filter to their sample, and send requests straight into Transit. They can’t change anything, and the seat closes when fieldwork ends.
Tuesday 10:40 to Thursday 12:15.
- 10:40Tue 14 Jul
REQ-2291arrives from the auditor: “Provide evidence of Q2 access reviews for all in-scope systems, with reviewer sign-off and remediation of any exceptions.” - 10:41Tue
Transit matches it to
PC-AC-04andPC-AC-06. The Q2 Okta export and AWS IAM report are already attached. Two systems are missing a sign-off. - 15:20Tue
Witness reminds the owners. Marcus Bell signs for production; Leah Fontaine signs for the warehouse system.
- 11:05Wed 15 Jul
One exception, a contractor account, is shown with its revocation ticket,
IT-4471, closed 3 Jul. - 12:15Thu 16 Jul
Sent to the auditor with seven items attached. No follow-up questions.
REQ-2291From the auditor- Received
- Tue 14 Jul
10:40 - Sent
- Thu 16 Jul
12:15
Request, as received
“Provide evidence of Q2 access reviews for all in-scope systems, with reviewer sign-off and remediation of any exceptions.”
Matched by Transit
Tue 10:41PC-AC-04Quarterly access reviewPC-AC-06Privileged access in AWS
Attached
7 items- 1Okta user export, Q2 · Okta
1 Jul 09:12 - 2AWS IAM credential report · AWS IAM
1 Jul 09:14 - 3Review sign-off, production · Marcus Bell
14 Jul 15:20 - 4Review sign-off, warehouse system · Leah Fontaine
14 Jul 15:31 - 5Review notes, Q2 · Marcus Bell
14 Jul 15:24 - 6Exception: contractor account · Jira IT-4471
closed 3 Jul - 7Access review procedure v3 · Datum
2 Jul
Reviewer sign-off
2 of 2Tue 14 Jul, 15:20 · item 3Tue 14 Jul, 15:31 · item 4Exception
1 found · item 6Contractor account still active after the contract ended. Access revoked.
IT-4471A second reader before it goes out.
On Bearing, an audit-window desk reads your responses before they reach the auditor: same-day replies during fieldwork, and a shared review of every request so nothing goes out half-answered.
Compare plansSame evidence, for your customers’ security teams.
Security questionnaires are evidence requests with a different sender. Transit answers them from the same controls, so the answer you gave the auditor in July is the answer the customer gets in October.