Audit evidence

The Audit evidence page in the console (app.heygrc.com, Audit evidence in the sidebar, next to Findings) turns your heyGRC reviews into a report you can hand to an auditor. For one organization and one period, it shows what heyGRC found on your pull requests, grouped by framework and control.

Every plan sees a preview. The full report and both downloads (CSV and PDF) are part of Scale.

What the report shows

For the period you pick, grouped by framework and control (from the controls each finding cites):

• PRs reviewed and findings by severity for each control. A finding mapped to two controls counts under each.
• Re-flagged status for each finding: Not re-flagged in a later full review, Still flagged, or Unknown. See What "not re-flagged" means.
• Each finding: title, description (up to 500 characters), repository, pull request and its link, file, first seen and last seen.
• The policy and review pack in force: the review pack revision used by the reviews in the period, so the auditor sees which rules the code was checked against.
• Milestone decisions in the period, when Milestones is on for your org: milestone, decision, decided at, and the note.

Code snippets and the suggested fix are not in the report. The code stays in GitHub; open the review there for those.

What "not re-flagged" means

heyGRC does not track whether a pull request was merged, and a finding has no "fixed" state. The report uses the strongest signal the reviews themselves can give:

• Not re-flagged in a later full review: a later review of the same pull request covered the whole pull request and did not raise the finding again. This is evidence that the team acted, not proof of a fix. A finding is matched on the line of code it is anchored to, so an edit to that line can change the match while the issue remains.
• Still flagged: the most recent review of the pull request raised the finding. This includes a finding raised by the last review, with no review after it.
• Unknown: heyGRC cannot tell. This happens when:
  • every later review of the pull request covered only part of it (a delta review of new pushes, or a partial review of a large pull request), because a review that did not look at the whole pull request cannot show that a finding is gone;
  • the finding has no signature to match on (a small share of findings).

Later reviews count even when they ran after the end of the period you picked.

Some older reviews did not record whether they covered the whole pull request. The report counts them as full reviews when your organization reviews every pull request automatically, and says so in a footnote.

Preview and full report

What the preview locks is the composed report. Your raw findings stay where they are on every plan: the Findings page and its CSV are unchanged.

Period

• The page opens on last quarter (the last full calendar quarter). Presets: last quarter, this quarter so far, last 12 months.
• Custom: any period within the last 400 days, at most 400 days long. Dates are UTC.

Downloads (Scale)

• Download CSV: one row per control and finding. Columns: Framework, Control, Severity, Finding, Description, Repository, PR, PR link, File, First seen, Last seen, Re-flagged status, Policy note, Commitment note. Cells that a spreadsheet could run as a formula are neutralised.
• Print / Save as PDF: a print-styled version of the report. Use your browser's "Save as PDF". It carries a header with the organization, the period and the generation time, the control table, and page numbers. The finding rows are in the CSV.

One organization

The report covers one GitHub or Origin organization, and a Scale subscription covers one organization. If you run several organizations, talk to us about Enterprise.

Related

• Pricing and plans
• Findings page
• Review packs
• Milestones