QULDEXResources · Glossary
What is a reviewer in an audit? Role and responsibilities
What does a reviewer do?
Review is the second pair of eyes. The owner submits evidence that a control ran; the reviewer checks it is the right record, in the right period, and actually shows what is claimed.
The reviewer's decision is itself evidence. An auditor will look for who reviewed each item, when, and what they decided.
What does a reviewer check?
The item relates to the control and the requirement in question.
It is dated within the period being examined.
It demonstrates that the control operated, not only that it exists.
What does a review decision look like?
A reviewer examines evidence for a backup restore test.
| Item | What it looks like |
|---|---|
| Submitted | Screenshot of a restore job, no date visible |
| Decision | Returned |
| Reason | Date and system name not shown; job log requested |
| Resubmitted | Job log export with timestamp and result |
| Decision | Accepted, 16 Oct 2026, by the security analyst |
This is an illustration written for this page, not a customer record.
Where do frameworks expect independent review?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Annex A 5.3 | Conflicting duties and areas of responsibility are segregated. |
| ISO 27001 | Clause 9.2 | Auditors are selected to ensure the objectivity and impartiality of the audit process. |
| SOC 2 | CC5.1 | Control activities include segregating incompatible duties where practical. |
| ISO 27001 | Clause 10.2 | The effectiveness of corrective action is reviewed. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What goes wrong with review?
Self-review
The owner accepts their own evidence.
Instead: the system should prevent the preparer from approving.
Accept without reading
Items are approved in bulk to clear a queue.
Instead: require a decision per item, with a reason when returned.
No record of the decision
Review happens in conversation and leaves no trace.
Instead: record who decided, when and why.
How does QULDEX handle this?
Each auditor and reviewer has their own access, and every decision is recorded against their name.
Reviewer: common questions
What is the four-eyes principle?
A rule that a second person must review or approve a piece of work before it takes effect, so that no single person can both prepare and approve it.
Can a small team have independent review?
Yes. Independence is about the specific item: the reviewer must not have prepared it. Two people can review each other's work.
Is a reviewer the same as an approver?
Often, but not always. A reviewer checks quality and completeness; an approver authorises the next step. One person can hold both roles for an item they did not prepare.
Sources
- ISO/IEC 27001:2022, Information security management systems: Requirements
- ISO/IEC 27002:2022, Information security controls
- ISO 19011:2018, Guidelines for auditing management systems
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
A named reviewer on every decision
Controls, evidence, findings and corrective actions in one audit workspace.