Audit Playbook: Continuous Application Inventory Reporting

What Auditors Want to See

Purpose

Auditors require verifiable proof of who accessed what, when, and why across all applications subject to compliance mandates.

Traditional IAM/IGA tools cover only managed apps, leaving unmanaged, on-prem, and shadow applications invisible. Orchid uniquely discovers in-scope applications, evaluates their identity controls, and generates continuous, compliance-mapped evidence.

Playbook
Phases

Preparation

Define audit scope & frameworks (PCI, HIPAA, ISO, NIS2, FedRAMP)
Enable continuous discovery of managed & unmanaged applications
Establish baseline dashboards
Assign ownership roles (Compliance, IAM, Orchid Admin)

Application Inventory

Managed apps via IAM/IGA
Unmanaged apps with Orchid
Compliance-subject apps flagged
Identity controls (MFA, lockout, password policies, sessions)
Gap analysis to compliance requirements

Identity Lifecycle

Track joiner, mover, and leaver events
Timely deprovisioning of accounts
Access requests & approvals with timestamps

Authentication Events

Map successful logins to user & application
Track failed login attempts with thresholds
Record logouts and session terminations

Access Governance

Enforce least-privilege access
Log privilege elevation events
Provide separation-of-duties evidence

Overlay Insights

Detect orphan accounts
Identify unmanaged local accounts
Flag shadow and stale applications
Highlight highly privileged & over-provisioned users
Monitor high-risk activity patterns

Audit-Ready Outputs

Up-to-date application inventory
Continuous evidence exports
Unified identity audit logs
Compliance-based gap analysis reports
Real-time dashboards for auditors

Sustainability Report 2023

This report details our sustainability initiatives and progress made in 2023. It reflects our commitment to environmental stewardship and social responsibility.

Initiatives

In 2023, we launched several initiatives aimed at reducing our carbon footprint, including:

Transitioning to renewable energy sources
Implementing waste reduction programs
Enhancing community engagement efforts

Our goal is to achieve a 30% reduction in emissions by 2025, and we are on track to meet this target.

Quick Checklist

Scope, baselines and owners.
Complete application inventory (managed + unmanaged).
Identity lifecycle records (joiner, mover, leaver).
Authentication logs (success, failure, session termination).
Access governance evidence (least privilege, SoD, privilege elevation).
Overlay risk exposure tracked (orphan, local, shadow, stale accounts).
Dashboards, reports and evidence prepared for auditor review.