Settlement External Auditor Portal UI

Quick answer

External auditor portal UI gives court-appointed reviewers what they need—without handing them admin keys or unredacted SSNs. Design AUD- audit engagements* with scoped read-only access, redacted SAMP- sample exports* from post-disbursement QA, and time-boxed credentials that expire when the engagement closes. Auditors browse REV-* checklists and FIND-* outcomes; they cannot edit CLM-* or trigger PAY-*. Connect to compliance exports, fund reconciliation, final accounting, and counsel approval. Start from the Figma guides hub and pair with tables, login, and Dev Mode handoff.

Who this is for

Product designers building settlement administrator portals where external auditors, special masters, or court monitors need read-only access.
Settlement administrators and class counsel provisioning AUD-* engagements without exporting sensitive data to email.
External audit firms reviewing QA samples, reconciliation periods, or final accounting packages under court order.

Auditor engagement lifecycle overview

AuditorEngagement — AUD-EXT-992-003 · Firm: Smith & Associates · Status: Active (expires 2026-10-15)
├── Triggers:
│   ├── Court order for independent audit
│   ├── Class counsel due diligence before [final accounting](/designing-breach-settlement-final-accounting-and-court-closure-ui-in-figma/)
│   ├── [QA campaign](/designing-breach-settlement-post-disbursement-qa-and-audit-sampling-ui-in-figma/) external validation
│   ├── [Reconciliation](/designing-breach-settlement-fund-reconciliation-and-bank-matching-ui-in-figma/) period sign-off attestation
│   └── Settlement plan annual review requirement
├── ID namespace:
│   ├── AUD-EXT-* (external engagement) · USR-EXT-* (auditor user)
│   ├── PKG-* (export package) · SCOPE-* (access scope record)
│   ├── QA-* · SAMP-* · REV-* · FIND-* (read-only subjects)
│   ├── REC-* · CLB-* (read-only if in scope)
│   └── LOG-* (auditor activity log)
├── Access model:
│   ├── Read-only — No edit · no export without watermark · no bulk download unless scoped
│   ├── Scoped — QA sample only · REC period only · Full settlement read
│   ├── Time-boxed — start_at · end_at · auto-revoke
│   └── MFA required — [2FA](/designing-two-factor-authentication-and-security-settings-ui-in-figma/) for all USR-EXT-*
├── Outcomes:
│   ├── Engagement closed → Credentials revoked · LOG-* archived
│   ├── Findings submitted → External report upload (PDF only)
│   └── Escalation → Admin notified of anomalous access patterns
└── Claimant impact: None—auditors never see claimant portal · PII redacted per policy

Engagement state	Admin sees	Auditor sees
Draft	Scope config · user invite	Nothing
Pending accept	Invite sent	Accept terms · MFA setup
Active	Activity dashboard	Scoped read-only views
Expiring soon	Alert · extend option	Banner: access ends DATE
Closed	LOG-* archive · report on file	Login denied

Verdict: Scope AUD-EXT- narrowly—“full settlement read” is almost never what the court ordered.*

AUD-EXT-* setup and scope configuration

ExternalEngagement — AUD-EXT-992-003 · settlement_id: SET-992 · scope: QA_sample_review
├── Engagement setup:
│   ├── aud_ext_id (AUD-EXT-*) · settlement_id · court_order_ref (optional)
│   ├── scope_enum (qa_sample · rec_period · final_accounting · custom)
│   ├── linked_qa_id (QA-*) · linked_rec_id (REC-*) · linked_samp_id (SAMP-*)
│   ├── start_at · end_at · auto_extend_bool (requires admin approve)
│   ├── max_users · firm_name · primary_contact_email
│   └── redaction_profile_enum (standard · strict · custom_field_list)
├── Scope matrix UI:
│   ├── ☑ QA-* campaigns listed · SAMP-* samples · REV-* · FIND-*
│   ├── ☐ CLM-* PII fields (name masked · SSN hidden · last4 only)
│   ├── ☑ ERR-* rollup reports · export PDF
│   ├── ☐ [Payment disbursement](/designing-breach-settlement-payment-disbursement-and-payout-tracking-ui-in-figma/) execute actions
│   ├── ☐ [Clawback](/designing-breach-settlement-clawback-and-overpayment-recovery-ui-in-figma/) REC-* triggers
│   └── ☑ [Compliance export](/designing-compliance-exports-and-legal-hold-ui-in-figma/) PKG-* download (watermarked)
├── User provisioning:
│   ├── Invite USR-EXT-* · role: viewer · lead_reviewer
│   ├── Accept flow: terms · NDA checkbox · MFA enroll
│   ├── Cannot invite other users unless lead_reviewer role
│   └── Revoke individual USR-EXT-* without closing engagement
└── Admin controls:
    ├── Extend end_at · Modify scope (AUD-* log · notify auditor)
    ├── Emergency revoke all sessions · [active sessions](/designing-active-sessions-and-device-management-ui-in-figma/)
    └── Clone engagement for renewal audit

Use forms for scope checkboxes and modals for extend/revoke confirmations.

Read-only review views and redacted exports

AuditorReviewView — QA sample mode · samp_id: SAMP-992-0012 · 1000 CLM-* (redacted)
├── QA sample review UI:
│   ├── Campaign summary: QA-* · sampling method · error rate ERR-*
│   ├── SAMP-* table: clm_id (masked) · pay_id · rev_status · find_count
│   ├── Drill to REV-* checklist (read-only) · FIND-* detail · ACT-* status
│   ├── Cannot: edit checklist · waive FIND-* · add CLM-* to sample
│   └── Download: watermarked PDF sample list · algorithm_version from [QA](/designing-breach-settlement-post-disbursement-qa-and-audit-sampling-ui-in-figma/)
├── Reconciliation review UI (if scoped):
│   ├── REC-* period summary · variance_total · closed_at
│   ├── BNK-* vs PAY-* match table (amounts · dates · no full account #)
│   ├── VAR-* resolution notes (read-only)
│   └── Link to [reconciliation handoff](/designing-breach-settlement-fund-reconciliation-and-bank-matching-ui-in-figma/) field names for dev
├── Redaction rules:
│   ├── SSN: hidden · show last4 only if plan requires verification audit
│   ├── Name: "Claimant ████4421" · full name never in export
│   ├── Address: city/state only · no street
│   ├── Bank: masked routing · last4 account
│   └── Custom: admin picks fields per redaction_profile
├── PKG-* export package:
│   ├── pkg_id (PKG-*) · aud_ext_id · generated_at · watermark_text
│   ├── Contents checklist (what is included)
│   ├── SHA256 hash displayed for integrity
│   ├── Download once or N times (configurable)
│   └── LOG-* every download: user · IP · timestamp
└── External report upload:
    ├── Auditor uploads PDF findings · max size · virus scan
    ├── Admin notified · attached to AUD-EXT-* record
    └── Not visible to claimants or other auditors

View mode	Auditor can	Auditor cannot
QA sample	Read REV-* · FIND-* · ERR-*	Edit · re-sample · waive
REC period	Read matches · VAR-* notes	Import BNK-* · close REC-*
Final accounting	Read exhibits · counsel sign-offs	Submit to court
PKG- download*	Watermarked export	Unredacted bulk CSV

Activity logging and anomaly detection

AuditorActivityLog — LOG-EXT-992-88421 · usr_ext_id · action: view_rev · rev_id: REV-992-88421
├── LOG-* events (all read actions):
│   ├── login · logout · mfa_challenge · session_timeout
│   ├── view_entity (QA-* · REV-* · FIND-* · REC-* · PKG-*)
│   ├── download_pkg · upload_report
│   ├── failed_access (out of scope · expired engagement)
│   └── ip_address · user_agent · timestamp (retention per policy)
├── Admin dashboard:
│   ├── Active USR-EXT-* sessions · last activity
│   ├── Downloads in last 7 days · unusual volume alert
│   ├── After-hours access flag (configurable timezone)
│   ├── Scope violation attempts (blocked · logged)
│   └── Export LOG-* for [compliance](/designing-compliance-exports-and-legal-hold-ui-in-figma/)
├── Anomaly alerts (optional):
│   ├── >500 REV-* views in 1 hour → notify admin
│   ├── Download from new IP → step-up or revoke
│   └── Pair with [security alerting](/designing-security-alerting-rules-and-notification-routing-ui-in-figma/) rules
└── Retention: LOG-* kept per [data retention](/designing-data-retention-policies-and-auto-deletion-ui-in-figma/) · legal hold overrides

Comparison: external auditor portal vs adjacent access patterns

Surface	Who	This UI adds
Compliance export PKG-*	One-time admin export	Sustained read-only browse
Counsel approval	Class counsel workflow	Third-party audit firm
QA REV-*	Internal analysts	External validation same UI read-only
Team roles	Org members	Time-boxed external USR-EXT-*
Status portal	Claimants	Never shared with auditors

Handoff checklist (Dev Mode)

ExternalEngagement — aud_ext_id (AUD-EXT-*), settlement_id, scope_enum, linked_entity_ids[], start_at, end_at, redaction_profile_enum.
ExternalUser — usr_ext_id (USR-EXT-*), aud_ext_id, role_enum, mfa_enrolled_bool, status_enum.
ExportPackage — pkg_id (PKG-*), aud_ext_id, contents[], watermark_text, hash, download_limit.
AuditorActivityLog — log_ext_id (LOG-*), usr_ext_id, action_enum, entity_ref, ip, timestamp.
ScopeMatrix — readable_entities[], forbidden_actions[], redaction_rules[].
ExternalReportUpload — report_id, aud_ext_id, file_ref, uploaded_at, scanned_bool.

Common mistakes

Mistake	Why it hurts	Fix
Full admin role for auditors	Over-access · liability	Scoped USR-EXT-* read-only
Unredacted SSN in PKG-*	Privacy violation	redaction_profile enforced
No time-box on engagement	Stale access	end_at auto-revoke
Email CSV exports	Insecure · unaudited	Portal PKG-* with LOG-*
Auditors edit REV-*	Invalidates QA audit	Read-only at API + UI
No MFA for USR-EXT-*	Credential theft risk	Mandatory 2FA
Same portal as claimants	Wrong UX · data leak	Separate auditor subdomain/route
Unlimited PKG-* downloads	Data exfiltration	download_limit + alerts
No LOG-* on view actions	Cannot prove who saw what	Log every entity view
Scope creep without AUD-*	Court order mismatch	Admin scope change logged

Recommended workflow

Define scope_enum from court order — map to QA-* · REC-* · or final accounting only.
Prototype AUD-EXT- setup* with scope matrix and redaction profile preview.
Design read-only REV- / REC- views** — disable all action buttons · show “View only” banner.
Build PKG- export* with watermark · hash · LOG-* on download.
Add USR-EXT- invite + MFA* flow using login patterns.
Close engagement with LOG-* archive and optional external report upload.

FAQ

Court ordered “access to all claims”?

Still redact SSN unless order explicitly requires · Log every view · Narrow to SAMP-* if order says “sample.”

Auditor needs unredacted for one CLM-*?

Break-glass admin export with separate AUD-* approval · Not bulk · legal hold if needed.

Can auditor see clawback CLB-*?

Only if scope includes recovery · Usually QA + REC scope suffices · Read-only.

Extend engagement after end_at?

Admin extend with reason · AUD-* log · Notify USR-EXT-* · Optional re-accept terms.

Same firm audits reconciliation and QA?

One AUD-EXT- with combined scope* or two engagements · Never duplicate credentials.

Auditor findings feed final accounting?

Upload PDF to AUD-EXT-* · Admin attaches to court exhibit · Not auto-merged.

Next steps

Design breach settlement post-disbursement QA and audit sampling UI in Figma — SAMP-* source for auditor scope
Design compliance exports and legal hold UI in Figma — PKG-* patterns and legal hold
Design breach settlement fund reconciliation and bank matching UI in Figma — REC-* period auditor view
Design breach settlement final accounting and court closure UI in Figma — Exhibit attachment workflow
Design team member roles and permissions UI in Figma — Contrast internal vs USR-EXT-* roles

Designing breach settlement external auditor access and read-only review portal UI in Figma: AUD-* engagements, redacted exports, and time-boxed access