AWS Audit Manager will no longer be open to new customers starting April 30, 2026. If you would like to use Audit Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [AWS Audit Manager availability change](https://docs.aws.amazon.com/audit-manager/latest/userguide/audit-manager-availability-change.html).
# Tutorial for Delegates: Reviewing a control set
This tutorial describes how to review a control set that was shared with you by an audit owner in AWS Audit Manager.
Audit owners use Audit Manager to create assessments and collect evidence for the controls in that assessment. Sometimes audit owners might have questions or need assistance when validating the evidence for a control set. In this situation, an audit owner can delegate a control set to a subject matter expert for review.
As a delegate, you help audit owners to review the collected evidence for controls that fall under your area of expertise.
## Prerequisites
**Before you start this tutorial, make sure that you first meet the following conditions:**
+ Your AWS account is set up. To complete this tutorial, you must use both your AWS account and the Audit Manager console. For more information, see [Setting up AWS Audit Manager with the recommended settings](setting-up.md).
+ You're familiar with Audit Manager terminology and functionality. For a general overview of Audit Manager, see [What is AWS Audit Manager?](what-is.md) and [Understanding AWS Audit Manager concepts and terminology](concepts.md).
## Procedure
**Topics**
+ [
### Step 1: Review your notifications
](#delegate-tutorial-step1)
+ [
### Step 2: Review the control set and related evidence
](#delegate-tutorial-step2)
+ [
### Step 3. Add manual evidence (optional)
](#delegate-tutorial-step3)
+ [
### Step 4. Add a comment for a control (optional)
](#delegate-tutorial-step4)
+ [
### Step 5: Mark a control as reviewed (optional)
](#delegate-tutorial-step5)
+ [
### Step 6. Submit the reviewed control set back to the audit owner
](#delegate-tutorial-step6)
### Step 1: Review your notifications
Start by signing in to Audit Manager where you can access your notifications to see the control sets that have been delegated to you for review.
**To review your notifications**
1. Open the AWS Audit Manager console at [https://console.aws.amazon.com/auditmanager/home](https://console.aws.amazon.com/auditmanager/home).
1. In the left navigation pane, choose **Notifications**.
1. On the **Notifications** page, you review the list of control sets that have been delegated to you. The notifications table includes the following information:
[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/audit-manager/latest/userguide/tutorial-for-delegates.html)
**Tip**
You can also subscribe to an SNS topic to receive email alerts when a control set is assigned to you for review. For more information, see [Notifications in AWS Audit Manager](notifications.md).
### Step 2: Review the control set and related evidence
The next step is to review the control sets that the audit owner delegated to you. By examining the controls and their evidence, you can determine if any additional action is needed for a control. Additional actions can include manually uploading additional evidence to demonstrate compliance, or leaving a comment about that control.
**To review a control set**
1. From the **Notifications** page, review the list of control sets that were delegated to you. Then identify which one you want to review and choose the name of the related assessment.
1. Under the **Controls** tab of the assessment detail page, scroll down to the **Control sets** table.
1. Under the **Controls grouped by control set** column, expand the name of a control set to show its controls. Then, choose the name of a control to open the control detail page.
1. (Optional) Choose **Update control status** to change the status of the control. While your review is in progress, you can mark the status as **Under review**.
1. Review information about the control in the **Evidence folders**, **Details**, **Evidence sources**, **Comments**, and **Changelog** tabs. To learn about each of these tabs and how to understand the data that they contain, see [Reviewing an assessment control in AWS Audit Manager](review-controls.md).
**To review the evidence for a control**
1. From the control detail page, choose the **Evidence folders** tab.
1. Navigate to the **Evidence folders** table, where a list of folders that contains evidence for that control is displayed. These folders are organized and named based on the date when the evidence within that folder was collected.
1. Choose the name of an evidence folder to open it. From here, you can review a summary of all the evidence that was gathered on that date. To understand this information, see [Reviewing an evidence folder in AWS Audit Manager](review-evidence-folders-detail.md).
1. From the evidence folder summary page, navigate to the **Evidence** table. Under the **Time** column, choose a line item to open and review details of the evidence that was collected at that time. To understand this information, see [Reviewing evidence in AWS Audit Manager](review-evidence.md).
### Step 3. Add manual evidence (optional)
Although AWS Audit Manager automatically collects evidence for many controls, in some cases you might need to provide additional evidence. In these cases, you can manually add your own evidence that helps you to demonstrate compliance with that control.
**To add manual evidence to a control**
There are several ways to add manual evidence to a control. You can import a file from Amazon S3, upload a file from your browser, or enter a text response. For instructions for each method, see [Adding manual evidence in AWS Audit Manager](upload-evidence.md).
### Step 4. Add a comment for a control (optional)
You can add comments for any controls that you review. These comments are visible to the audit owner. For example, you can leave a comment to provide a status update and confirm that you remediated any issues with that control.
**To add a comment to a control**
1. From the **Notifications** page, review the list of control sets that were delegated to you. Find the control set that you want to leave a comment for, and choose the name of the related assessment.
1. Choose the **Controls** tab, scroll down to the **Control sets** table, and then select the name of a control to open it.
1. Choose the **Comments** tab.
1. Under **Send comments**, enter your comment in the text box.
1. Choose **Submit comments** to add your comment. Your comment now appears under the **Previous comments** section of the page, along with any other comments regarding this control.
### Step 5: Mark a control as reviewed (optional)
Changing the status of a control is optional. However, we recommend that you change the status of each control to **Reviewed** as you complete your review for that control. Regardless of the status of each individual control, you can still submit the controls to the audit owner.
**To mark a control as reviewed**
1. From the **Notifications** page, review the list of control sets that were delegated to you. Find the control set that contains the control that you want to mark as reviewed. Then, choose the name of the related assessment to open the assessment detail page.
1. Under the **Controls** tab of the assessment detail page, scroll down to the **Control sets** table.
1. Under the **Controls grouped by control set** column, expand the name of a control set to show its controls. Choose the name of a control to open the control detail page.
1. Choose **Update control status** and change the status to **Reviewed**.
1. In the pop-up window that appears, choose **Update control status** to confirm that you finished reviewing the control.
### Step 6. Submit the reviewed control set back to the audit owner
When you're done reviewing all controls, submit the control set back to the audit owner to let them know you finished your review.
**To submit a reviewed control set back to the owner**
1. In the **Notifications** page, review the list of control sets that were assigned to you. Find the control set that you want to submit to the audit owner, and choose the name of the related assessment.
1. Scroll down to the **Control sets** table, select the control set that you want to submit back to the audit owner, and then choose **Submit for review**.
1. In the pop-up window that appears, you can add any high-level comments about that control set before choosing **Submit for review**.
After you submit the control to the audit owner, the audit owner can view any comments that you left for them.
## Additional resources
You can continue to learn more about the concepts that are introduced in this tutorial. Here are some recommended resources:
+ [Reviewing assessment details in AWS Audit Manager](review-assessments.md) - Introduces you to the assessment details page, where you can explore the different components of an Audit Manager assessment.
+ [Reviewing an assessment control in AWS Audit Manager](review-controls.md) and [Reviewing evidence in AWS Audit Manager](review-evidence.md) - Provides definitions to help you understand the controls and evidence in an assessment.
+ [Understanding AWS Audit Manager concepts and terminology](concepts.md) - Provides definitions for the concepts and terminology that are used in Audit Manager.