Blog · Audit evidence · Problem 16 of 93
You did the work but kept no record. Answer the auditor and fix it for next time.
· 3 min read · By Case Jones
You are in the middle of an audit, or getting ready for one, and a request has come in for proof of something. The access review happened in a meeting, the new laptop was set up by hand, and nobody wrote anything down.
What it costs to leave it
To an auditor, a control with no evidence did not operate, and it may be written up as an exception. Trying to fix that by creating records after the fact is far worse, since an auditor who finds backdated evidence has reason to doubt everything else. The same gap will also repeat every period until the work itself leaves a record.
How to respond honestly and stop it happening again
You cannot go back and record the past. You can find what traces exist, tell the auditor plainly, and change how the work gets done.
- 1
Look for traces made at the time
Work usually leaves some mark. Check ticket history, chat threads, calendar invites, email, commit logs and the admin logs of the system involved. A Google Workspace audit log showing an account suspended on a given date is real evidence, even if nobody meant it as such.
- 2
Never create a record and date it in the past
Do not fill in a checklist today and put last March's date on it. If you write a note now about what happened then, date it today and say it is a recollection. Auditors can work with honest gaps. They cannot work with records they do not trust.
- 3
Tell the auditor what you have and what you do not
Send the traces you found, with a short note explaining them. Say clearly which part has no record. Ask whether they will treat it as an exception and what response they want from you.
- 4
Turn the work into a checklist with a record
For each control that came up short, write the steps as a short checklist. Name who does each step, and say what the step leaves behind, like a screenshot, an export or a sign-off with a timestamp. The record should be a side effect of doing the work.
- 5
Run it on a schedule or a trigger
Work that is supposed to happen quarterly needs a calendar reminder and an owner, or it slips. Work tied to an event, like a new hire, should start from that event. Check after the first run that the record exists and is easy to find.
Example
A sample note to the auditor
The Q2 access review took place in a meeting on June 14 with the CTO and the head of support. We have the calendar invite and a Slack message the next day confirming two accounts were removed. The Workspace admin log shows both removals on June 15. We did not keep a signed review record. From Q3, the review runs as a checklist with an access export and a sign-off.
Or make the record part of doing the work
In 93 Compliance, a procedure document becomes a checklist that runs from a trigger to steps to controls to evidence to a kept record. It can start from a button, the assistant, a schedule from daily to quarterly, or another system through an API key or webhook. Each step goes to a role, like HR, IT or a manager.
Controls collect the evidence while the work happens, as photos, files or screenshots, answers, a timestamp or a sign-off. A check cannot be done by the same person who did the work. Every run's record is kept and not edited, and it lands in the audit package with SHA-256 fingerprints, so next time the auditor asks, the answer is already there.
- Procedures that run as checklists
- Evidence collected at each step
- Sign-offs kept separate from the person who did the work
- A kept, unedited record of every run
Make it a checklist
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Will a missing record fail our SOC 2 audit?
A SOC 2 report does not pass or fail. A missing record usually becomes an exception in the report, with your response next to it. One exception with a clear fix is far less damaging than a pattern.
Can I write up a summary of what we did and give it to the auditor?
Yes, if you date it today and say it is written after the fact. Pair it with any traces from the time. The auditor will decide how much weight to give it.
What counts as good evidence?
Something created when the work happened, showing what was done, by whom and when. System exports, logs, tickets and signed checklists are typical. Screenshots work too if they show the date and the system.