SOC2-COMPLIANCE5 MIN READ
Push Back on an Overbroad Auditor Request
Clarify and narrow auditor evidence requests by tying them to control objective, population, and period.
Dana DA External auditor 1 Clarify 2 Narrow 3 Confirm Evidence boundary 20 sec The moment Dana asks for all admin activity logs for the year. The export is huge and contains fields unrelated to the control being tested. Overbroad evidence can create confidentiality risk and still fail to prove the control. 1.8TB raw logs requested 12mo full report period
Read the full lesson
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in