The auditor asked for evidence we do not have. What now?
If an auditor requests evidence an organisation does not possess, the immediate action is transparent communication. Explain the absence, propose alternative evidence if available, or acknowledge the control deficiency. This will likely result in a finding or observation in the audit report, necessitating a remediation plan. Proactive engagement with the auditor is crucial to manage expectations and minimise audit impact.
When an auditor identifies a control for which no evidence exists, it typically indicates a control deficiency. The organisation must clearly articulate why the evidence is unavailable. This could be because the control was not performed, not documented, or the requested evidence format does not align with internal practices. The auditor will assess the impact of this deficiency on the overall control environment and the achievement of the control objective, which will be reflected as a finding, observation, or exception in the audit report. Attempting to retrospectively create evidence is generally detectable and can undermine audit credibility.
Practitioners often err by delaying communication or attempting to obscure the lack of evidence. Instead, the focus should be on understanding the underlying control objective the auditor is testing. If the control was genuinely not implemented or documented, the organisation must develop a robust remediation plan, including timelines and assigned responsibilities. This plan should be shared with the auditor. For ISO 27001, this directly impacts conformity with Annex A controls or the Statement of Applicability. For SOC 2, it affects the description of controls and the auditor's opinion on their effectiveness. Proactive engagement and a clear remediation strategy are essential for demonstrating commitment to security and compliance.
Sources
- ISO/IEC 27001:2022, Clause 10.1 (Nonconformity and corrective action)
- AICPA Professional Standards, AT-C Section 205 (Examination Engagements)