5

We have a system that outputs and rotate logs on a daily basis.

If an auditor requests us to provide logs of a particular date for a particular task, are we obliged to provide a complete full day log? Or can we provide, say an omitted log or screenshot of the log portion that shows only portion of the particular task? Would auditor questions the integrity of partial / omitted / screenshot of logs?

My personal answer is that I would not agree to providing complete full day log as these logs may contain other confidential or sensitive information that may be out of the audit scope.

|improve this question
  • 3
    depends on the audit – tylerl Feb 20 '13 at 2:29
  • ^+1 It really depends on the audit. If I was an QSA working on your SAQ, I would question your intentions. – g3k Feb 20 '13 at 16:35
  • If the issue is this sensitive, you might want to consider breaking up the outputs into discrete logs (i.e. logs based on specific users, specific transactions, etc.), or, if having such logs is discoverable in court and poses a liability, don't collect them in the first place. Contact your legal department to ensure whether or not you should do this. – Ivan Jun 2 '16 at 15:57
3

This depends on the type of the audit and the contract between your company and the auditing company. Furthermore privacy laws, agreements concerning privacy related data and NDAs may play an important role in judging the request.

As a practical advice: Ask your legal department as this is not a question rooted in IT but in laws and contracts. Try to explain your concerns in a way that is understandable to lawyers with little IT background.

You can try to provide a stripped down log as initial response and ask the auditor to clarify if additional data is needed and why. But whether this approach is a good idea or not, depends on the situation.

|improve this answer
0

I myself am an IT auditor. When I conduct an audit, I evaluate the sufficiency of evidence based on risk. Audit risk, the risk that a material misstatement or non compliance with rules / policy won't be found, is evaluated based on its components -

  • Inherent risk - risk underlying process under audit
  • Control risk - risk that faulty internal controls won't prevent or detect a misstatement / fraud / non-compliance with policies
  • Detection risk - risk that techniques used by the auditors are inadequate or unsuitable to fully evaluate risk in the process under audit.

Inherent risk and control risk are directly correlated with the amount of evidence required to satisfy an auditor's judgement that the application under audit is operating effectively, properly secure, and protecting confidentiality of sensitive data.

Auditor's requests are not arbitrary, but based on strength of evidence and degree of risk so... -

You should only provide what the auditor is requesting - sufficient evidence to evaluate a particular fact.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.