We have a system that outputs and rotate logs on a daily basis.

If an auditor requests us to provide logs of a particular date for a particular task, are we obliged to provide a complete full day log? Or can we provide, say an omitted log or screenshot of the log portion that shows only portion of the particular task? Would auditor questions the integrity of partial / omitted / screenshot of logs?

My personal answer is that I would not agree to providing complete full day log as these logs may contain other confidential or sensitive information that may be out of the audit scope.

  • 3
    depends on the audit
    – tylerl
    Commented Feb 20, 2013 at 2:29
  • ^+1 It really depends on the audit. If I was an QSA working on your SAQ, I would question your intentions.
    – g3k
    Commented Feb 20, 2013 at 16:35
  • If the issue is this sensitive, you might want to consider breaking up the outputs into discrete logs (i.e. logs based on specific users, specific transactions, etc.), or, if having such logs is discoverable in court and poses a liability, don't collect them in the first place. Contact your legal department to ensure whether or not you should do this.
    – Ivan
    Commented Jun 2, 2016 at 15:57

2 Answers 2


This depends on the type of the audit and the contract between your company and the auditing company. Furthermore privacy laws, agreements concerning privacy related data and NDAs may play an important role in judging the request.

As a practical advice: Ask your legal department as this is not a question rooted in IT but in laws and contracts. Try to explain your concerns in a way that is understandable to lawyers with little IT background.

You can try to provide a stripped down log as initial response and ask the auditor to clarify if additional data is needed and why. But whether this approach is a good idea or not, depends on the situation.


I myself am an IT auditor. When I conduct an audit, I evaluate the sufficiency of evidence based on risk. Audit risk, the risk that a material misstatement or non compliance with rules / policy won't be found, is evaluated based on its components -

  • Inherent risk - risk underlying process under audit
  • Control risk - risk that faulty internal controls won't prevent or detect a misstatement / fraud / non-compliance with policies
  • Detection risk - risk that techniques used by the auditors are inadequate or unsuitable to fully evaluate risk in the process under audit.

Inherent risk and control risk are directly correlated with the amount of evidence required to satisfy an auditor's judgement that the application under audit is operating effectively, properly secure, and protecting confidentiality of sensitive data.

Auditor's requests are not arbitrary, but based on strength of evidence and degree of risk so... -

You should only provide what the auditor is requesting - sufficient evidence to evaluate a particular fact.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .