Producing Audit Evidence
Auditors ask the same questions every year. A working programme answers most of them from data it already holds.
Procedure
The programme earns visible value at audit, and the evidence is a by-product of operating it properly rather than a separate exercise.
What auditors typically ask
Who has privileged access to this system, and how was it approved?
How is that access removed when someone leaves? With evidence for a sample of leavers.
How are privileged credentials protected and how often do they change?
What record exists of privileged activity?
Who reviews it, how often, and what have they found?
How is emergency access controlled?
How do you know the inventory is complete?
All seven are queries against data a working programme holds.
Evidence that stands up
Dated. An assertion without a date is not evidence.
Attributed. A named person for each decision.
Retained artefacts, not summaries: the actual approval, the actual review output, the actual rotation record.
Consistent across systems. An auditor comparing your inventory against the directory and finding disagreement will expand the sample.
Demonstrably complete, which means describing the discovery methodology rather than asserting completeness.
The sampling reality
Auditors sample. Five leavers, five privileged accounts, five sessions.
One failure expands the sample and converts a clean finding into an exception.
Run your own sample first. Take five recent leavers and check every privileged account, key and standing grant. Whatever you find, the auditor would have found.
Do the same with five break-glass accounts against their rotation records, which is the other common sample.
The completeness question
The hardest one to answer well.
Describe the discovery sources and what each covers.
State the known gaps, which is stronger than claiming there are none.
Show the reconciliation between sources.
Show the residual-risk list of systems that cannot be onboarded, with compensating controls.
An honest statement of coverage with a named gap is received far better than a claim of completeness that the auditor disproves in an afternoon.
Snapshots
Export the privileged account inventory periodically, dated, to immutable storage.
This answers questions a live system cannot: who had access on a given date, what the estate looked like at the start of an incident, whether an account existed at the time of a finding.
Cheap, and it answers otherwise unanswerable questions.
Continuous rather than annual
A programme operated properly produces evidence as a by-product.
A programme assembled for the audit produces a three-week scramble, gaps that cannot be filled retrospectively, and findings.
Retrospective evidence is frequently impossible. You cannot demonstrate that sessions were reviewed last March if they were not.
The reciprocal benefit
Everything here is worth doing without an audit.
The inventory that satisfies an auditor is the inventory that answers an incident, and the review process that produces evidence is the one that occasionally finds something. The audit is a deadline rather than a reason.
The self-sample
Running the auditor's test first converts a finding into a fix.
Five recent leavers. Check every privileged account, standing grant, SSH key and shared credential they knew.
Five privileged accounts. Check the approval record, the owner, the rotation history.
Five sessions. Check the request, the reason, the recording, the review.
Five break-glass accounts. Check the register, the test date, the rotation after last use.
Whatever you find, the auditor would have found, and fixing it beforehand with the fix documented is a materially better position.
Answering the completeness question
The hardest question and the one where honesty performs best.
Describe the discovery sources and what each covers.
Describe the reconciliation between them.
Name the known gaps, which is stronger than claiming none.
Show the residual-risk list with compensating controls and review dates.
Show the trend in discovered accounts, which demonstrates the process is running rather than that it ran once.
A claim of completeness that an auditor disproves in an afternoon costs more than the gap it concealed.