Objectives and criteria
- Sponsor, decision and intended report audience.
- Entities, frameworks or internal policy requirements.
- Evidence period and reporting deadline.
Platforms and populations
- Tenant, account, site and user counts at a high level.
- Complete populations for the proposed samples.
- Critical services, suppliers and exclusions.
Evidence handling
- Named evidence owners and availability.
- Approved secure transfer and read-only access.
- Redaction, retention and deletion requirements.
Reporting and action
- Prior findings and remediation status.
- Factual review and escalation arrangements.
- Management owners and follow-up expectations.
Do not manufacture records to fill a historical gap. State what is missing and when a new control began operating. The assessor can then distinguish current implementation from evidence of sustained operation.
Build your audit scoping brief, or send your requirements with an NDA or RFP. High-level context is sufficient for the first conversation.
