The Audit That Found Nothing
You are engaged to perform a security audit of a payment processor ahead of a client's vendor due diligence. The processor provides a recent certification report with no exceptions, a scope statement, and a bridge letter. The scope statement excludes the very payment application that the client will connect to, because that application runs in a separate business unit. The certification covers only the data centre hosting the core network. The processor's security lead says the exclusion is standard and the bridge letter covers the gap. The client's deadline is in three weeks. The processor will not permit penetration testing of the excluded application. You have sample evidence from two control areas and interview access to the security lead only.
1. Assess the sufficiency of the evidence for the client's purpose.
Read the worked answer
The evidence is insufficient for the stated purpose. The certification's scope excludes the payment application the client will actually connect to, so the report says nothing about the control environment that matters most. The bridge letter addresses the period between the report date and now; it does not extend scope. Two control areas is a sample, not an audit. The right conclusion is a scope limitation, not a clean opinion. I would state plainly what is covered, what is excluded, and why the exclusion is material to the client's decision, then propose compensating evidence: the processor's own internal assessment of the excluded application, architecture and data-flow documentation, and contractual security commitments with audit rights. The three-week deadline does not change the evidence standard; it changes how the limitation is communicated.
2. The processor refuses penetration testing of the excluded application. How do you proceed?
Read the worked answer
I do not accept a verbal assurance as a substitute. I request the most recent independent test results for the excluded application, the remediation status of findings, and confirmation of who performed the test and against what scope. If the processor refuses all of that, the refusal itself is a finding: an unexamined application in the client's connection path is an unquantified risk. I document the refusal, the reason given, and the residual risk to the client, and I recommend contractual controls such as a right-to-audit clause, security SLAs, and a requirement to notify of material changes. I would not sign an opinion that implies assurance over the excluded application.
3. What should the final report say, and how should it be framed for the client?
Read the worked answer
The report should separate facts, scope, and judgement. Facts: what the certification covers, the exclusion, the bridge letter's limits, the evidence obtained, and the refusal. Judgement: the certification does not provide reasonable assurance over the application in the client's path; residual risk is unknown and must be treated as elevated. I would give the client a clear statement of what is assured, what is not, and the conditions under which the gap would close. Framing matters: the client needs a decision aid, not a verdict on the processor's integrity. I would present options (proceed with contractual controls, request further evidence, or defer connection) with the risk consequence of each, and note that the deadline is a business constraint, not a reason to lower the evidence bar.