Question 1

What evidence does an auditor actually accept?

Accepted Answer

Records your systems produced while doing the work. Not documents you wrote about the work. A policy says what should happen. A ticket, an approval, a log line, a dated export shows that it did. Auditors sample. They pick items from a population and test those, so your evidence has to be retrievable per item rather than as a summary. Screenshots are accepted, and they are the weakest thing accepted. The strongest evidence is what your infrastructure emits on its own. Nobody chose which examples to keep.

Question 2

Do I need a penetration test?

Accepted Answer

Your customers will ask for one, whether or not a framework demands it. SOC 2 does not name a penetration test as a required control. Your own control description might. Once it does, your auditor tests against it. Enterprise questionnaires ask directly, and a missing answer stalls your deals. The useful question is scope. A test against your production application, by someone whose report you can share, is worth more in procurement than a broad scan. Ask what you can hand a customer before you buy. A report you may not share solves nothing.

Question 3

Do I really need a risk assessment?

Accepted Answer

Yes, and it is more useful than it sounds when you write it yourself. A risk assessment lists what could go wrong, how bad it would be, and what you do about each one. Auditors ask for it because your controls are supposed to follow from it. A downloaded template is visible immediately. It undermines everything downstream, because your controls then have no stated reason to exist. Spend an hour listing the six things that would actually hurt your company. That beats any template.