Answer exactly what was asked, point to evidence, and say plainly when you do not know. Never guess to fill a silence. A short, accurate answer with a file attached beats a long explanation that the auditor then has to test.
Read the question twice
Follow up questions often target a specific item from a sample: why was this change approved late, why does this user still have access. Work out which item and which control the question concerns before replying.
If it is unclear, ask. "Do you mean the change on this date, or the process in general?" is a fair question, and it prevents a wasted day.
Find the facts first
Pull the record. Read tickets, logs and messages around the event. Often the answer is simple and the record exists. Sometimes you find the auditor has spotted a real gap. Better to learn that before you reply than after.
Structure the reply
A reliable shape is short:
- The direct answer in one or two sentences.
- The evidence, named and attached.
- If a gap exists, what you did about it and when.
Skip history and opinions. The auditor wants to know what happened and how you know.
Say you do not know when you do not
If the cause is unclear, state what you know, what you are checking and when you will report back. Guessing and being wrong creates a second problem: now there are two statements that do not match.
Keep one voice
Agree internally who replies. Several people answering the same question in different ways causes confusion. The control owner gathers facts, one coordinator sends the reply, and anyone with new information tells the coordinator first.
Record each question, who answered, when and what was sent. Next year the same questions return, and the log is a head start. It also shows that you handled things consistently.
If you disagree with the auditor's reading of a requirement, discuss it calmly with the engagement lead, with the text in hand. Do not argue it in an email thread with a junior team member who is applying the firm's method.
Having evidence stored per control makes replies faster. Safeguard's compliance and evidence automation keeps records tied to controls, so the file you need is easier to find. The answer itself still needs a person who understands the process.
Tone matters too. Be courteous, brief and specific. An auditor with a long list of items does not want a defence of your whole program in reply to one question. If a request seems to ask for something you consider out of scope, say so politely and ask what the auditor is trying to confirm. Often a different, easier piece of evidence answers the real need.
Quick check
What if the question reveals a real gap?
Say so, explain what you did to fix it, and provide evidence of the fix. Honest handling is better received than defending the gap.
How fast should I reply?
As fast as accuracy allows. A quick holding note with a date for the full answer is better than a rushed wrong one.
Last reviewed: 19 October 2026.
