An export from your own system is not automatically reliable evidence. Auditors usually want to know how the report was produced, what filters it used, and whether it contains everything in scope. Prepare a short note with each report that covers the source, the parameters and a reconciliation to a second source.
Why this comes up
Many SOC 2 tests start from a list: all new hires, all production changes, all terminated users. The auditor samples from that list. If the list is missing items, the sample is meaningless. So they ask how you know the list is complete and correct.
Advisory firms describe this as information produced by the entity, often shortened to IPE. The idea is the same in every explanation: the population must be complete and the data accurate.
Completeness: does the list hold everything
Show that the report covers the whole period and every in-scope system. Useful checks:
- The date range is stated and covers the full audit period.
- No filter excludes a team, repo or environment by accident.
- The record count matches an independent number, such as the count in a second system or the count of tickets in a date range.
Accuracy: is each row right
Spot check a handful of rows against the source record. If the report says a user was removed on a date, open the identity provider log and confirm. Document the rows you checked and the result.
Keep the parameters
Save the query, the report name, the filters and the run date with the output. If a report relies on a custom script, keep a copy of the script and a record of who can change it. Auditors may ask whether anyone can alter the logic.
Prefer reproducible over pasted
A saved query or scheduled report that anyone can re-run is easier to trust than a spreadsheet someone edited. If you must edit an export, keep the original beside it and describe the change.
A short note to attach to every report
Add a few lines next to each export. Say which system it came from, which report or query produced it, the date range, the filters applied, who ran it and when, and what you compared it with to check completeness. Two minutes of writing saves an hour of follow up questions.
When the report comes from a vendor
If a third party produces the report, ask how it is generated and whether you can reproduce it. You may need to rely on the vendor's own assurance report for the system that produces it. Note this dependency in your evidence index.
If you cannot validate a report at all, consider another source for the same fact. Two independent sources that agree are better than one that is unexplained.
Quick check
Is a screenshot of a dashboard enough?
Sometimes, but it rarely proves completeness. An export with a visible date range and a record count is usually stronger.
Last reviewed: 19 October 2026.
