When an auditor asks that an export be complete and accurate, they want proof that the list you gave them contains every relevant record and that the values match the source system. You show it by keeping the query, the parameters, the run time, a row count that reconciles to the source, and a hash of the file.
Why they ask
Auditors sample from the lists you provide: users, changes, deployments, vendors. If the list is missing rows, the sample cannot find the problem. So they test the list itself before relying on it. This is a general auditing idea about company-produced information, and you will hear it phrased in different ways. Ask your auditor which wording their firm uses and what they expect.
The two tests
| Test | Question | How to show it |
|---|---|---|
| Completeness | Is every record in scope included? | Same count from an independent source, no silent filters, full date range |
| Accuracy | Do values match the system of record? | Spot checks of rows against the source, unchanged since export |
A repeatable method
- Save the exact query or API call, not a description of it. Include filters and the date range.
- Record who ran it, when, in which environment, and against which system.
- Capture a total count from the source system's own UI or API, separate from your export.
- Compare the counts. If they differ, explain why, for example "excluded service accounts, listed separately".
- Hash the file and record the hash. Any later edit changes it.
- Keep the raw export, and give the auditor a copy rather than a hand-edited version.
- For a few rows, screen share or screenshot the source record so the auditor can compare.
Common causes of incomplete exports
- Pagination that stops early, so only the first page of results is saved.
- Default filters, such as only active users or only the last 30 days.
- Time zone mismatches that cut off the first or last day of the period. Use UTC and say so.
- Permissions that hide some records from the account running the export.
- A spreadsheet row limit or a copy and paste step.
Common causes of inaccurate exports
- Manual edits to fix formatting.
- Joining data from two systems on a field that is not unique.
- Renamed teams or users, so labels differ from the source.
Make it routine
Put the export in a script in version control, so the method is the same each time and changes to it are reviewed. Log the output in your evidence store with the run details. Then answering this request next year is a re-run, not a research project.
Quick check
Can I clean up the spreadsheet before sending it?
Avoid it. Send the raw export. If formatting is needed, do it in a separate file and keep the original with its hash.
What if the counts do not match?
Find out why and document it. An explained difference is fine. An unexplained one is a finding waiting to happen.
Safeguard includes compliance and evidence automation so records can be collected the same way each time. You can try a free scan.
Last reviewed: 19 October 2026.
