Chapter 10 — Evidence for auditors and insurers
Lesson map
Lesson 10 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Evidence pack"]
N2["10.2 Questionnaires"]
N3["10.3 Maintenance"]
N4["10.4 Honesty"]
N5["Organising the pack"]
N6["Mapping to frameworks and follow-up"]
N7["Insurer questions"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Evidence pack"]
N2["10.2 Questionnaires"]
N3["10.3 Maintenance"]
N4["10.4 Honesty"]
N5["Organising the pack"]
N6["Mapping to frameworks and follow-up"]
N7["Insurer questions"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX046"]
[Learning outcomes]
|
v
[10.1 Evidence pack]
|
v
[10.2 Questionnaires]
|
v
[10.3 Maintenance]
|
v
[10.4 Honesty]
|
v
[Organising the pack]
|
v
[Mapping to frameworks and follow-up]
|
v
[Insurer questions]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) assemble evidence; (2) answer questionnaires; (3) maintain an evidence pack.
10.1 Evidence pack
Standard, approvals, monthly coverage reports, exceptions register and change records. Together these documents show what Marlowe expects of its devices, who approved it, how far devices meet it each month, and which gaps are knowingly accepted. Seun organises the pack by outcome from the charter, so auditors can find evidence for each one. Each document carries its date and version. The pack is stored where the operations director and the infrastructure team can both reach it, and access is limited to people who need it.
10.2 Questionnaires
Insurance answers cite the pack. When the insurer's questionnaire asks whether disk encryption or MFA is in place, Seun answers with the current figure and points to the document in the pack that supports it, rather than a simple yes. Where the answer is partial, such as warehouse encryption, he states the figure and the replacement plan. The finance director reviews the answers before they are sent, and a copy of the submitted questionnaire is kept in the pack. Answers from one questionnaire are reused for the next only after the coverage figures are refreshed, so the insurer never sees an out-of-date percentage.
10.3 Maintenance
Monthly updates keep it current. Each month Seun adds the new coverage report, any new or closed exceptions and any changes to the standard, with dates. A short checklist names the documents to update and who provides each one: the infrastructure team for servers, the warehouse managers for shared PCs and the endpoint team for laptops. Keeping the pack current means it is ready for an auditor or insurer at any time, not only when a request arrives. Seun checks the pack against this list at month end.
10.4 Honesty
Gaps are disclosed with plans. Disclosing gaps, such as the unencrypted warehouse PCs and the two Linux exceptions, builds more trust with auditors and insurers than claiming full compliance that later proves untrue. Each disclosed gap is paired with its reason, compensating controls and a date for resolution. Seun's mentor Claire points out that an insurer who discovers an undisclosed gap after a claim may dispute the claim, so honest disclosure also protects Marlowe financially. Each disclosure is reviewed when the figures change, so dates stay accurate.
Organising the pack
The evidence pack is a shared folder with a simple index: one section per outcome, with the document, its date and who approved it. Monthly coverage reports are added automatically by a scheduled export. When an auditor asks a question, Seun can point to a specific file rather than writing a new explanation.
Access to the pack is limited, since it shows where weaknesses are.
The pack's owner is named, and a deputy can update it during holidays, so monthly reports keep arriving even when Seun is away.
Mapping to frameworks and follow-up
The pack's index maps each item to CIS Controls v8 safeguards and NIST SP 800-53 Rev. 5 controls, such as CM-2, CM-6, SI-2 for flaw remediation and AC-6 for least privilege, so auditors using either framework find what they need, and insurer questions, which follow similar themes, are easier to answer. Evidence is kept for at least three years to match the audit cycle, with older monthly reports archived rather than deleted. At the follow-up audit the finding is closed, and the auditor notes the clear link between standard, measurement and exceptions as good practice.
Insurer questions
Typical insurer questions ask whether MFA protects admin and remote access, whether backups are tested, whether endpoints run detection software and how quickly critical patches are applied. Seun answers each with a figure from the latest monthly report and a reference to the pack.
Where an answer is partial, such as encryption on warehouse PCs, he says so and attaches the replacement plan.
He keeps a copy of each submitted questionnaire in the pack, so next year's answers can be compared with this year's.
Worked example
The insurer accepts the pack and the premium increase is smaller than feared.
Synthetic case. Figures are synthetic.
Errors and limits
Overstated answers can void cover.
Exercises
- EX046 — Pack contents. List five pack items. Rubric: 3 = five;; 2 = four;; 1 = fewer;; 0 = none.
- EX047 — Overstating. Why avoid overstating answers? Rubric: 3 = void cover;; 2 = trust;; 1 = vague;; 0 = none.
- EX048 — Gap disclosure. How should gaps be presented? Rubric: 3 = with plans;; 2 = listed;; 1 = hidden;; 0 = none.
- EX049 — Maintenance. How often update the pack? Rubric: 3 = monthly;; 2 = regularly;; 1 = never;; 0 = none.
- EX050 — Outcome. What was the insurance outcome? Rubric: 3 = smaller increase;; 2 = accepted;; 1 = vague;; 0 = none.
Synthesis
A maintained evidence pack answers audits and insurers efficiently.
Continue studying — chapter 10 of 12
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →