Question 1

What evidence do auditors ask for on AU-16 Cross-organizational Audit Logging. Employ [organization-defined] for coordinating [organization-defined] among external organizations when audit information is transmitted across organizational boundaries?

Accepted Answer

Agreements with each external organisation covering audit information exchanged across the boundary; The defined methods for coordinating audit information, such as agreed formats, identifiers and time base; Evidence that audit information transmitted externally preserves the identity of the originating subject; Records of audit information actually exchanged during the period; Points of contact on both sides for audit coordination and dispute.

Question 2

Can AU-16 be evidenced continuously rather than by periodic review?

Accepted Answer

This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.

Question 3

What is the most common gap auditors find on AU-16?

Accepted Answer

Logs shared with a provider under contract while no method exists to correlate their records with yours

`AU-16` Cross-organizational Audit Logging. Employ [organization-defined] for coordinating [organization-defined] among external organizations when audit information is transmitted across organizational boundaries

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet