Auditor Notes Issue 12 · 8 October 2026 From the audit desk at Intagla
What your auditor means by “population”
Six of you asked us this in the last month. When an auditor asks for the population, they mean every item a control touched in the period: every new hire, every access change, every laptop. They pick their samples from that list, so a missing row becomes a finding.
The fix is plain. Export the population from the system of record on the day the period closes, and keep it sealed next to the samples.
Two short items
New in Intagla. Population exports now list every item with the time it was sealed.
From Arjun. Our own auditor asked for 25 samples last month. How we picked them, in one post.
A reader asks
“How long should we keep sealed evidence?” Adaeze, Brightkeel. As long as your auditor looks back, and some contracts ask for more. Page 3 of the readiness guide has the table.
Buyers now ask for a SOC 2 report on the first call. If your first audit window opens this quarter, talk to us before it does.
Book a readiness review
