3 ms·

I'd guess there's a difference between an external audit performed for regulatory of financial reasons, and an audit by the internal legal team because of a pen

• bravetraveler 4y ago
  There's a very wide gap in what needs to be covered as a result of this consideration! Disaster recovery/business continuity? Absolutely, you need it documented so that someone 'off the street' could be helpful. Implementing yet another service gateway? Probably going to take a lot of conversations with people familiar with the streets involved. Auditors won't care until it's realized. They'll want things like interconnection diagrams -- painting a picture so they can follow your adherence. We have very high compliance requirements where I work -- about half of my time is spent on it. They're less worried about how the bread is made, more that you can keep making bread the way you say you do.