Security Audit Report

Detects populated security audit and assurance reports (SOC 2 Type I/II, ISO/IEC 27001 audits, SSAE 18, IRAP and security control assessments) that carry finding/exception references, severity ratings, technical evidence (hosts, IPs, CVEs) or audit scope details. Phrase-only mentions stay discovery-only.

Type

regex

Confidence

medium

Confidence justification

Enforce tiers require populated finding, rating, technical or scope fields beside the audit-report phrase; vendor assurance pages, SOC 2 explainers and certification news stay at 65. Medium because redacted public trust-centre summaries can still carry scope fields. Removed clearance-vetting terms (NV1/NV2/AGSVA) that did not relate to audit reports.

Jurisdictions

global

Regulations

Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth)

Frameworks

ISO 27001, NIST CSF, PCI-DSS

Data categories

security, audit

Scope

narrow

Risk rating

8

Corroborative evidence keywords

control objective, control activity, trust services criteria, Statement of Applicability, Annex A, exception noted, qualified opinion, operating effectiveness, complementary user entity controls, bridge letter

Proximity: 300 characters

Should match

• SOC 2 Type II report - CONFIDENTIAL Service organisation: Cloudbank Payments Pty Ltd Audit period: 01/07/2025 to 30/06/2026 Exception ID: EX-04 Severity: High Control CC6.1: 3 of 40 terminated users retained VPN access on host vpn01.corp (10.20.30.40). Exception noted; operating effectiveness not achieved for this control activity. — Populated SOC 2 report - scope, exception, severity, host evidence and control reference (85)
• Security audit report Lead auditor: Priya Ramanathan Fieldwork was completed at the Brisbane office. — Report with a single populated scope field (75)
• ISO/IEC 27001 certification audit - Stage 2 report Audited entity: Bayside Logistics Pty Ltd Report date: 18/09/2026 NC No: NC-2026-03 Classification: Minor Annex A control A.8.8 (management of technical vulnerabilities): CVE-2024-3400 remained unpatched on fw02.internal for 47 days. Nonconformity raised; corrective action request due within 90 days. — ISO 27001 Stage 2 audit with nonconformity reference, grading, Annex A control, CVE and host evidence (85)

Should not match

• Fact sheet: a SOC 2 Type II report tests whether controls operated effectively over a period. Ask vendors for their latest report and check the trust services criteria and any exceptions. — Explainer naming the report type without values
• SECURITY AUDIT REPORT Audited entity: __________ Audit period: __________ Finding ID: __________ Severity: __________ — Blank report form - placeholder values
• The company said its ISO 27001 certification audit found no major issues, according to a statement released on Monday. — Certification news item
• Security guard audit of premises — Unrelated
• Home security system review — Unrelated
• The public assurance page links to a security audit report. — Public page reference
• Template example: security audit report with control objective, Annex A, high risk finding, audit exception, and required action. — Template framing

Known false positives

• Vendor trust-centre pages and SOC 2 / ISO 27001 explainers. Mitigation: No populated finding, rating, technical or scope fields, and guidance framing is excluded.
• Penetration test and vulnerability reports that mention an audit framework. Mitigation: They can reach 75/85 through technical evidence; they are equally sensitive.

References

• ACSC Information Security Manual (ISM)
• APRA CPS 234 Information Security