Audits · What your auditor found
You are allowed to disagree with your auditor, in writing, on the record.
A finding is not a verdict. It is one side of a conversation that ends in a file somebody signs. Asiri keeps both sides — the test, your reply, and the firm’s note on whether your reply holds — because an audit where the client cannot answer back is an inspection.
Two subject requests were answered late with no extension explained
- Raised by Amaka Obiora · 8 Jul
One took 38 days and one 51. The Act allows an extension to three months, but only if the person is told inside the first month why. Neither was told.
- Disputed by Hauwa Sule · 11 Jul
We dispute the second. The 51-day case was a request for records held by a court-appointed receiver, which we do not control. We wrote to the person on day 12 explaining the delay — the letter is not in the register because it went out on letterhead rather than through the system.
- Firm’s note · the dispute is reasonable
The letter has been requested. If it exists and is dated inside the month, the second instance falls away and this becomes a single-case finding at low severity.
Neither side can edit the other's words. Both go into the signed file.
AUD-2026-014 · Veritas Data Compliance
Four findings, and one nobody has replied to
Two accepted in full, one disputed with a reasonable argument, and one still awaiting any answer at all — which is the only one on this list that will hurt you, because silence reads as agreement you would rather not put in writing.
1 unanswered
| Finding | Your response | Who it affects | Remedy owner |
|---|---|---|---|
| HighF-014-1Two activities have no lawful basis, and one claims business interest without a balancing testMarketing to lapsed customers and the referral programme record no basis at all. Anti-fraud screening claims business interest, which requires showing you weighed the customer’s interest against yours — no such test is on file. | Accepted | 41,000 people · ACT-030, ACT-031, ACT-002 · Mailchimp and core banking | Hauwa Suleby 31 Aug |
| HighF-014-3Three suppliers handle personal data with nothing in forceOne never signed. One signed its own standard terms, which are not a processing agreement whatever they say. One let its agreement lapse in March 2025 and continued the work regardless. | Accepted | 96,000 people · Lagos Data Centre, SMS gateway, collections agency | Tunde Balogunby 15 Aug |
| MediumF-014-2Two subject requests were answered late with no extension explainedOne took 38 days and one 51. An extension to three months is allowed, but only if the person is told inside the first month why. Neither was told. | Disputed | 2 people · the second case turns on a letter sent on paper | Ngozi Ezeby 18 Jul |
| MediumF-014-4The DPO’s second semi-annual report was never writtenGAID requires the officer to report to management twice a year, and requires that report to sit where a DPCO can verify it. One exists for the first half of 2025. Nothing exists for the second. | No reply yet | Nobody directly — which is why it has been ignored for two weeks | Unassigneddue 26 Jul |
Every finding traces to a test
Twelve of thirty-four, and the twelve are named
An auditor who says “we reviewed the activity register” has told you nothing you can check. One who says which twelve of thirty-four, chosen how, and what each one showed has given you something you could reperform yourself.
Two of the twelve named a system that had been decommissioned. The register was corrected during fieldwork — and the correction is on your trail, dated, with the auditor’s name on it.
Test T2 · lawful basis on material activities
- Population
- 34 activities
- Sampled
- 12
- How chosen
- All nine high-risk, plus three at random
- Result
- Pass, with correction
- Corrected in fieldwork
- 2 named a decommissioned system
What the file ends in
A qualified opinion is not a failure. A missing one is.
Auditors qualify opinions constantly and the world keeps turning. What ends a conversation with a serious buyer is discovering the opinion exists and was never mentioned — or that the limitations behind it were quietly left out of the copy you sent.
Asiri publishes the file as signed, limitations included, in the auditor’s words rather than yours.
Clean
Nothing material found. Rarer than companies expect, and treated with suspicion by anyone who reads audit files for a living.
Qualified
Sound apart from named exceptions. The exceptions are listed, dated and owned — which is more useful to a buyer than a clean opinion with no detail.
Limited
The auditor could not test something. Kuda refusing an audit request produced exactly this, and the limitation is recorded rather than negotiated away.
Adverse
Serious and systemic. Still better published than hidden — the companies that survive one are the ones that said so before somebody else did.
Your auditor works in your registers, not in a spreadsheet you email
Which means findings arrive tied to the record that caused them, replies land beside the test they answer, and nobody spends a fortnight assembling a pack that is out of date before it is sent.