Audits and filing · Evidence requests

Four of the seven answered before anybody read the email.

Your auditor raised seven items for the 2026 return. Four were already sitting in registers Asiri reads, so they answered themselves with a provenance label attached. Two needed a person. One had nothing behind it at all — and said so rather than producing a paragraph.

See how it works What your auditor found

EV-2026-04 · raised by Chidi Anozie, Veritas

4 answered from registers · 2 by a person · 1 gap

01
A register of what you do with personal data
Twelve activities returned from the register, each with the system it was read from.
Read
02
Every supplier that handles personal data
Nine suppliers and nineteen sub-processors, with the state of each agreement.
Read
03
Transfers out of Nigeria and their mechanisms
Seven active transfers returned. TR-014 has nothing on file, and that is stated rather than left blank.
Read
04
Your incident record for the period
Two incidents, with the notification timestamps the clock produced.
Read
05
The board’s statement on data protection
Written by the DPO and signed. Nothing generates a signature.
A person
06
That your DPO is independent of the processing
Answered from the people register — and rejected. He also owns fraud operations.
Rejected
07
The DPO’s second semi-annual report for 2025
Nothing exists. Returned as a gap with the reason, not assembled from adjacent material.
Gap

Answered from a register · 4Needed a person · 2Nothing behind it · 1

EV-2026-04 · item 6, rejected

An answer that satisfies the question can still fail the test

You answered that your DPO is independent of the processing, and named him. That is true as far as it goes. The auditor rejected it anyway — and the rejection is the more useful document.

What you sent

Your DPO is independent of the processing

Tunde Adeyemi is named to the Commission, reports to management twice a year, and holds the officer role formally. Every box the question asks about is ticked.

Answered from the people register

Why it was refused

He also owns fraud operations

Which makes him the person deciding how a monitoring activity runs and the person assessing whether it is lawful. That is a self-review conflict rather than an independent appointment — and no amount of formal title fixes it.

Rejected by Chidi Anozie · 23 Jul · recorded on your trail

Asiri keeps the rejection beside the answer permanently. A pack that shows only accepted responses is a pack that has been curated, and any auditor who has seen one before will assume the rest of it was too.

Four tiers, printed on every answer

A screenshot is never shown as a system read

Every answer carries how it was obtained, and the label is assigned by the mechanism rather than chosen by the person answering. A control satisfied by somebody's declaration can never look like one satisfied by a read — which is the single thing that makes an evidence pack worth accepting.

Where reads come from

Verified
read from a system
Read from a connected system at a stated time, not retyped by anybody. The strongest thing an answer can be.
Structurally verified
shape read, contents never
The system reported counts and field names and nothing else. Enough to prove a register is complete without copying what is in it.
Declared
you told us
Somebody typed it and nothing checked it. Perfectly legitimate for a board statement; useless as proof of a control.
Missing
nothing behind it
Asked for and not supplied. Shown as a gap rather than quietly omitted, because an omission is what an auditor goes looking for.

Serving a client with nothing connected

The honest answer to item seven was "nothing exists"

The auditor asked for the DPO's second semi-annual report. There isn't one. Asiri returns that as a gap with the reason, rather than assembling a plausible-looking document from adjacent material — which is what a template pack does, and what gets a whole file treated as unreliable.

A gap declared costs you one finding. A gap papered over costs you the auditor's confidence in the other six answers.

Talk to us

What an evidence request costs, either way

Assembled by hand: A fortnight of somebody senior, and a pack that is out of date the day after it is sent.
Assembled from registers: Four of seven answered instantly, with provenance the auditor can check rather than trust.
A gap declared: One finding, with an owner and a date. Costed, survivable, and over.
A gap papered over: The other six answers re-examined, and a limitation on the opinion that follows you into every buyer conversation for a year.