Field notes
Writing from the audit room
Short pieces on evidence habits, interview timing, and the decisions that show up again and again when organisations commission an audit of applications.
What belongs in an application inventory before auditors arrive
How to build an application inventory that survives an audit of applications — owners, environments, and the fields that actually get tested.
Sampling privileged access without drowning in exports
Practical notes on privileged access sampling during an audit of applications — window selection, HR matching, and emergency accounts.
Timing evidence requests around Japanese fiscal calendars
Why application audit evidence requests should respect fiscal closes, Golden Week, and change freezes when planning an audit of applications in Japan.
When a restore log is not a restore test
Distinguishing backup success messages from restore evidence in an audit of applications — what auditors look for and how to prepare.