Running a data audit that a regulator or client can't poke holes in

Sector-specific layers stack on top: accounting firms handling audit data face SOX (Sarbanes-Oxley Act) record-keeping rules; firms serving healthcare clients may touch HIPAAHIPAAHealth Insurance Portability and Accountability Act, loi américaine imposant la protection des données de santé (PHI). Violations : amendes jusqu'à 1,9M$ par catégorie de violation.-covered data even indirectly; firms serving EU financial clients may need to demonstrate DORA (Digital Operational Resilience Act, EU, applicable since January 2025) compliance from their vendors, including advisory firms in the supply chain.

The regulator you should assume is watching: in the EU, national Data Protection Authorities (DPAs, such as Ireland's DPC or France's CNIL) enforce GDPR. In the US, the FTC (Federal Trade Commission) enforces against unfair or deceptive data practices, and state attorneys general enforce CCPA-type laws.

The four things every audit actually checks

Strip away the jargon and every client due-diligence questionnaire or regulatory review converges on four evidence categories.

1. Access logs

Who touched what data, and when. Not "we have access controls," but a timestamped, exportable log.

Minimum bar: for any client file containing personal or financial data, you should be able to produce, within an hour, a list of every user who accessed it in the last 12 months.

Cloud platforms (Microsoft 365, Google Workspace) generate this natively, but most firms never turn on the retention settings needed to keep logs longer than 90 days. Fix that before an audit lands, not after.

2. Retention proof

A data retention schedule states how long each data category is kept and why, plus the deletion mechanism. "We delete client data when the engagement ends" is not proof. Proof is: a policy document, a system configuration showing automatic deletion after N days, and a sample deletion log.

GDPR's storage limitation principle (Article 5(1)(e)) requires data be kept "no longer than necessary." Auditors will ask for your schedule and then spot-check a real file against it.

3. Breach drill records

Both GDPR (Article 33) and most US state laws require notifying regulators, and sometimes affected individuals, within a fixed window after discovering a breach (72 hours under GDPR). You cannot hit that window without a rehearsed process.

What auditors want to see: a written incident response plan, a record of at least one tabletop exercise (a simulated breach walkthrough) in the past 12 months, and named roles (who calls the regulator, who calls the client, who calls counsel).

4. Vendor and sub-processor mapping

Professional services firms routinely hand client data to a transcription vendor, an AI drafting tool, a cloud host. Under GDPR, each of these is a sub-processor, and you need a signed Data Processing Agreement (DPA) with each one, plus a current list of who they are.

If a firm uses an AI tool to summarize client contracts, the audit question is blunt: does that tool's provider train its models on your inputs? If you don't know, that's a finding.

A mock audit walkthrough

Picture a client due-diligence request landing on a 40-person advisory boutique. The five checks a competent reviewer runs, in order:

1. Data inventory: request a list of what personal/client data is held, where (which systems, which country), and why. Firms without this documented lose points immediately.

2. Access control sample test: pick one sensitive file, ask for the access log, cross-check against the list of staff who should have access.

3. Retention spot check: pick a closed engagement from 3 years ago, ask why that data still exists or where the deletion record is.

4. Breach drill evidence: ask for the date and outcome of the last tabletop exercise.

5. Sub-processor list: ask for the DPA covering the firm's cloud storage and any AI tools in use.

A firm that can answer all five in writing, with dated evidence, clears in a day. A firm improvising answers triggers a longer, more adversarial review, or a rejected bid.

The UK Information Commissioner's Office publishes a practical self-assessment tool that mirrors this exact structure: ICO Accountability Framework.

Building the audit file before you need it

The fix is not a one-time scramble but a standing folder, reviewed quarterly, containing:

• Current data inventory (spreadsheet or data mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète →, updated when engagements open/close)
• Retention schedule with linked deletion logs
• Access log export capability, tested at least twice a year
• Signed incident response plan plus record of the last drill
• Current DPA list for every vendor and AI tool touching client data

A useful discipline: treat this like a filing cabinet a stranger could audit with zero explanation from you. If a document requires you to talk them through it, it's not audit-ready.

Key Takeaways

• Client due-diligence and regulatory audits both converge on four evidence types: access logs, retention proof, breach drill records, and vendor/sub-processor mapping. Have all four on file, dated, before a request lands.
• GDPR's 72-hour breach notification clock (Article 33) and its storage limitation principle (Article 5(1)(e)) are the two rules that most directly test whether your operational practices, not just your policies, hold up.
• Cloud tools (Microsoft 365, Google Workspace) can generate access logs automatically, but retention settings must be configured deliberately, most firms don't do this until it's too late.
• Every AI tool or vendor touching client data needs a signed DPA and a documented answer to "does this provider train on our data?" Missing this is one of the most common audit failures in 2026.
• Run your own mock audit quarterly using the five-step walkthrough above. Firms that rehearse this clear real reviews in a day; firms that don't lose deals to firms that did.