Record the gap and tell the control owner promptly. Determine whether the activity happened without a retained record, did not happen, or cannot be established from available information. Look for legitimate contemporaneous records, such as system logs or approved tickets, and explain their limitations to the auditor. Do not recreate an old approval and present it as original evidence. Fix the retention problem going forward and track any related remediation. The auditor will evaluate the gap in context. Early disclosure gives everyone time to understand the issue; a late collection of unsupported explanations rarely improves it.
Related: SOC 2 audit and compliance hub.
Further reading: NIST control-assessment guidance.
