WEBVTT

00:00:01.000 --> 00:00:04.170
This accompanies our article on software audits.

00:00:04.440 --> 00:00:08.890
A useful finding connects investigation, evidence and conclusion,

00:00:08.920 --> 00:00:11.450
while making its limitations explicit.

00:00:11.720 --> 00:00:16.170
A fictional dossier contains successful backup job notifications, but

00:00:16.280 --> 00:00:17.730
no restore report.

00:00:17.960 --> 00:00:21.130
That does not establish whether the application can actually be

00:00:21.240 --> 00:00:24.010
restored to a usable state after loss.

00:00:24.280 --> 00:00:28.730
Agree the application, environment, records and user action under

00:00:28.760 --> 00:00:29.610
examination.

00:00:30.120 --> 00:00:32.490
Identify access and limitations.

00:00:33.000 --> 00:00:37.130
A limited software audit does not assess every possible defect or

00:00:37.160 --> 00:00:39.490
security weakness across the product.

00:00:39.720 --> 00:00:43.090
The available notifications support that jobs ran.

00:00:43.320 --> 00:00:47.450
Without a recovery test, restoration remains unconfirmed.

00:00:47.640 --> 00:00:51.290
That differs from claiming every backup is defective or that the

00:00:51.320 --> 00:00:53.290
original data has been lost.

00:00:53.560 --> 00:00:57.850
Suppose an agreed recovery test stops because the destination lacks a

00:00:57.880 --> 00:00:59.730
required database function.

00:00:59.960 --> 00:01:03.610
That demonstrates a failure in the tested route, with a specific

00:01:03.880 --> 00:01:06.170
environment and reproducible step.

00:01:06.440 --> 00:01:10.490
Consider consequences for the process, available alternatives and

00:01:10.520 --> 00:01:11.530
recovery needs.

00:01:12.040 --> 00:01:14.810
Record uncertainty alongside priority.

00:01:15.240 --> 00:01:19.095
A generic severity colour without supporting reasoning does not tell

00:01:19.120 --> 00:01:20.890
the team where work should begin.

00:01:21.400 --> 00:01:24.650
Assign an owner for the environment requirement and recovery

00:01:25.000 --> 00:01:25.530
instructions.

00:01:26.040 --> 00:01:28.010
Repeat the agreed test fully.

00:01:28.440 --> 00:01:32.010
A successful import alone does not establish that the selected

00:01:32.040 --> 00:01:34.170
application task works correctly.

00:01:34.600 --> 00:01:38.970
Record evidence source, version, limitation and next action.

00:01:39.480 --> 00:01:43.930
Agree additional tests beforehand; read access does not authorise

00:01:43.960 --> 00:01:45.850
disruptive tests in production.

00:01:46.440 --> 00:01:51.450
Our source article on software audits explains scope, evidence, impact

00:01:51.560 --> 00:01:55.770
and verification, helping teams distinguish supported findings from

00:01:55.800 --> 00:01:58.490
assumptions before choosing improvements.