1
00:00:01,000 --> 00:00:04,170
This accompanies our article on software audits.

2
00:00:04,440 --> 00:00:08,890
A useful finding connects investigation, evidence and conclusion,

3
00:00:08,920 --> 00:00:11,450
while making its limitations explicit.

4
00:00:11,720 --> 00:00:16,170
A fictional dossier contains successful backup job notifications, but

5
00:00:16,280 --> 00:00:17,730
no restore report.

6
00:00:17,960 --> 00:00:21,130
That does not establish whether the application can actually be

7
00:00:21,240 --> 00:00:24,010
restored to a usable state after loss.

8
00:00:24,280 --> 00:00:28,730
Agree the application, environment, records and user action under

9
00:00:28,760 --> 00:00:29,610
examination.

10
00:00:30,120 --> 00:00:32,490
Identify access and limitations.

11
00:00:33,000 --> 00:00:37,130
A limited software audit does not assess every possible defect or

12
00:00:37,160 --> 00:00:39,490
security weakness across the product.

13
00:00:39,720 --> 00:00:43,090
The available notifications support that jobs ran.

14
00:00:43,320 --> 00:00:47,450
Without a recovery test, restoration remains unconfirmed.

15
00:00:47,640 --> 00:00:51,290
That differs from claiming every backup is defective or that the

16
00:00:51,320 --> 00:00:53,290
original data has been lost.

17
00:00:53,560 --> 00:00:57,850
Suppose an agreed recovery test stops because the destination lacks a

18
00:00:57,880 --> 00:00:59,730
required database function.

19
00:00:59,960 --> 00:01:03,610
That demonstrates a failure in the tested route, with a specific

20
00:01:03,880 --> 00:01:06,170
environment and reproducible step.

21
00:01:06,440 --> 00:01:10,490
Consider consequences for the process, available alternatives and

22
00:01:10,520 --> 00:01:11,530
recovery needs.

23
00:01:12,040 --> 00:01:14,810
Record uncertainty alongside priority.

24
00:01:15,240 --> 00:01:19,095
A generic severity colour without supporting reasoning does not tell

25
00:01:19,120 --> 00:01:20,890
the team where work should begin.

26
00:01:21,400 --> 00:01:24,650
Assign an owner for the environment requirement and recovery

27
00:01:25,000 --> 00:01:25,530
instructions.

28
00:01:26,040 --> 00:01:28,010
Repeat the agreed test fully.

29
00:01:28,440 --> 00:01:32,010
A successful import alone does not establish that the selected

30
00:01:32,040 --> 00:01:34,170
application task works correctly.

31
00:01:34,600 --> 00:01:38,970
Record evidence source, version, limitation and next action.

32
00:01:39,480 --> 00:01:43,930
Agree additional tests beforehand; read access does not authorise

33
00:01:43,960 --> 00:01:45,850
disruptive tests in production.

34
00:01:46,440 --> 00:01:51,450
Our source article on software audits explains scope, evidence, impact

35
00:01:51,560 --> 00:01:55,770
and verification, helping teams distinguish supported findings from

36
00:01:55,800 --> 00:01:58,490
assumptions before choosing improvements.