CodeForge Inc. discovers missing access logs while preparing for a Service Organization Control 2 (SOC 2) Type II audit. What is the most appropriate assessment conclusion?

### Why this is right Missing access logs mean the organization may be unable to show who accessed systems or determine what happened during a relevant period. Assessors should record the gap, evaluate its risk, and identify corrective actions rather than infer that access was safe. ### The concept An assessment compares actual practices and evidence with expected requirements. A missing record is an evidence gap, and it may also signal that logging controls are not operating as intended. It does not by itself prove a breach or prove that no breach occurred. The organization should investigate the cause, preserve available evidence, and establish reliable logging. ### The other options - **B. The organization has proved that no unauthorized access occurred.**: Missing evidence cannot establish that access was authorized. - **C. The organization should delete remaining logs to make records consistent.**: Deleting evidence worsens traceability and can undermine an investigation. - **D. The missing logs establish that the organization is compliant.**: The gap makes it harder, not easier, to demonstrate compliance. ### Terms - **SOC 2**: Service Organization Control 2. An audit and reporting framework concerning controls at service organizations. ### Remember A missing record is a gap to investigate, not evidence that nothing happened.