An auditor's control questionnaire covers a document store you run on a managed service; why is "the provider is certified" not an answer?

## What a provider's audit report actually asserts A large provider is assessed by an independent auditor and publishes the result. That report is genuine evidence, and it is evidence about a specific scope: the provider's facilities and their physical access controls, its hardware and the virtualization layer, and the way it operates the services in scope. Two properties of it matter for your questionnaire: - It is scoped to the provider's own layers and the services listed in it, not to your workload. - It is **detective evidence about the past** — an assessment that controls operated over a period. It is not a control that you operate, and describing it as though it prevented anything in your environment is a category error. So "the provider is certified" is a true statement that answers a question the auditor did not ask. The auditor is asking, per row, who satisfies this control for **this** document store, and what proves it. ## Turning the responsibility model into answers The method is mechanical once you accept that every row is really three possible shapes: 1. **Platform-owned rows.** Physical access to the facility, media disposal, hardware maintenance, isolation between tenants at the virtualization layer. Your answer names the provider as the operator and cites its report as the evidence. You do not claim to have performed the control. 2. **Tenant-owned rows.** Data classification and retention, which principals hold access, whether the store is reachable from outside, whether the configuration was reviewed, what the audit record of changes shows. Your answer names your own team and cites your own records. The provider's report is irrelevant here and citing it is the mistake the question is about. 3. **Shared rows.** The interesting ones. A control like "vulnerabilities are remediated in a timely manner" is performed on both sides of the line: the provider patches the layers it owns, and you patch what you shipped and choose when an offered upgrade lands. A shared row is not a row where either party may answer; it is a row where **each side does a different part and each part needs its own evidence**. ## The claim that fails the audit The failure mode has a specific shape. Someone reads a row, recognises that the underlying service is managed, and writes "provider responsibility, see attestation". Later, the row turns out to have been about who could read the documents, or how long deleted documents remained recoverable, or whether the store was reachable from outside the private network. None of those is in the provider's scope, none of them appears in its report, and the exposure — when it happens — is on a service that was, accurately, fully managed and fully patched the whole time. This is the concrete meaning of "managed is not secured". The tier removes operational work below the line. The controls that cause breaches on a managed service cluster above it, because that is where configuration, access and data live. ## What to do before answering - **Read the provider's own responsibility documentation for the specific service.** The line differs by service on the same platform, so the general picture is not enough for a row-by-row answer. - **Read the report's scope section, not its conclusion.** A service you use may simply not be in scope, which turns an assumed platform-owned row into an unevidenced one. - **Name evidence, not intent, for every tenant row.** A configuration review with a date and an owner is evidence; "we follow least privilege" is not. - **Mark shared rows explicitly as shared,** and attach both halves. A shared row silently answered as platform-owned is the same defect as the one above, just harder to spot. ## Where the boundary of this question sits Two neighbouring things are deliberately not the answer here. What the provider commits to in writing about availability, and what remedy you get when it misses, is a contractual question of its own. So is who holds the encryption key and what revoking it makes unreadable. Both come up in the same conversation, and both are separate subjects; this question is only about who performs each control and who can prove it. ## How to answer it in an interview Say what the report evidences and what it is scoped to, then give the three row shapes, then give the failure: a row about access or retention answered as "provider responsibility" on a service that really was managed and really was patched. That last sentence is the one that shows you have filled in one of these questionnaires rather than read about them.