Skip to main content
Part of Lumos Launchpad: Access Reviews, step 1.
Auditors need to trust the data behind your access reviews. This guide shows you how to prove the completeness and accuracy (C&A) of that data, and how to keep the yearly effort small.
The short version
  1. Validate each Lumos connector once, when you first turn it on.
  2. After that, rely on Lumos’s SOC reports for ongoing assurance. Get them from the Lumos Trust Center.
  3. Each audit cycle, focus your own testing on what you control: scoping, configuration, reviewer actions, and systems that aren’t integrated.

​
What C&A means

For SOX 404, SOC 2, and similar audits, auditors verify two things about the data in your access reviews:
  • Completeness: every in-scope user, entitlement, and system is included.
  • Accuracy: the data matches the source systems.
Lumos pulls this data straight from your source systems through authenticated API integrations. Every sync is logged with timestamps, record counts, and status. That’s stronger evidence than spreadsheets, CSV exports, or screenshots.

​
Validate each connector once

Do this when you first enable a connector, not every audit cycle. Save the evidence. You’ll point to it in every later audit.
1

Define your scope

For each in-scope system, write down: the system and its purpose, how it connects (Lumos integration, SCIM, or manual upload), the fields Lumos pulls, how often it syncs, and whether service accounts and non-human identities are in or out of scope. If you exclude anything, record why.
2

Check completeness

Compare the active user count in Lumos with the count in the source system’s admin console, at the same point in time. Filter both lists to in-scope accounts first, so excluded accounts never show up as a variance. The target is zero variance. Small timing gaps between syncs are the only acceptable cause, and you should record the sync timestamps that explain them.Record the Lumos count, the source count, the variance and its cause, who did the check, and the date. This reconciliation is your main completeness evidence.
3

Check accuracy

Sample 25 to 30 users. For each one, confirm that name, email, employee ID, roles and permissions, and active or inactive status match between Lumos and the source. Record the result and explain any variance.
4

Document the integration

Capture the authentication method, fields pulled, filters, sync frequency, how sync failures are alerted, and where the sync log lives. Most of this is in the Lumos admin console. Give this summary to your auditor so they don’t need a walkthrough for every system.
Spreadsheet comparisons go faster with a diff tool or an approved AI tool that can flag mismatches and group them. Follow your company’s data policies, and have a person review and sign off on the result.

​
Each audit cycle

Keep this light. Repeat full connector testing only when something material changes, such as a new connector, an identity provider migration, or a schema change.
  1. Download Lumos’s latest SOC reports and any bridge letter from the Lumos Trust Center.
  2. Confirm you meet the complementary user entity controls (CUECs) listed in the report, and document it.
  3. Share the SOC report with your auditor early and propose relying on it for the connector layer.
  4. Review sync health for the year and confirm there are no unresolved sync failures for in-scope systems.
  5. Validate any connectors or source systems you added or changed during the year.
  6. Apply heavier procedures to systems that aren’t integrated, such as flat files or manual extracts.
  7. Archive the SOC report, bridge letter, reliance memo, and sync health summary.

​
Answering common auditor questions

Treat each request as a risk-based conversation.
The data comes from the source systems through authenticated APIs, so there’s no manual step where users can drop out. We reconciled each connector’s population when we enabled it, and the sync logs show successful syncs with record counts. For ongoing assurance, we rely on Lumos’s SOC reports.
We sampled users against the source systems when we set up each connector. The data flows from the source by API with no manual changes, so the risk of accuracy errors is much lower than with manual extracts. For ongoing assurance, we rely on Lumos’s SOC reports instead of retesting every cycle.
Lumos already pulls the same data a raw export would contain, without the manual handling risk. We have our initial reconciliation and sampling on file. We’re glad to pull specific users for your sample or give you targeted access. A blanket export of every system duplicates what the integration does and adds its own risk.
Screenshots only show one moment and are hard to verify. The integrations produce system-generated audit trails with timestamps, record counts, and sync status. We can provide screenshots for a targeted sample.
We can walk you through a live sync, show the fields returned, and check a few users together in real time. We can also share Lumos’s SOC reports from the Lumos Trust Center.
For flat-file uploads and manual extracts, we apply heavier procedures: row-count checks, spot-check accuracy testing, documented chain of custody, and a second review before loading. SOC report reliance doesn’t extend to these systems.

​
Pre-audit checklist

  • Latest Lumos SOC reports and bridge letter downloaded from the Lumos Trust Center
  • CUECs reviewed and confirmed
  • SOC report shared with your auditor, with reliance proposed
  • Sync health reviewed for all in-scope systems
  • Scope document updated for new systems or changes, with revalidation where needed
  • Non-integrated systems identified and their manual controls documented
  • Service accounts and non-human identities accounted for, with your rationale
  • Remediation evidence on hand for any access revoked during the period
  • Evidence package organized: SOC report, reliance memo, sync logs, scope document, integration summaries, and sample results
For audit-prep help, contact your Customer Success Manager.