hardScenarioMidSeniorStaffLead
You were audited a year ago and the product has changed a great deal since. A customer asks whether your newest service is covered. What do you tell them?
6 min readUpdated 2026-08-15Target archetype: Product Startup, Enterprise Captive
Answer
Short answer
Say what the scope statement covers and what it does not, because a report or certificate covers named systems over a stated period and your newest service is probably in neither.
Was this answer helpful?
Likely follow-ups
- The new service applies exactly the same controls but was not in the audit. Does that count for anything?
- How would you decide whether to extend scope now or wait for the next audit cycle?
- A customer's security team asks for evidence covering last month specifically. What can you give them?
- You acquire a company with its own certificate. What can you claim about the combined organisation?
Related questions
- What is the difference between SOC 2 and ISO 27001, and what does an auditor accept as evidence?mediumAlso on soc-2 and iso-270016 min
- A customer asks how you meet a control your cloud provider handles. What can you claim from their certification?mediumAlso on iso-270016 min
- You are asked to design a product that does not exist, and the setup is missing details you would need in real life. Do you point that out?mediumSame kind of round: scenario5 min
- Your only contact is an architect who loves the product and cannot get you in front of anyone with a budget. What do you do next, and when do you stop?hardSame kind of round: scenario6 min