Which item is NOT typically included in CBP audit documentation?

• A. Marketing brochures
• B. Security policies
• C. Training records
• D. Incident reports

Answer: (A)

CBP audit documentation focuses on evidence of a company’s security controls and how those controls are implemented and maintained. Documents that show the security framework and day-to-day compliance—such as security policies that outline rules and responsibilities, training records that prove personnel are educated on security procedures, and incident reports that document events and the actions taken to investigate and remediate them—are central to demonstrating a secure, compliant program. Marketing brochures, while useful for business purposes, do not provide evidence of security practices or responses, so they are not typically included in the audit file.