An external audit team is evaluating controls at a private equity portfolio company that uses a new acquisition ERP integration. The operating partner provides screenshots, user lists, and vendor reports, but the evidence is incomplete for SOC 2. Which procedure or conclusion is most appropriate?
