Most companies accept audit reports at face value. Green checkboxes across the board, zero findings, everything conforming. That sounds like good news. It isn’t.

In this session, Cheri Hotman is joined by Tanya Wade, Brittany Schroeder, and Ja’Kayla Lovelace to do something different: pull up a real (fully anonymized) HIPAA compliance audit report and walk through it line by line as practitioners. What they find is a masterclass in what audit theater actually looks like up close.

The team breaks down the specific red flags: a scope section that describes methodology instead of actual systems and data flows, a risk analysis finding marked “conforming” with zero detail on how it was conducted or when it was last updated, evidence descriptions that simply say “reviewed and deemed sufficient” for controls that can’t be validated through an API, and a contingency plan marked complete with no proof it was ever actually tested.

The bigger problem isn’t just the report itself. It’s what happens when organizations rely on it. If everything looks fine on paper, there’s no case for budget. No push to fix gaps. No visibility into what’s actually exposed. A false sense of security, as Cheri puts it, is more dangerous than doing nothing at all.

Third party risk management has the word “risk” in it for a reason. If a report can’t help you reduce that risk, it isn’t worth the paper it’s printed on.

This one is required viewing for anyone responsible for vendor due diligence, compliance oversight, or GRC program integrity.