Illustrative stock imagery from Pexels. Images do not identify the people, premises or events discussed and do not imply endorsement.
Reviewed 26 October 2026. Original publication date retained: 2025-12-03.
A survey describes a defined sample, period and question. It should not be used as proof that a particular retailer lacked a control or that a certificate would have prevented its incident.
Questions to follow in an audit
- Is the survey period and population stated accurately?
- Does the claim distinguish attacks, breaches and confirmed outcomes?
- How is the information used in the organisation's own risk review?
Connect the records with practice
Follow an external statistic from its original publication through a recorded assessment of relevance and any resulting management action.
These are illustrative audit trails, not findings about a named organisation, technical instructions or a guarantee of a particular result. The appropriate evidence depends on the activities, risks and agreed scope. The organisation remains responsible for its operations and legal obligations.
AAA provides independent certification audits. Confirm the applicable standard edition, scope and customer requirements before agreeing a programme. Request an indicative price or discuss your proposed audit.
Further reading: ISO information security.