Firmaprofesional audit statements gap and later amended audit reports

This case concerns Mozilla’s review of Firmaprofesional’s audit statements and whether they met Mozilla and CA/B Forum audit-period requirements. The bug was opened after Kathleen Wilson identified what appeared to be a gap in the CA’s period-of-time audits, with the initial audit coverage ending on 2016-03-09 and the next audit period appearing to start on 2017-01-30. Firmaprofesional responded that it had ordered an audit covering the missing period and later uploaded audit reports for 2016-2017 and 2017, followed by amended ETSI audit reports in October 2018 to fulfill Mozilla’s requirements. Mozilla asked for clarification on a minor non-conformity in the amended reports, and Firmaprofesional explained that the issue was the accessibility of test-pack request instructions, which had been moved into the CPS. The bug was ultimately resolved as FIXED.

1. 2016-03-10 A later audit gap was identified as beginning after this date in the audit coverage described in the thread.
2. 2017-01-30 A subsequent audit period was described as starting on this date, leaving an apparent gap in coverage.
3. 2017-12-24 Firmaprofesional uploaded audit reports covering 2016-2017 and 2017.
4. 2018-10-22 Firmaprofesional uploaded amended ETSI audit reports in Spanish and English.
5. 2018-10-23 Firmaprofesional explained the minor non-conformity noted in the amended audit report.

1. 2017-10-30 Mozilla representative — Kathleen Wilson said Firmaprofesional appeared to have gaps in its period-of-time audits and cited Mozilla and BR audit-period requirements.
2. 2017-11-06 Isigma representative — Firmaprofesional said it learned of the issue via the CCADB reminder and auditor conversations, ordered an audit for the uncovered period, and said it would provide results within the year.
3. 2017-12-24 Isigma representative — Firmaprofesional uploaded audit reports for 2016-2017 and 2017 and said the reports were uploaded.
4. 2018-01-09 Mozilla representative — Aaron updated Salesforce with the audit information and referenced Audit Case #159 and #200.
5. 2018-08-30 Mozilla representative — Kathleen Wilson reminded Firmaprofesional of Mozilla’s audit-report timing and content requirements and said the next audit statements were due by 2018-09-20.
6. 2018-09-17 Isigma representative — Firmaprofesional said it was in the same situation as Consorci AOC, noted there was no gap in the audited periods, and said it had uploaded the Spanish version while waiting for a new report.
7. 2018-10-12 Fastly representative — Wayne Thayer asked when the new audit report meeting Mozilla’s requirements would be provided.
8. 2018-10-15 Isigma representative — Firmaprofesional said the report would be provided during that week.
9. 2018-10-22 Isigma representative — Firmaprofesional uploaded amended ETSI audit reports in Spanish and sworn English translation and said they were intended to fulfill Mozilla requirements.
10. 2018-10-22 Fastly representative — Wayne Thayer asked for an explanation of the minor non-conformity in section 6.9.
11. 2018-10-23 Autoridad de Certificacion Firmaprofesional — Firmaprofesional explained that the test-pack request instructions had been moved into the CPS because they were not easily maintainable on the website.
12. 2019-07-05 Isigma representative — Firmaprofesional posted an attachment marked Action_required, then said the warning disappeared and asked that the comment be disregarded.