Sri Lanka CERT – Audit Statement Delay Explanation Letter
This case is a submission by Sri Lanka CERT to explain a delay in issuing WebTrust Assurance Reports for an audit period from 15 May 2025 to 31 August 2025. The Mozilla Root Store Policy expectation cited in the bug is that the reports should have been issued by 30 November 2025, but they were not issued by that deadline. The delay is attributed to administrative circumstances affecting the auditor, specifically the migration of the WebTrust Practitioner’s License from BDO Consulting Sdn Bhd to BDO PLT, which required additional administrative processes such as contract revisions and onboarding procedures. The submitter states that the audit process, scope, and quality were not impacted and that there were no security incidents, control failures, or certificate mis-issuance events associated with the delay. The explanation letter and relevant audit documentation were attached and updated in CCADB for review. The bug is currently marked as UNCONFIRMED.
- WebTrust Assurance Reports for the audit period (15 May 2025 to 31 August 2025) were expected to be issued by this deadline but were not.
- Sri Lanka CERT submitted an explanation letter in Mozilla Bugzilla regarding the audit report issuance delay.
- Cert representative — Created the bug and attached an explanatory letter stating the report delay was due to administrative migration of the WebTrust Practitioner’s License from BDO Consulting Sdn Bhd to BDO PLT, and that the audit process/scope/quality were not impacted.