TheRequired auditor may have to generate this list on the basis of interviews if one is not available.
The auditor can provide this list.
Privacy and security are not factors companies need to worry about.