The IS auditor should be most concerned if completeness testing has not been performed on the log data, as this could indicate that some logs are missing, corrupted, or tampered with, and that the log aggregation system is not reliable or accurate12. Completeness testing is a process of verifying that all the logs generated by the source systems are successfully collected, transferred, and stored by the log aggregation system, and that there are no gaps or inconsistencies in the log data34. Completeness testing is essential for ensuring the integrity and validity of the log data, and for supporting the risk management practices of the organization.
References
1: Log Aggregation: How it Works, Methods, and Tools - Exabeam2 2: Log Aggregation & Monitoring Relation in Cybersecurity4 3: Log Aggregation: What It Is & How It Works | Datadog3 4: Data Flow Testing - GeeksforGeeks1