They should be providing all that information regularly to auditors anyway. If they don’t have it handy, then their IT leadership should be replaced.