Evidence is more than a policy
A policy shows intended direction. Auditors also look for proof that responsibilities, risk decisions and controls operate. Evidence can be a record, configuration, ticket, report, meeting decision, sampled transaction, system output or interview supported by observable practice.
Four qualities of useful evidence
- Relevant: it supports the specific requirement or control being evaluated.
- Attributable: the source, owner, period and scope are clear.
- Current: it reflects the review or operating frequency expected for the control.
- Traceable: the auditor can connect it to risk, policy, procedure and corrective action.
Evidence examples by control cycle
Access management: approved requests, role mappings, privileged-account inventory, periodic access reviews and leaver closure records. Vulnerability management: scan scope, findings, risk decisions, remediation tickets, exception approvals and retest results. Backups: configuration, monitoring, failed-job response and restore-test results. Incidents: classification, chronology, decisions, evidence handling, communications and lessons completed.
Create an evidence register
For each applicable control, record the owner, evidence description, source system, expected frequency, storage location, access restriction, current period and status. Avoid copying sensitive evidence into unnecessary repositories; a controlled reference to the authoritative system may be better.
Use sampling intelligently
Recurring controls rarely require every transaction to be exported. Define a representative sample across the audit period, systems, locations and risk levels. Retain enough information to reproduce the selection and explain exceptions.
Common evidence failures
- Documents have no approval, owner or review date.
- Evidence covers only the week before the audit.
- A control is mapped to a tool licence rather than an operating process.
- Exceptions are hidden instead of risk-assessed and corrected.
- Evidence contains excessive personal or confidential data.