Chapter 4 of 13 · Weeks 1–4
Evidence That Survives an Audit
- What counts as evidence?
- Is a screenshot enough?
- How do I stop the last-minute evidence scramble?
Evidence is anything that shows a control did what it claims. An auditor wants to see that the control is designed sensibly and that it actually ran during the period they are checking.
What good evidence shows
- What ran: the control, by name or ID.
- When: a date and time that falls inside the audit period.
- On what: the systems, people or records in scope.
- Who did it or approved it.
- The result, including any exceptions and what happened to them.
A screenshot can be good evidence if it shows all of that. A cropped screenshot with no date, no system name and no context is weak, because it could come from anywhere. An exported report, a ticket with an approval, or a log with timestamps is usually stronger.
Stop the scramble
- For each control, write down what evidence it produces and where that evidence lives.
- Agree a schedule with each control owner: monthly, quarterly or per event.
- Store evidence in one place, named consistently: control, period, date.
- Check a sample yourself each month. Ask: would a stranger understand this?
- Record gaps as soon as you find them, rather than hoping to fill them later.
The question you might not ask out loud
A team sent me evidence from last week for a control that should have run all year. What do I do?
Do not present it as if it covers the year. Ask what happened before. If the control did not run, that is a finding, and it is better that you find it than the auditor. Record it, fix it, and keep the honest history.
Rule of thumb:Never create evidence after the fact and date it to look older. Backfilled or altered evidence turns a small gap into an integrity problem, and auditors are trained to spot it.
Sampling, in plain words
Auditors rarely check every record. They pick a sample, such as some leavers from the year, and ask for proof each one was handled. You should do the same check yourself first. If your own sample fails, you have time to understand why.
Evidence also expires in practice. A penetration test from two years ago or an access review from last spring may not speak to the current period. Track when each piece of evidence goes stale, just as you track when a policy is due for review.