Glossary · Testing and assessment
Auditors believe records, not reassurances.
The records, logs, exports, documents and observations an auditor relies on to conclude that a control exists and operated as described.
Back to the glossary01 · In plain words
In plain words
The records, logs, exports, documents and observations an auditor relies on to conclude that a control exists and operated as described.
An auditor does not take your word. They take evidence: a ticket showing who approved a change and when, an export of users with their last access review, a training log, a configuration screen. Good evidence is dated, complete, produced by the system rather than retyped, and traceable to the control it supports.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
The quality of evidence decides how fast an audit moves and how clean the result is. Under the AICPA attestation standards, a practitioner needs sufficient appropriate evidence: enough of it, and reliable and relevant enough to support the conclusion. ISO 19011 treats audit evidence as information tied to the audit criteria that can be verified. A control that runs well but leaves no trace looks, to an auditor, much like one that never ran. Evidence gathered as you go also costs far less than evidence rebuilt in the week before fieldwork.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- Population requests
- The auditor first asks for a complete list, such as every production change in the period, then picks samples from it.
- The request list
- Often called a PBC (prepared by client) list: what the auditor needs, from whom, and by when.
- Stage 2 of an ISO certification audit
- Auditors interview staff, observe work and read records to confirm the ISMS operates.
- Tests of controls in a SOC 2 report
- Each test names its method: inquiry, observation, inspection or reperformance.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: undated screenshots at a payroll software company
A payroll SaaS company in Kochi hands its auditor a folder of screenshots for its quarterly access reviews. The images show user lists with ticks beside names, but no date, no reviewer and no system name. The auditor cannot tell which quarter each covers, or whether the list was complete. The team rebuilds the evidence from source: a timestamped export from the identity provider, the review ticket with the reviewer's sign-off and date, and the removal tickets that followed. The same review, now provable, passes.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Documentation
- A policy or procedure describes what should happen. Evidence shows what did happen. Auditors need both, and one never stands in for the other.
- Population and sample
- The population is every instance a control should cover; a sample is the subset tested. Evidence is what each sampled item produces.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- For each control, name the record it leaves and where that record lives.
- Prefer exports from the system over screenshots, and keep the export date.
- Collect evidence through the period, not at the end of it.
- Check every population is complete before you hand it to an auditor.
- GuideEvidence that passesWhat makes an item acceptable: source, date, completeness, owner.
- GuideSampling & deviationsPopulations first, how samples are picked, and what one miss means.
- GuideSOC 2 audit preparationThe auditor's request list, complete populations, and a dry run before fieldwork.
Sources: AICPA AT-C section 205 (examination engagements) on sufficient appropriate evidence; ISO 19011:2018 on audit evidence and audit methods; ISO/IEC 27001:2022 clause 7.5 on documented information.
Questions about Evidence
Is a screenshot acceptable evidence?
Sometimes, if it carries context.
A screenshot that shows the system, the date and the setting in question can work. One cropped to a list with no date usually cannot. Where a system can export a report, auditors tend to prefer the export.
How long should we keep evidence?
At least as long as an audit could look back.
Keep it for the full period an audit could examine, plus any longer retention your own rules or the law require. For a Type 2 report that is the whole observation period. For ISO/IEC 27001, records covering the certification cycle are commonly kept.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.