What is evidence integrity?

Why it matters

Most audit evidence is produced by the organisation being audited. SOC 2 auditors call this information produced by the entity, and before relying on it they test whether it is complete and accurate. Evidence that can be shown to be unchanged since collection is easier to rely on.

ISO 27001 asks for the same thing in general terms. Clause 7.5.3 requires documented information to be protected, including against loss of integrity, and Annex A 8.15 requires logs to be produced, stored, protected and analysed.

Integrity matters outside audits too. After an incident, records may be needed by a regulator, an insurer or a court, and their value depends on showing that nobody changed them.

How integrity is shown

The usual technique is a cryptographic hash. When evidence is collected, a hash function such as SHA-256 produces a short fingerprint of the file. Changing even one byte produces a different fingerprint, so recomputing the hash later shows whether the file is the same.

A hash on its own could be replaced along with the file. To prevent that, each log entry can include the hash of the entry before it, forming a chain. Altering any earlier entry breaks every link after it, which is what makes the log tamper-evident.

• Hash at collection. Record the fingerprint as soon as the evidence is captured.
• Record the source. Note which system it came from, who or what collected it, and when.
• Restrict changes. Limit who can edit or delete evidence, and log every change.
• Verify on request. Be able to recompute hashes and check the chain when an auditor asks.

Tamper-evident and tamper-proof

Tamper-evident means a change can be detected. Tamper-proof would mean a change is impossible, and few systems can honestly claim that, because someone with enough access to the underlying storage can usually alter data. When a vendor says tamper-proof, ask who holds that access.

Integrity says nothing about relevance. A perfectly preserved screenshot of the wrong setting is still the wrong evidence, so integrity sits alongside, and never replaces, checking that evidence fits the control.

In Certifyi, the tamper-evident activity log means what this section says: a later change to an entry can be detected.

Related terms

Evidence

Any record that shows a control operated: a configuration export, a ticket, a signed policy, an access review. Auditors sample evidence across the period they are reporting on.

Attestation report

An independent auditor’s written opinion on whether an organisation’s controls are designed, and in a Type II report operating, as described. A SOC 2 report is an attestation, not a certificate.

Observation period

The window, usually three to twelve months, over which a SOC 2 Type II auditor tests whether controls operated. It starts once the controls are in place.

Control

A specific safeguard or activity that reduces a risk, such as requiring MFA on privileged accounts or reviewing access every quarter. Frameworks are, in large part, lists of controls.