What is evidence?

What counts as evidence

Good evidence is specific to a control, dated and traceable to the system it came from. A screenshot of an MFA setting shows it was on at one moment. A timestamped export of the identity provider’s policy, kept every quarter, shows it stayed on.

• System records. Configuration exports, logs, alerts and reports pulled from the systems in scope.
• Tickets and approvals. Change requests, access requests and incident tickets showing who approved what and when.
• Documents. Policies, procedures and plans, with version history and approval.
• Records of activity. Completed access reviews, training records, policy acknowledgements and meeting minutes.

How auditors use it

For a control that runs many times, the auditor asks for the population, such as every new joiner in the period, and selects a sample. For each item they check that the evidence shows the control ran as described. A missing or late record becomes an exception in a SOC 2 report or a finding in an ISO audit.

Auditors also check that the population is complete and accurate. A list of joiners exported from the HR system is more convincing than one typed up for the audit, because the auditor can see where it came from.

A SOC 2 Type I needs evidence that controls were in place on one date. A Type II needs evidence across the whole observation period, so it has to be collected as the controls run. Reconstructing it at the end rarely works.

Keeping it manageable

Most evidence problems are timing problems. A quarterly review done late, or done on time but saved where nobody can find it, leads to the same finding. Give every control an owner, a frequency and a place where its evidence is stored, ideally on the control itself so one record serves every framework the control is mapped to, and check evidence as it arrives instead of in the weeks before fieldwork.

Collecting evidence on a schedule and checking it between audits is what continuous monitoring means in practice. Where systems allow it, pulling records directly from the source saves effort and removes doubt about where a record came from.

Related terms

Evidence integrity

The property that a piece of evidence can be shown to be unchanged since it was collected, usually by hashing it and keeping a log that shows any later change.

Observation period

The window, usually three to twelve months, over which a SOC 2 Type II auditor tests whether controls operated. It starts once the controls are in place.

Access review

A periodic check, usually quarterly, that every user’s access to systems still matches their role, with removals recorded. One of the first pieces of evidence a SOC 2 or ISO 27001 auditor samples.

Exception (audit)

An instance where a control did not operate as described during the audit period. A SOC 2 report lists exceptions, and readers judge how much they matter.

Control

A specific safeguard or activity that reduces a risk, such as requiring MFA on privileged accounts or reviewing access every quarter. Frameworks are, in large part, lists of controls.