What is audit evidence?
Also called: compliance evidence, control evidence
Last updated
Audit evidence is the information an auditor relies on to conclude whether a control or process worked as described: records, documents, screenshots, logs, sign-offs and the answers given in interviews. Good evidence is relevant, dated, complete and traceable to the person and moment it came from, and is collected as the work happens.
In more detail
For certifications and attestations such as ISO 27001 and SOC 2, the auditor tests a sample of controls and asks for evidence that each operated, often across a whole period rather than on one day. A SOC 2 Type II report, for example, covers how controls operated over a period of months.
The common problem is not missing controls but missing evidence: the access review happened, but nobody kept the record. Collecting evidence as part of the process, rather than gathering it before the audit, saves weeks and gives a more convincing picture.
Example
For the control “access is reviewed quarterly”, the auditor asks for the last four access reviews. The team provides each review’s checklist, showing the list of users reviewed, each manager’s decision, the removals made and the date each step was completed.
Audit evidence in CheckFlow
In CheckFlow evidence is collected inside the checklist that runs the control: files in File Upload fields, answers in required fields, and the activity feed recording who did each step and when. A checklist can be printed or saved as a PDF, or shared with an auditor through a link, and guests are free.
Related terms
Templates with a live demo
Each one opens as a live checklist you can try without signing up.
Run your next process as a checklist.
Build it once as a template, then run it with owners, due dates and a record of every step.
14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request