QULDEXResources · Glossary
What is audit evidence? Types, quality and examples
What counts as audit evidence?
Evidence answers one question: how do you know? A policy shows what should happen. Evidence shows that it did, for these items, on these dates.
Auditors weigh evidence by its source. A report generated by the system is stronger than a screenshot, and a screenshot is stronger than someone's description of what they did.
What are the main types of audit evidence?
Policies, procedures and diagrams that show how a control is meant to work.
Tickets, logs, approvals and system exports that show it worked on specific occasions.
What the auditor watches being done, and what people explain. Usually supported by records.
What does acceptable evidence look like?
Evidence for a quarterly user access review.
| Item | What it looks like |
|---|---|
| Requirement | Access rights are reviewed at planned intervals |
| Evidence | System export of users and roles, dated; reviewer's decisions per user; tickets for removals |
| Period | Third quarter, review completed 5 Oct 2026 |
| Why it is acceptable | From the system, dated, shows who decided, and removals can be traced |
This is an illustration written for this page, not a customer record.
What do frameworks say about evidence?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clause 7.5 | Documented information required by the standard is controlled, protected and available as evidence. |
| ISO 27001 | Clause 9.2 | Documented information is kept as evidence of the audit programme and the audit results. |
| SOC 2 | Type 2 report | The auditor tests whether controls operated effectively across the whole period, using evidence from that period. |
| NIST 800-53 | SP 800-53A | Controls are assessed by examining records, interviewing people and testing mechanisms. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
Why does evidence get rejected?
Outside the period
The export is from last week, but the audit covers last year.
Instead: collect evidence when the control runs, not when the auditor asks.
No date or source
A cropped screenshot shows a setting but not when or where.
Instead: include the system, the date and the full context.
Shows design, not operation
A policy is offered as proof that reviews happened.
Instead: provide the records of the reviews themselves.
How does QULDEX handle this?
Evidence is encrypted, linked to its control and viewed without downloading. Every view is logged.
Evidence: common questions
What makes audit evidence sufficient?
There is enough of it to support the conclusion, for the whole period and across a reasonable sample. One example rarely proves that a control worked all year.
Is a screenshot valid audit evidence?
It can be, if it shows the system, the date and enough context to be trusted. A system-generated export is usually stronger.
How long should evidence be kept?
At least for the audit cycle it supports, and longer where law or contract requires. Set the period in your retention policy.
Sources
- ISO 19011:2018, Guidelines for auditing management systems
- ISO/IEC 27001:2022, Information security management systems: Requirements
- NIST SP 800-53A Rev. 5, Assessing Security and Privacy Controls
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
Evidence collected once, kept safely, found in seconds
Controls, evidence, findings and corrective actions in one audit workspace.