QULDEXResources · Glossary
What is evidence completeness in an audit?
What does evidence completeness mean?
For each control in scope there is a list of evidence an auditor will expect. Completeness asks, item by item: is it there, is it the right period, has someone reviewed it, and is it attached to the right control?
A complete evidence set does not prove the controls work. It proves the audit can be carried out without delay. The auditor still tests what the evidence shows.
What makes an evidence item complete?
The item exists and is stored where the auditor can see it.
It is the correct record and covers the dates under audit.
It is attached to its control, and a reviewer has accepted it.
How is evidence completeness measured?
A control needs four evidence items for the period.
| Item | What it looks like |
|---|---|
| Backup policy | Present, current version, reviewed: complete |
| Backup job reports | Present for 11 of 12 months: incomplete |
| Restore test record | Present, in period, awaiting review: incomplete |
| Result | One of three items complete; two gaps with named owners |
This is an illustration written for this page, not a customer record.
Where do frameworks expect complete evidence?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clause 7.5.3 | Documented information is available and suitable for use where and when it is needed. |
| ISO 27001 | Clause 9.1 | The organisation keeps documented information as evidence of monitoring and measurement results. |
| SOC 2 | Type 2 report | Evidence must cover the whole examination period; a gap in the period can lead to an exception. |
| NIST CSF 2.0 | ID.IM | Improvements are identified from evaluations, which depend on evidence being available. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What causes evidence gaps?
Collected at the last minute
Evidence is gathered when the auditor asks, and some periods can no longer be produced.
Instead: collect it when the control runs.
Counted but not checked
A file is uploaded, so the item is marked done, but it is the wrong record.
Instead: have a reviewer accept each item.
Not linked
The evidence exists in a shared drive with no connection to a control.
Instead: attach each item to the control it supports.
How does QULDEX handle this?
Evidence is encrypted, linked to its control and viewed without downloading. Every view is logged.
Evidence Completeness: common questions
Is complete evidence the same as passing the audit?
No. Complete evidence means the auditor has what they need to test. The evidence may still show that a control failed.
How do you calculate evidence completeness?
Divide the number of required evidence items that are present, in period and accepted by the number required. Report it per control and per framework.
Who is responsible for evidence completeness?
Each control owner for their controls, and the audit or compliance lead for the overall picture.
Sources
- ISO/IEC 27001:2022, Information security management systems: Requirements
- ISO 19011:2018, Guidelines for auditing management systems
- NIST Cybersecurity Framework (CSF) 2.0
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
See evidence gaps before the auditor does
Controls, evidence, findings and corrective actions in one audit workspace.