QULDEXResources · Glossary
What is evidence reuse? One record for several frameworks
What does evidence reuse mean?
An organisation with ISO 27001, SOC 2 and a customer audit is often asked for the same access review three times. Reuse means supplying it once, attached to the control, and letting each audit draw on it.
The limit is fit. Each audit has its own period and its own wording. Evidence that satisfies one may only partly satisfy another.
When is reusing evidence valid?
Both requirements are met by the same control operating.
The record falls inside each audit's period, or enough records exist to cover it.
The system or process has not changed since the evidence was produced.
What does evidence reuse look like?
One quarterly access review used three times.
| Use | Why it fits |
|---|---|
| ISO 27001 surveillance audit | Shows Annex A 5.18 operating in the quarter sampled |
| SOC 2 Type 2 examination | One of four quarterly reviews in the period; the other three are also needed |
| Customer security questionnaire | Answers the question on periodic access review |
| Not reusable for | A requirement about privileged access monitoring, which is a different control |
This is an illustration written for this page, not a customer record.
What do frameworks say about evidence and periods?
| Framework | Where | What it asks for |
|---|---|---|
| ISO 27001 | Clause 7.5 | Documented information is controlled and available as evidence where and when needed. |
| SOC 2 | Type 2 report | Evidence must show the control operating throughout the examination period. |
| NIST CSF 2.0 | Informative references | Published mappings show where one outcome corresponds to requirements elsewhere. |
| ISO 27001 | Clause 9.2 | Each audit has its own scope and criteria, which decide what evidence is relevant. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
Where does evidence reuse go wrong?
Out of period
Last year's record is offered for this year's audit.
Instead: check dates against each audit's period.
Stretched to fit
Evidence for one control is offered for a different one.
Instead: reuse only where the same control is being tested.
Copies everywhere
The file is duplicated for each audit and versions drift.
Instead: store it once and link it.
How does QULDEX handle this?
One control and one piece of evidence count towards every framework they apply to.
Evidence Reuse: common questions
Will auditors accept reused evidence?
Yes, when it is relevant to the requirement they are testing and falls within their audit period. They judge each item on its merits.
Does evidence reuse need special software?
No, but it needs each record to be linked to a control and each control to be mapped to requirements. That is hard to maintain in folders and spreadsheets.
Can evidence from an internal audit be reused externally?
The underlying records can. The internal auditor's conclusions are useful context, but an external auditor reaches their own.
Sources
- ISO/IEC 27001:2022, Information security management systems: Requirements
- NIST Cybersecurity Framework (CSF) 2.0
- NIST National Online Informative References Program (OLIR)
- AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022). aicpa-cima.com
Ask each control owner once
Controls, evidence, findings and corrective actions in one audit workspace.