Knowledge MaxxingAudit evidence
Audit evidence is the concrete documentation, logs, and records collected to demonstrate that a system actually followed its stated processes and controls.
Prerequisite: Decision record
What matters
Claiming a process was followed is not the same as being able to demonstrate it; audit evidence is specifically what lets a claim be independently verified later.
Example
Logs showing that every high-risk decision was actually reviewed by a human, as the process required, serve as audit evidence that the control was followed in practice.
Common misconception
Having a documented policy in place is not itself audit evidence that the policy was actually followed; evidence needs to show the process happened in real cases.
Recall question
Why isn't having a written policy enough to count as audit evidence that it was followed?