What makes evidence hold up
- Date and author recorded by the system, not written in by hand afterward.
- Tied to its control: the access report sits under the quarterly access review, not in a folder.
- Intact: you can prove it has not changed since it was saved.
- Easy to find: it turns up in minutes when an auditor asks for it, months later.
An example
The quarterly review of system access. The control opens on the 1st with its owner and its checklist. The owner reviews the accounts, ticks off the items, attaches the exported list and closes it. The evidence is all of that together: the checklist, the attachment and the timeline with dates and author.
Recurring control and evidence
The control is the obligation that repeats: every month, quarter or year. The evidence is what remains each time it is done. A control without evidence is an intention; evidence without a control is a loose piece of paper.
The usual mistake
Gathering evidence when the audit arrives. People dig through emails, rebuild dates and produce documents created after the fact, which an auditor spots right away. Evidence is created when the control is done, not when someone asks for it.