Evidence
Evidence is whatever shows an auditor that a requirement is met and a control actually ran: records, documents, system output, what the auditor observes and what people say in interview. ISO auditing calls it objective evidence. A SOC 2 auditor samples it across the whole period the report covers.
- Clauses
- ISO 27001:2022 9.2.2 · ISO 27001:2022 7.5 · SOC 2 CC4.1
Where the term appears
The ISO standards ask you to keep documented information as evidence in clause after clause, for example of the audit programme and its results (ISO 27001:2022 9.2.2), and to control it under ISO 27001:2022 7.5. ISO 9001, ISO 13485 and ISO 42001 do the same in their own clauses. SOC 2 CC4.1 asks you to evaluate whether controls are working, and for a Type II report the auditor picks samples from each population, such as every access change or every release in the period. The SOC 2 evidence page explains populations and samples.
Evidence that holds water
Good evidence is dated, attributable to a person or system, from the period being audited, and complete enough to sample from. A policy shows design, not operation. An undated screenshot proves little. Interviews corroborate records but rarely stand alone, and an auditor who finds one gap in a sample usually asks for more.
How Sted uses it
- Only evidence from the last 12 months counts towards readiness.
- Readiness counts four kinds of item per adopted standard (each linked document approved; its requirements for that standard adopted or excluded with a reason; at least one closed record per record template; each assigned person’s training completed), counts an item shared by two standards once overall, and reads 0% for a standard with nothing linked.
- Records take file attachments, scanned for malware before download.
Related terms
- Documented information: the controlled form most ISO evidence takes.
- Internal audit: your own test of the evidence.
- Certification audit: where a certification body samples it.
- Audit readiness: how complete your evidence is before an audit.
- SOC 2 report: the auditor’s opinion, built on sampled evidence.