# Evidence

Whatever shows an auditor a requirement is met and a control ran: records, documents, system output, observation and interviews.

Source: https://sted.digital/docs/glossary/evidence · Last reviewed 17 October 2026 · Strand Glossary

Evidence is whatever shows an auditor that a requirement is met and a control actually ran: records, documents, system output, what the auditor observes and what people say in interview. ISO auditing calls it objective evidence. A SOC 2 auditor samples it across the whole period the report covers.

## Where the term appears

The ISO standards ask you to keep documented information as evidence in clause after clause, for example of the audit programme and its results (ISO 27001:2022 9.2.2), and to control it under ISO 27001:2022 7.5. ISO 9001, ISO 13485 and ISO 42001 do the same in their own clauses. SOC 2 CC4.1 asks you to evaluate whether controls are working, and for a Type II report the auditor picks samples from each population, such as every access change or every release in the period. The [SOC 2 evidence page](/docs/standards/soc-2/evidence) explains populations and samples.

### Evidence that holds water

Good evidence is dated, attributable to a person or system, from the period being audited, and complete enough to sample from. A policy shows design, not operation. An undated screenshot proves little. Interviews corroborate records but rarely stand alone, and an auditor who finds one gap in a sample usually asks for more.

## How Sted uses it

Only evidence from the last 12 months counts towards readiness.
Readiness counts four kinds of item per adopted standard (each linked document approved; its requirements for that standard adopted or excluded with a reason; at least one closed record per record template; each assigned person's training completed), counts an item shared by two standards once overall, and reads 0% for a standard with nothing linked.
Records take file attachments, scanned for malware before download.

## Related terms

- [Documented information](/docs/glossary/documented-information): the controlled form most ISO evidence takes.
- [Internal audit](/docs/glossary/internal-audit): your own test of the evidence.
- [Certification audit](/docs/glossary/certification-audit): where a certification body samples it.
- [Audit readiness](/docs/glossary/audit-readiness): how complete your evidence is before an audit.
- [SOC 2 report](/docs/glossary/soc-2-report): the auditor's opinion, built on sampled evidence.