Insights · Checklist
Audit evidence pack checklist
Evidence assembled in a rush before an audit is incomplete, inconsistent and discarded afterward. This checklist builds the pack once, indexed to every framework the organization answers to, and keeps it current.
How to use it
Before the first step.
- Index each item to every requirement it satisfies across frameworks.
- Evidence that does not exist is listed as a gap, never fabricated.
Steps
Each one owned and evidenced.
| # | Step | Owner | Evidence |
|---|---|---|---|
| 01 | List every framework, contract and questionnaire the organization must answer, with their requirements. | Compliance lead | Requirements register |
| 02 | Map requirements across frameworks so one item of evidence serves several. | Compliance lead | Cross-reference matrix |
| 03 | For each requirement, identify the control and the evidence it produces in operation. | Control owners | Control-to-evidence map |
| 04 | Collect evidence: configurations, logs, tickets, reviews, test results, training records, with dates. | Control owners | Evidence files named and dated |
| 05 | Verify each item is current, complete and consistent with the policy it supports. | Compliance lead | Verification column |
| 06 | Record gaps where evidence does not exist, with the action and owner to produce it properly. | Compliance lead | Gap list |
| 07 | Index the pack: requirement, control, evidence, location, date, owner, next refresh. | Compliance lead | Index spreadsheet |
| 08 | Prepare standard answers for recurring questionnaire items with evidence references. | Compliance lead | Answer set |
| 09 | Perform the internal audit or readiness review against the pack before the external examination. | Internal auditor | Internal audit report |
| 10 | Define access to the pack: who may share what externally, and under what agreement. | Compliance lead | Sharing rules |
| 11 | Set the maintenance routine: who refreshes each item and how often; tie refreshes to control operation. | Compliance lead | Maintenance schedule |
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days