Insights · Field note · Security assurance and compliance
How to prepare evidence an auditor will accept the first time
Auditors reject evidence for predictable reasons. Each is avoidable before the audit begins.
Auditors accept evidence that is specific to the requirement, dated within the period, complete for the population, consistent with the policy it supports, and produced by the control rather than assembled for the audit. They reject screenshots without dates, samples that omit the exceptions, policies that describe an environment that does not exist, and evidence that contradicts other evidence. Preparing evidence the auditor accepts the first time means collecting it continuously, indexing it to each requirement, verifying it internally and recording the gaps honestly before the auditor finds them.
In detail
What the evidence shows.
Why evidence is rejected
It is undated, so it does not show the control operated in the period. It is a sample chosen by the organization that happens to exclude the failures. It is a policy, which describes intent, where the auditor wanted a record, which shows operation. It is inconsistent: the access policy says quarterly reviews and the records show one. Each rejection is a predictable consequence of assembling evidence after the fact.
What acceptance requires
Dated artifacts from the period. Complete populations, or samples the auditor selects. Records produced by the control as it operates: tickets, logs, approvals, test results. Consistency between policy, procedure and record. An index that lets the auditor find each item without a meeting.
The internal audit first
Before the external examination, an internal review against the same requirements finds what the auditor would find. Gaps are closed or formally accepted with reasoning. The auditor then confirms a program rather than discovering one, and the evidence pack has already been tested.
Maintaining it
Evidence collected continuously, tied to the control’s operation, is never reconstructed under pressure. The maintenance routine names who refreshes each item and how often. The audit evidence pack checklist covers the build; see evidence collection and audit preparation.
Sources
Primary references.
- ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, information security management systems, requirements (ISO)
- SOC 2 examinations: Trust Services Criteria (AICPA)
- Performance Data engagement observations (first-hand: David Selakovic); method described under Cyber Assurance.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days