Term

Evidence

Artefacts proving that a control is operating as designed.

Evidence in a compliance program refers to any documentation, screenshot, configuration export, or log that demonstrates a control is implemented and functioning as intended over a period of time.

Compliance evidence, explained

Auditors do not take your word for it. A policy says what should happen; evidence shows what did happen. Most of the effort in a SOC 2 or ISO 27001 audit goes into producing, organizing, and explaining evidence, so understanding what auditors actually accept saves more time than almost anything else in a compliance program.

What makes evidence acceptable

Quality, What the auditor asks, Weak example, Strong example comparison
Quality	What the auditor asks	Weak example	Strong example
Relevant	Does it relate to this control and scope?	A screenshot of MFA on a test tenant	MFA enforcement policy exported from the production identity provider
Dated	Does it fall inside the audit period?	An undated screenshot	A system export with a visible generation timestamp
Complete	Is the whole population included?	A filtered list of five new hires	The full HR report of all hires in the period
Attributable	Who performed or approved it?	A spreadsheet marked done	A ticket showing reviewer name, date, and sign-off
Reliable	Could it have been altered?	A retyped summary in a document	A direct system export or API pull

Point-in-time and period evidence

Some evidence shows a state at a moment: an encryption setting, a firewall rule, an approved policy. Other evidence shows an activity repeated over time: access reviews, vulnerability scans, change approvals. A SOC 2 Type I or an ISO 27001 Stage 1 audit leans on the first kind. A Type II report and ISO surveillance audits need the second kind, which means evidence has to be collected as the activity happens, not reconstructed afterwards.

How sampling works

You provide the full population, for example every production change deployed in the audit period.
The auditor checks the population is complete, often by comparing it to another source.
The auditor selects a sample, with the size depending on how often the control runs.
You supply supporting evidence for each sampled item, such as the pull request approval for each sampled change.
Any sampled item that fails becomes an exception or nonconformity.

Evidence mistakes that cost time

Collecting everything in the weeks before the audit, when period evidence can no longer be created retroactively.
Screenshots that crop out the URL, account, or date, so the auditor cannot tell what they show.
Uploading the same artefact separately for each framework instead of linking it once to a shared control.
Letting certificates, pen test reports, and policies silently expire mid-period.
Storing evidence in personal drives or chat threads where it cannot be found at audit time.

Collect once, use many times

A single identity provider export can support access control requirements in several frameworks, which is why evidence reuse is one of the biggest efficiency gains in multi-framework programs. The free audit evidence tracker is a simple way to start. Asurvo's evidence management tracks expiry and reuse, and its native integrations pull evidence continuously from connected systems into the controls it supports, part of what continuous compliance means in practice.

FAQ

Frequently asked questions

Are screenshots acceptable audit evidence?

Often yes, provided they show enough context: the system, account or environment, relevant settings, and a date. Auditors generally prefer system-generated exports or direct integrations because they are harder to alter and easier to verify for completeness. A screenshot of a setting is weaker than a report listing that setting across all in-scope resources.

How long should compliance evidence be retained?

At minimum, keep evidence for the full audit period plus enough time to answer follow-up questions and support the next audit. Many organizations keep it for several years. Contracts, sector regulations, and your own retention policy may set specific periods, so check those before choosing a default.

What is the difference between evidence and documentation?

Documentation describes how things should work, such as a policy, procedure, or network diagram. Evidence proves how things did work, such as tickets, logs, and exports from the audit period. Auditors need both: documentation shows the control is designed, and evidence shows it operated. Approved documents can also serve as evidence that governance activities occurred.

Can the same evidence be used for SOC 2 and ISO 27001?

Frequently, yes. Many requirements overlap, such as access reviews, change management, and vulnerability management. The artefact must still cover the right scope and time period for each audit. Mapping evidence to a common control rather than to each framework separately is the usual way to avoid collecting it twice.

Keep exploring