Start with the question the evidence must answer
Evidence is useful in relation to a question. Before asking a team for documents, decide whether you need to understand control design, confirm implementation or review operation over a period. Those enquiries need different records. A policy might explain a design decision while an activity log helps show execution.
For example, consider a quarterly review of access to a shared finance workspace. The question might be whether an authorised owner reviewed all relevant users during the last quarter and followed up inappropriate access. A generic screenshot of the workspace settings does not answer that whole question. It may show configuration, but says little about the review population or the decisions made.
Write a short evidence request that identifies the control, the period, the population and the judgement needed. This helps the provider choose relevant material and makes gaps easier to discuss without collecting unnecessary files.
Check relevance, coverage and timing
A record should relate to the actual control and the environment being reviewed. A procedure from another business unit may explain a similar method without showing what happened in this one. A review conducted before a new service launched cannot establish how access to that service was subsequently managed.
Coverage matters as much as the record itself. Ask which systems, users, locations or transactions are included and which are excluded. If a sample is used, explain how it was selected and what conclusions can reasonably follow. A small purposeful sample may answer a focused question, but it does not prove that every item in the population was handled correctly.
Timing helps establish whether the activity took place when expected. A record created after the review period may provide an explanation, but it should not be presented as a contemporaneous log if it is a later reconstruction. Preserve the difference between the time of the activity and the time the evidence was assembled.
Understand where the record came from
Evidence reliability depends partly on its origin and handling. A system-generated event record, an owner-approved review and an interview note have different strengths and limitations. None should be treated as automatically conclusive. Understand what the system records, what the reviewer actually checked and whether the source could omit relevant events.
When possible, retain a clear reference to the source and the method used to obtain the record. If data was exported and filtered, document the filter and scope. If a screenshot is used, include enough context to understand the environment and date, while removing unnecessary personal information.
Corroboration can help. A review record may state that access was removed. A separate membership history may help establish that the removal occurred. The two records together can support a more useful conclusion than either one alone, provided they refer to the same user, system and period.
A proportionate access-review example
In this fictional example, a small publishing team reviews external access to its editorial workspace. The service owner receives a current member export, compares it with active supplier engagements and records decisions. The workspace administrator then removes expired access and reports any accounts that cannot be resolved immediately.
Useful records could include the member population, the dated owner decisions, removal confirmations and an exception list. The reviewer needs to understand whether the export included guests as well as employees and whether any separate shared links were considered. The records should make those boundaries visible.
The evidence does not establish that every access risk has been eliminated. It supports a narrower judgement about a defined review activity. If shared links sit outside the review process, that may be a scope limitation or a control issue to investigate. State it clearly rather than silently extending the conclusion.
Keep evidence usable and proportionate
Evidence needs enough structure to remain understandable later. Record the control reference, owner, relevant period, location, access restrictions and review outcome. A short index can be more useful than a large folder of unnamed files. Version changes should not erase the record needed to understand an earlier decision.
Retention should reflect the purpose, applicable obligations and sensitivity of the information. Keeping everything indefinitely may increase exposure and make retrieval harder. Avoid copying complete production datasets when a limited extract or an appropriately redacted record can answer the question.
Close the loop with the operating team. If a request repeatedly produces incomplete evidence, investigate whether the control itself is unclear, the record is difficult to retrieve or the request asks for something the process was never designed to show. Improving the practice is more valuable than repeatedly reconstructing its history.
A useful evidence record ultimately connects an objective, an activity and a justified conclusion. It should help someone understand what happened, what remains uncertain and what decision follows. That is a stronger foundation for assurance than treating document quantity as a measure of control quality.
Official sources and further reading
The explanations and examples above are independent educational material. Consult the official sources for their own scope and terminology.
Continue reading
What is information security management?
Return to the controls subject desk