Good evidence is dated, comes from the system of record, is complete and shows who acted. Evidence collected from systems as controls run is more credible than screenshots taken when the auditor asks.
The SOC 2 evidence list goes control by control.
Read more
Related terms
- Population and sample
- A population is every occurrence of a control during a review period; a sample is the subset of it an auditor selects and tests.
- Continuous compliance
- Continuous compliance is keeping controls in a known, evidenced state between audits instead of reconstructing that state before each one.
- Control
- A control is a measure an organization puts in place to manage a risk or meet a requirement, such as an access review, an approval step or encryption.