Recording Audit Evidence

Recording audit evidence accurately and clearly is a fundamental part of conducting an effective ISO/IEC 27001 audit.

The evidence collected during an audit forms the basis for verifying compliance and determining whether the Information Security Management System (ISMS) meets required standards. 

Clear Notation of Audit Evidence

Clear notation means documenting evidence precisely and understandably. Auditors should describe what was observed or reviewed, where it was found, and how it relates to specific ISO 27001 requirements.

Notations must be factual, objective, and free of ambiguity.

For example, rather than writing “Access controls seem okay,” an auditor should note, "Access control policy reviewed (Document Ref: ACP-2024), effective user role assignments verified on system logs dated 2025-10-10."

This method allows easy verification and reduces misunderstandings.

Detailed Notes Typically Include:

1. The source of evidence (e.g., document name, system, interviewee).

2. Specific clauses or Annex A controls related to the evidence.

3. Date and time of observation or document version.

4. Description of the evidence supporting conformity or nonconformity.

5. Maintaining clarity ensures that audit conclusions stand up to scrutiny by internal teams or external certification bodies.

Linking Evidence to Audit Criteria

Audit criteria are the benchmarks defined by ISO/IEC 27001 clauses, organizational policies, or regulatory requirements.

Linking evidence to these criteria means explicitly connecting each piece of evidence to the specific requirement it addresses. This linkage is vital for several reasons:

1. Traceability: It shows the rationale behind audit findings.

2. Objectivity: It grounds conclusions on documented facts rather than opinions.

3. Completeness: It ensures all requirements are appropriately assessed and supported.

For instance, if auditing Clause 7.2 on competence, recorded evidence such as training records or personnel certifications should be directly referenced alongside that clause.

An auditor’s statement might read, “Training attendance logs and certificates for staff A, B, and C reviewed per Clause 7.2 requirements.”

Best Practices in Evidence Recording