On 15 September 2026, GRSee and Sprinto hosted the Audit Evidence Quality Masterclass, focused on what auditors actually need to see when reviewing evidence and why a working control can still lead to an audit finding.
Led by Yoni Berenyi, QSA and Lead Auditor at GRSee Consulting, and Manas Kasliwal, Lead Auditor at Sprinto, the session covered credible evidence, common gaps, and how to build a more scalable evidence process.
The last point is often where teams struggle.
A screenshot may prove a configuration exists today, but not that it remained in place throughout the period under review. A policy may describe how a process should work without proving that it was followed consistently.
Good evidence needs to prove the control being tested, not simply show that documentation exists.
Even when a control works, weak supporting evidence can make it hard to verify. Common gaps include:
In each case, the issue is the same: the auditor lacks enough reliable information to validate the control
Credible evidence should be:
These qualities turn documentation into evidence an auditor can rely on.
As organizations add systems, control owners, and frameworks, manual evidence collection becomes harder to manage. A more scalable approach includes:
The goal is not to collect more evidence. It is to produce better evidence with less audit friction.
Yes. A control may exist and be appropriately designed, but the evidence may not sufficiently demonstrate that it operated as expected during the relevant audit period.
This is why auditors look beyond whether a control exists. They may also need evidence showing that it operated consistently and produced the expected result.
Credible audit evidence should generally be complete, accurate, timely, and traceable.
That means it should cover the relevant period or population, directly support the control being tested, reflect when the control operated, and provide enough context to understand who performed the activity, when it happened, and the outcome.
Sometimes, but not always.
A screenshot can be useful when it clearly shows the relevant system, configuration, date, user, or activity. However, a screenshot without enough context may only demonstrate a point-in-time condition and not prove that a control operated consistently throughout the audit period.
The evidence needed depends on the control being tested and what the auditor needs to verify.
A policy describes how a process is intended to work. It does not necessarily prove that the process was actually followed.
For controls that require ongoing operation, auditors may need records such as approvals, system logs, review results, tickets, or other evidence demonstrating that the documented process was carried out.
Yes, where the same underlying control supports requirements across multiple frameworks. For example, evidence supporting an access control may be relevant to SOC 2, ISO 27001, HIPAA, or other requirements.
The evidence still needs enough context and traceability to show how it supports each applicable requirement. Evidence reuse should reduce duplicated work without weakening the audit trail.
Organizations can reduce manual work by assigning clear evidence owners, identifying reliable evidence sources, and using system-generated records where appropriate.
Automation and integrations can also help collect recurring evidence. However, automated evidence must still be complete, accurate, timely, and traceable. Automation improves efficiency; it does not replace the need to confirm that the evidence actually supports the control.
Before the audit begins, teams should confirm that controls have clear owners, evidence sources are known, records cover the relevant audit period, approvals are documented, and audit trails provide enough context to verify what happened.
It is also worth identifying recurring evidence that can be generated continuously and opportunities to reuse evidence across overlapping framework requirements.
Incomplete or difficult-to-verify evidence creates more follow-up questions, more manual reconstruction, and more time spent tracking down old records.
A clearer evidence process can reduce that effort and make future assessments easier to manage, especially as the organization adopts additional frameworks.
GRSee helps organizations prepare for and manage audits across frameworks such as SOC 2 and ISO 27001, with practical guidance around controls, evidence, readiness, and ongoing compliance.
