4.9
On 15 September 2026, GRSee and Sprinto hosted the Audit Evidence Quality Masterclass, focused on what auditors actually need to see when reviewing evidence and why a working control can still lead to an audit finding.
Led by Yoni Berenyi, QSA and Lead Auditor at GRSee Consulting, and Manas Kasliwal, Lead Auditor at Sprinto, the session covered credible evidence, common gaps, and how to build a more scalable evidence process.
What we covered
Designed for security, compliance and GRC teams, the webinar covered:
- Why a working control can still result in a finding
- The difference between control existence, design and operation
- What makes evidence complete, accurate, timely and traceable
- Common evidence gaps across SOC 2 and ISO 27001 audits
- Why screenshots and other point-in-time evidence can fall short
- How ownership, evidence reuse, automation and continuous collection can improve audit readiness
Why a working control can still generate an audit finding
Auditors may need evidence to demonstrate three things: that a control exists, that it was designed appropriately, and that it operated consistently during the audit period.
The last point is often where teams struggle.
A screenshot may prove a configuration exists today, but not that it remained in place throughout the period under review. A policy may describe how a process should work without proving that it was followed consistently.
Good evidence needs to prove the control being tested, not simply show that documentation exists.
The evidence gaps auditors see most often
Even when a control works, weak supporting evidence can make it hard to verify. Common gaps include:
- Stale evidence
- Records fall outside the relevant audit period.
- Missing approvals
- Required reviews or approvals happened but were not documented.
- Incomplete audit trails
- It is unclear who acted, when, or whether the process was completed.
- Inconsistent sampling
- Evidence is available for some items but missing for others.
- Unverifiable screenshots
- Images lack timestamps, system details, user information or context.
In each case, the issue is the same: the auditor lacks enough reliable information to validate the control.
What makes good audit evidence?
Credible evidence should be:
- Complete
- It covers the relevant period or population.
- Accurate
- It directly supports the control or claim being tested.
- Timely
- It was generated when the control operated.
- Traceable
- It shows who did what, when, and what happened next.
These qualities turn documentation into evidence an auditor can rely on.
How to make evidence collection more scalable
As organizations add systems, control owners and frameworks, manual evidence collection becomes harder to manage. A more scalable approach includes:
- Assigning clear owners and evidence sources to controls
- Collecting evidence closer to when the control operates
- Using system-generated records where appropriate
- Reusing evidence across overlapping requirements
- Applying automation without sacrificing evidence quality
The goal is not to collect more evidence. It is to produce better evidence with less audit friction.
Better evidence, more predictable audits
Incomplete or difficult-to-verify evidence creates more follow-up questions, more manual reconstruction, and more time spent tracking down old records.
A clearer evidence process can reduce that effort and make future assessments easier to manage, especially as the organization adopts additional frameworks.
