The audit evidence an auditor asks for that nobody collects
Audit evidence is a dated record, made while the work happened, that proves a control operated across a period. Auditors test operation, not policy wording, so evidence cannot be retrofitted. The HIPAA Security Rule requires documentation to be retained for six years. Start collecting at least twelve months before the report you want.
- Audit evidence is a byproduct of a process running, not a document produced at audit time. A screenshot proves one week. A dated ticket proves the year.
- An auditor tests control operation across an observation period. They define a population, draw a sample from it, and check the dates on what comes back.
- Seven records carry most evidence requests: access reviews, offboarding records, change approvals, restore tests, training completions, vendor reviews and exception approvals.
- Collection starts at least twelve months before the report you want, because the observation period has to already be behind you.
- The HIPAA Security Rule requires documentation to be retained for six years, which is longer than most ticketing systems keep anything by default.
How we checked what auditors actually ask for
We built this list from the bodies that write the rules, not from compliance software marketing. Audit readiness is a crowded sales category, and a vendor's checklist is written to sell a platform rather than to describe an examination.
- The sources. Every requirement below is quoted from CISA, NIST, the AICPA, ISO and IEC, or the text of the HIPAA Security Rule, the FTC Safeguards Rule, the CMMC regulation and New York's Part 500.
- The exclusions. We name no provider and no audit firm, and we say nothing about which firms in our directory hold which report.
- Not audit or legal advice. Your auditor and your counsel own the final call on your scope and your obligations.
- Independence. Best IT MSP is an independent directory. We rank providers on verified rating and firmographic data, we label paid placement, and we do not sell IT services.
Framework names differ. The evidence request does not. SOC 2, ISO 27001, HIPAA, CMMC and the FTC Safeguards Rule all ask one question in their own words. Did this control operate, and can you show it?
What is audit evidence, and why do written policies still fail an audit?
Audit evidence is a dated record, created while the work happened, that shows a control operated. A written policy describes a control. Audit evidence proves it ran. An auditor tests control operation rather than control description, which is why a shelf of clean policies still produces findings.
The rule-writers say this in plain words. The CMMC regulation defines an assessment as the testing or evaluation of security controls to determine the extent to which the controls are implemented correctly, and an assessment objective as a set of determination statements that, taken together, expresses the desired outcome. Testing is the verb that matters. NIST defines an audit trail as a chronological record that reconstructs and examines the sequence of activities leading to a security-relevant event. Chronological is the other word that matters.
Good evidence is also verifiable, which means a stranger can check it without taking your word for anything. A signed-off ticket, an approval in a system log and a scheduled report all pass that test. A sentence in a policy document does not.
Here is the part almost nobody is told before a first audit. Audit evidence is a byproduct of a process running, not a document produced at audit time. A screenshot taken the week before the auditor arrives proves the control worked that week. A dated ticket, an approval record or a scheduled report proves it worked all year. The two sit in the same folder and look equally tidy. They are not remotely the same thing.
Screenshot evidence is the most common thing a small business brings to a first audit, and the weakest. It is a photograph of a current state. The examination is about a past period. That mismatch is the whole problem, and it is why evidence cannot be retrofitted. The work begins at least twelve months before the certificate anyone is chasing.
Why can audit evidence not be created after the fact?
Audit evidence cannot be created after the fact because the date on it is the thing being tested. An auditor does not count your documents. They set a scope, define a population, draw a sample across the observation period, and check each item that comes back.
Three words carry that sentence. The scope names which systems and services are in the examination at all. The observation period is the window the auditor tests across. The population is the complete list of things that happened inside that window, such as every new starter, every leaver, every change and every restore test. The AICPA publishes its SOC 2 guidance as an examination of controls at a service organization, and the illustrative service auditor's report it issues meets the reporting requirements of SSAE-21, effective for reports dated on or after June 15, 2022.
Then the auditor samples. Sampling is why a last-minute scramble fails. If 60 people left your business during the period and the auditor samples 10 of their offboarding records, a screenshot of today's user list answers none of it. The sample is drawn from history, and history is either written down on the day or gone.
The population usually comes from your inventory, which is the list an auditor samples from before anything else. Our guide to the IT asset register you can demand from your MSP today covers the fields that make that list usable.
Records then have to survive long enough to be produced. The HIPAA Security Rule requires covered entities to retain documentation for 6 years from the date of its creation or the date when it last was in effect, whichever is later, and to review it periodically and update it in response to environmental or operational changes affecting security. Six years is longer than most help desk systems keep anything on their default settings. Check yours before you need it.
The 7 audit evidence types auditors ask for and nobody collects
Seven record types carry most evidence requests across SOC 2, ISO 27001, HIPAA, CMMC and the FTC Safeguards Rule. Each one is a byproduct of routine work somebody is already doing. Each one also disappears if nobody captures it on the day.
1. Dated access review records naming who reviewed what
An access review record names the reviewer, the date, the list that was reviewed and what changed as a result. New York's Part 500 requires covered entities to periodically, but at a minimum annually, review all user access privileges and to remove or disable accounts and access that are no longer necessary. The HIPAA Security Rule asks covered entities to establish, document, review, and modify a user's right of access, and the FTC tells financial institutions to implement and periodically review access controls. A current user list satisfies none of that. The auditor wants the reviewed list, with a human name and a date attached. Ask to see last year's, then verify that its date falls inside the period you care about.
2. Offboarding records tied to a leaving date
An offboarding record ties each disabled account to the day the person actually left. Part 500 requires covered entities to promptly terminate access following departures, and CISA's performance goals ask you to review user access and disable accounts when inactive for a specified period. Prompt is measured in hours, so the evidence is two dates sitting side by side. CISA also warns that disabling MSP accounts can be overlooked when a contract terminates, which puts your provider's own leavers inside your population too.
3. Change approvals showing who said yes, before the change
A change approval shows who authorised a change, and when, before it was made. CISA asks for configuration change control processes prohibiting unauthorized changes unless approved, and a separate goal that requires review, testing, and approval before new hardware, firmware, or software is installed or deployed. A ticket closed with no approver named is a change with no change approval behind it. Ask your provider whether approvals are recorded in the ticket or agreed verbally on a call, because only one of those answers survives an audit.
4. Restore test results, not backup success emails
A restore test result records what was restored, when, how long it took and whether the data came back correct. CISA says to test backups and recovery no less than once per year, and the HIPAA Security Rule asks for periodic testing and revision of contingency plans. A nightly success email proves a job ran. It does not prove the data returns. IBM measures an average of 247 days to identify and contain an active breach, which is longer than many businesses keep their backup logs, so the restore you need to prove may predate the records you kept.
5. Training completion with dates, per person
Training evidence is a per-person record carrying a completion date. CISA asks that new employees receive initial cybersecurity training prior to accessing computer systems and that you provide at least annual cybersecurity training for all organizational users. The FTC tells firms to provide security awareness training and to schedule regular refreshers. A dashboard showing that most staff are complete is not the evidence. The dated export, naming each person and the day they finished, is.
6. Vendor review records with a date and a decision
A vendor review record shows that somebody looked at a supplier, on a date, and decided something. The FTC requires contracts with service providers to provide for periodic reassessments of their suitability for the job. Federal bank regulators say contract terms should set the types and frequency of audit reports the banking organization is entitled to receive from the third party. CISA asks you to identify, record, assess and monitor risks from managed service providers across the whole relationship. Your IT provider is usually the largest single entry on that list. Verizon found a third party involved in 48% of breaches, after third-party supply chain breaches jumped 60% in one year.
7. Exception approvals and a live exception register
An exception register records every control you knowingly did not apply, who approved the gap, and when it expires. The CMMC regulation names the equivalent artifact directly, defining an operational plan of action as the formal artifact which identifies temporary vulnerabilities and temporary deficiencies. NIST defines the related plan of action and milestones as a document that identifies tasks and the scheduled completion dates for the milestones. Document each exception on the day you accept it. Open items are normal; unrecorded open items are a finding.
Most businesses are carrying exceptions whether they write them down or not. Verizon found the median time for full resolution of a critical vulnerability rose to 43 days from 32 days, and that only 26% of critical known exploited vulnerabilities were fully remediated in 2025, down from 38%. An auditor reading a register of twelve dated, approved exceptions trusts you more than one reading a policy that implies there are none.
A screenshot proves the control worked the week you took it. A dated ticket proves it worked all year. Only one of those can be produced after the fact, and it is the one that fails.
When should evidence collection start?
Evidence collection starts at least twelve months before the report you want, because the report covers a period and that period has to already be behind you. This is the consequence owners miss, and it is expensive to discover late.
Work the calendar backwards. A customer asks for a Type 2 report in October. The report covers an observation period that must close before the auditor finishes fieldwork. So the collection started last October. A gap assessment in July cannot invent January's access review, and no amount of money speeds that up.
ISO and IEC are blunt about partial adoption for the same reason. ISO/IEC 27001:2022 states that excluding any of the requirements specified in Clauses 4 to 10 is not acceptable when an organization claims conformity, so the management system has to be running, producing records, before a certification body audits it. Our ISO 27001 compliance checklist covers the clause work in order.
This is the practical argument for continuous compliance, which simply means evidence lands in a system as the work happens instead of being assembled in a panic. Several rules already assume it. The HIPAA Security Rule asks covered entities to regularly review records of information system activity and to perform a periodic technical and nontechnical evaluation of their safeguards. CISA asks for logs stored for a duration informed by risk or pertinent regulatory guidelines and a regularly updated inventory of all organizational assets, and for incident response plans that are reviewed and drilled, at a minimum, on an annual basis.
Some of that evidence arrives as a dated report from a scheduled job, which is the easiest kind to collect. The FTC tells financial institutions to conduct annual penetration testing plus vulnerability assessments including system-wide scans every six months where continuous monitoring is not in place, and to report in writing at least annually to your board of directors. CISA separately asks firms to regularly use third-party experts to test their defenses. Every one of those produces a document with a date on it. Filing it takes a minute. Recreating it takes a year.
What should you ask your IT provider this week?
Ask your provider which of the seven records it already produces as a byproduct of work it does anyway. Most managed providers already generate three or four of them and have never been asked to keep or send them. That is the cheapest compliance win available to a small business.
- Ask for last quarter's access review record, with the reviewer's name and the date on it.
- Ask for the last three offboarding tickets, then compare each disable date against the leaving date.
- Ask who approved the last firewall change, and where that approval is stored.
- Ask for the date, duration and result of the last restore test, not the backup success report.
- Ask for a per-person training export with completion dates covering the last twelve months.
- Ask which of these can be scheduled to arrive monthly, with nobody chasing it.
That last question is the one that changes your position. A report somebody has to request will not exist for the months nobody requested it. A scheduled monthly export is automatic, and automatic evidence is the only kind that reliably survives a twelve month window. Ask for it in writing and get the cadence into the service agreement.
Two fairness notes keep this honest. A provider who has never produced this is not negligent, because almost no buyer asks and most help desk systems will export it once somebody switches the report on. And no provider can hand you the whole file. Your leavers, your approvals, your training and your exception decisions sit on your side of the line, and an auditor will ask you for them directly.
The stakes are ordinary business stakes rather than audit stakes. IBM puts the global average cost of a data breach at USD 4.99 million, a record high. The records in this post are the same records that let you answer a question after an incident, which is why they are worth keeping even if no auditor ever calls.
This post is about the evidence you have to produce. If you are reading somebody else's report instead, start with is SOC 2 a certification? for how the report works, and your MSP's SOC 2 does not cover you for what a provider's report leaves on your desk. For the order to build in across frameworks, read our cybersecurity compliance guide.
No set of records makes an audit certain, and no honest provider promises a pass. Evidence collection just moves the outcome out of the realm of luck. Turn seven controls into seven scheduled jobs that each leave a dated record behind, and the audit becomes an export rather than a scramble.
FAQ
What is audit evidence?
Audit evidence is a dated record, created while the work happened, that shows a control operated. The CMMC regulation defines an assessment as the testing or evaluation of security controls to determine the extent to which the controls are implemented correctly. A policy describes the control. Evidence proves it ran.
Can you create audit evidence after the fact?
No. The date on the record is the thing being tested. An auditor samples items from across the whole observation period, so a screenshot taken last week answers one week of a twelve month population. New York's Part 500 requires firms to review all user access privileges at a minimum annually, and that record has to carry last year's date.
What evidence does a SOC 2 auditor ask for?
A service auditor asks for records showing controls operated across the stated period: access reviews, offboarding tickets, change approvals, restore tests, training completions, vendor reviews and exception approvals. The AICPA publishes its guidance as an examination of controls at a service organization, and its illustrative report meets the reporting requirements of SSAE-21.
How long should you keep compliance evidence?
Keep it at least as long as your longest obligation. The HIPAA Security Rule requires documentation to be retained for 6 years from the date of its creation or the date when it last was in effect, whichever is later. CISA says logs should be stored for a duration informed by risk or pertinent regulatory guidelines. Check your help desk system's default retention first.
When should you start collecting audit evidence?
At least twelve months before the report you want. A Type 2 report covers an observation period that must already have closed, so January's access review cannot be produced in July. CISA asks firms to test backups and recovery no less than once per year, which only becomes evidence once a full year of dated tests exists.
Best IT MSP is the independent directory of managed IT and cybersecurity providers across the US and Canada. Organic ranking is earned on verified rating and firmographic data, and paid placement is always labelled. Shortlist three firms in your city, then ask all three for the same seven records.