Glossary
Evidence
An artefact that lets a third party who was not present verify that a control ran, when, over what scope, and without later alteration.
- Audit evidence
Evidence is valid when it answers four questions without anyone having to ask you: where it came from, when the fact occurred, whether it has changed since, and which part of the estate it covers. If one of those fails, it becomes an assertion.
The most expensive failure is scope. A flawless export showing 98 % patch compliance proves nothing if nobody knows how many machines that percentage is calculated over. Every quantitative piece of evidence needs to declare its denominator.
Four artefacts are constantly offered as evidence and, alone, hold nothing up: the policy, which demonstrates intent rather than execution; the screenshot with no URL and no clock; the email, which proves somebody said something; and the supplier questionnaire, which proves what the supplier declared. All four are valid as one piece of a set, and none as the only piece.