Security and compliance / Audit evidence / ARTEFACT
The evidence pack
One place an auditor can be pointed at, assembled from systems that already run.
The evidence pack drawn as a document. Parts: Request index, Evidence folders, Source register and Gap log. Acceptance: Every supplied audit request links to dated source evidence or an explicit gap entry. Every entry records its covered period and accountable owner.
01
Request index
02
Evidence folders
03
Source register
04
Gap log
- Every supplied audit request links to dated source evidence or an explicit gap entry.
- Every entry records its covered period and accountable owner.
WHAT THIS ARTEFACT IS
A named output with defined parts
An evidence pack is a dated, indexed collection of control records that links each audit request to its source, owner, period and supporting artefact.
What is inside it
- 01
Request index
Each audit request links to a control, covered period, source system and accountable owner.
- 02
Evidence folders
Dated records are grouped by request while retaining their original source and collection date.
- 03
Source register
The register identifies where each record came from, who supplied it and which period it supports.
- 04
Gap log
Missing records and controls that did not operate are recorded separately with an owner and next action.
WHAT IT TAKES
Inputs, time and ownership
FROM YOU
4 inputs
- The audit request list
- Access to evidence sources
- A named control owner
- Previous evidence packs
WORKING RANGE
CLIENT ROLE
A control owner must confirm the audit boundary, approve each source and explain records that are absent for the stated period.
WHERE IT SITS