Audit evidence is information relevant to the audit criteria that can support an evaluation. Useful evidence may come from records, observations, interviews or data. Its strength depends on relevance, reliability and context, not simply on whether it appears in a signed document.
An auditor follows evidence to answer the objectives set out in the internal audit guide. The examples here are fictional illustrations of evidence reasoning. They do not reproduce ISO requirements or establish a compulsory set of records for every organisation.
Connect a record to the question
A completed form can show that something was recorded, but the auditor still needs to understand what it relates to. A final-check entry saying complete may be uninformative without the job identity, acceptance criteria, result and authority for release.
For a repair workshop, a useful trail could connect the accepted fault description, repair instructions, parts used, test results and customer handover. Each item answers a different question. The auditor should not infer that the entire process is effective merely because the final page has a signature.
Document identity matters. Check that the record belongs to the selected case, uses relevant criteria and represents the appropriate period. A demonstration record created after the audit began is not necessarily evidence of what happened during the original work.
Compare different evidence sources
Interviews can explain how decisions are made and why exceptions occur. Observations can show activities or conditions at a particular time. Records can preserve results from earlier work. Data can reveal patterns, provided definitions and exclusions are understood.
| Evidence item | What it can support | What remains to be tested |
|---|---|---|
| Approved work instruction | The intended method and revision | Whether people use it in practice |
| Completed inspection record | A recorded check for an identified item | Whether criteria and results were suitable |
| Employee explanation | Understanding of work and responsibilities | Implementation in selected cases |
| Performance chart | A measured pattern over time | Definition, completeness and underlying data |
| Direct observation | Conditions visible during the visit | Whether other periods differ |
No source is automatically decisive. A consistent explanation supported by observations may be persuasive. A signed form with contradictory results may require further enquiry.
Test reliability when information conflicts
Suppose a supervisor says all orders receive technical review, but a sampled order has no recorded approval. First establish what the adopted arrangement requires. A review may be evidenced elsewhere, or the record may genuinely be missing.
Check dates, versions and case identities before assuming that the sources contradict one another. If a system changed during the period, the evidence may reflect different arrangements. Ask how the transition was controlled and whether the selected case was subject to the earlier or later method.
If a relevant required record was not retained, its absence may itself support a finding. If a remote connection merely failed temporarily, the issue may be a limitation on the audit rather than proof that the activity never occurred.
Select samples that fit the objective
Sampling should consider meaningful variation. Changed orders, different shifts, unusual materials, repeat complaints and previous findings may warrant examination. An easy sample chosen entirely by the process owner may omit the conditions that matter most.
There is no one sample size that establishes adequate assurance for every internal audit. Consider the population, consequence, variation and what early evidence reveals. Expand enquiry when a contradiction suggests a wider concern, and explain significant exclusions in the report.
Do not describe a convenience sample as statistically representative. A conclusion about examined cases may be justified while a percentage estimate for the whole population is not.
Preserve a usable evidence trail
Working notes should identify relevant records and observations clearly enough to support later review. Include necessary references, dates or process context. Avoid collecting unnecessary personal or customer information merely because it is available.
Where screenshots or exported files are used, consider permission, authenticity, access and retention. A screenshot detached from its system context may omit filters, timestamps or excluded records. Explain what the image actually shows rather than treating it as complete proof.
Distinguish raw notes from confirmed findings. An initial concern may be resolved by later evidence, and the report should reflect the evaluated result. Retain sufficient context to explain why the conclusion changed.
Keep conclusions within the evidence
One missing approval can support a finding about that case against an applicable requirement. It does not automatically show that every approval is missing or that management has no control. A wider conclusion requires wider supporting evidence.
The process-based auditing article explains how connected evidence can reveal issues at handovers that isolated document checks miss.
Reliable evidence handling makes findings defensible and follow-up more focused. It also protects the organisation from unnecessary action based on an inaccurate interpretation. The aim is neither to accumulate the largest evidence folder nor to minimise findings, but to support an honest evaluation of the process examined.