Compliance evidence

The idea

Compliance evidence supports a requirement or control claim. Useful evidence has identifiable origin, scope, dates, ownership, and enough detail for evaluation. A configuration screenshot may show one moment, while operating evidence demonstrates repeated performance over time. Preserve sensitive records appropriately and limit access. Evidence should be traceable to the exact requirement rather than collected indiscriminately for every possible assessment.

In practice

An access review includes the population checked, reviewer, date, decisions, and completed removal actions, not simply a policy saying reviews should occur.

A common misunderstanding

A document’s existence does not prove its process was followed or the exceptions were resolved.

Check your understanding

What distinguishes design from operating evidence?

Think it through: Design describes the intended control; operating evidence shows it was actually performed in the relevant context.

Match the record to the claim

Evidence is useful only in relation to a specific requirement and scope. A policy demonstrates stated intent; a configuration record demonstrates a setting at an observed point; a completed review may demonstrate that somebody evaluated access during a period. These records answer different questions. Collecting a large folder of screenshots does not automatically create strong assurance.

Consider completeness, authenticity, timing, and context. A list of access-review approvals is difficult to evaluate without the population that should have been reviewed. A screenshot may omit the system identity or date. A sample can support a bounded conclusion, but it should not be presented as an examination of every case unless that actually occurred.

A fictional backup claim

An academy says its critical application is recoverable. Evidence that a backup job succeeded supports the fact that the job reported completion. A restore test with application validation supports a different and stronger claim about usable recovery under the tested conditions. The team should retain the test scope, selected recovery point, result, and exceptions.

Protect evidence itself because it may reveal sensitive configuration or personal information. Restrict access according to need, preserve relevant records, and apply an appropriate retention policy. Redaction can support sharing, but keep a controlled original where needed so reviewers can understand what was removed and why.

Evaluate three records

For a fictional privileged-access requirement, compare a policy, a current account listing, and a completed quarterly review. State what each can demonstrate and what it cannot. Identify one missing contextual field for each record. This helps a beginner move from collecting documents to reasoning about whether a claim is actually supported.

Keep exploring

• Compliance and assurance
• Policies, standards, and procedures
• Risk registers