Audit and quality
What counts as audit evidence? A practical guide
“We do that” is not evidence. What auditors accept, why some evidence carries more weight than other evidence, and how to organise records so that every claim traces back to a document, a page and a date.
DataStruct AI Team · Compliance · · 7 min read
In short
- Audit evidence is information that is relevant to the audit criteria and can be verified: records, statements of fact and observations. An assertion with nothing checkable behind it is not evidence.
- Evidence carries weight when it is relevant, verifiable, current, attributable and traceable to its source. Organise it by requirement, not by folder.
- ISO 19011, the guidance standard for auditing management systems, reached its fourth edition in May 2026. It gives more guidance on remote audits and digital evidence; the questions an auditor asks of evidence are the same.
Every audit comes down to the same exchange. The auditor asks how you know a requirement is met, and you show them something. What you show is the evidence. Whether it is accepted depends less on how much of it there is than on whether it can be checked.
A working definition
Auditing guidance such as ISO 19011 treats audit evidence as information that is relevant to the audit criteria and can be verified. The criteria are the requirements you are audited against: a standard, a contract, a policy or a regulation. The evidence is what shows whether they are met. Comparing the evidence with the criteria produces the audit findings.
In practice, evidence takes four forms:
- Records. Completed forms, logs, certificates, test reports, signed approvals, minutes. A record shows that something happened.
- Documents. Policies, procedures and work instructions. A document shows what is supposed to happen.
- Statements. What people tell the auditor in interviews. Statements count, but they carry more weight when a record or an observation corroborates them.
- Observation. What the auditor sees: a process running, a calibration label, a quarantine area.
The difference between documents and records matters more than it seems. A procedure that says every incoming batch is inspected is a document. The inspection records for the batches the auditor samples are the evidence that it happens.
Five tests for a piece of evidence
| Test | The question | Passes | Fails |
|---|---|---|---|
| Relevant | Does it bear on this requirement? | Calibration certificate for the gauge used on that line | Calibration certificate for a gauge in another plant |
| Verifiable | Could someone else check it? | Signed, dated record with a reference number | “The team confirmed it verbally” |
| Current | Was it in force for the period audited? | The policy revision in force during the audit period | A policy approved last week, after the period |
| Attributable | Do you know who produced or approved it? | Approval with a name, a role and a date | An unsigned, unattributed spreadsheet |
| Traceable | Can you point to where it says so? | File, page and section, or sheet and row | “It’s on the shared drive somewhere” |
Evidence that fails one test is not worthless, but it will draw questions. Evidence that fails several should not be relied on.
Assertions are not evidence
The commonest weak answer in an audit is an assertion: all our suppliers are approved, everyone has had the training, we review this every month. Each is a claim that needs something behind it.
| Assertion | Evidence that would support it |
|---|---|
| All our suppliers are approved | An approved supplier list, with an approval record for each supplier sampled |
| Everyone has had the training | Training records with names, dates and content, matched to the staff list |
| We review this every month | Dated review records or minutes for the months sampled |
| Our corrective actions are closed | Closure evidence for each, and a check that the action worked |
Expect sampling
Auditors rarely look at everything. They sample, and they choose the sample. The practical consequence is that every record needs to be complete, because any one of them may be picked. A process that is well evidenced for nine batches out of ten looks, in an audit, like a process that is not under control.
Organise evidence by requirement
The quickest audits are the ones where evidence is already mapped to the requirements. Keep a simple evidence register with, for each requirement:
- the requirement, in the wording you are audited against;
- the evidence item, with its title and version;
- where it is: the file, and the page or section, or the sheet and row;
- the period it covers and the date it was produced;
- who owns it;
- its status: supports the requirement, partly supports it, or no evidence located.
The location column is the one teams leave out, and the one auditors notice. “Section 4.2 of the supplier approval procedure, revision 7” can be checked in seconds. “The procedures folder” cannot.
Remote audits and digital evidence
The fourth edition of ISO 19011, published in May 2026, gives more guidance on remote auditing, including evidence gathered through video calls, shared platforms, cloud systems and electronic records. Whatever the edition, digital evidence raises the same questions as paper: is this the version that was in force, who produced it, and can it be checked at its source?
A few habits help:
- Share the controlled version of a document from the system that holds it, not a copy saved to someone’s desktop.
- Keep the metadata: dates, authors and version numbers should travel with the file.
- Treat screenshots as a last resort. If you use one, make sure it shows where it came from and when it was taken.
- Never create or edit records to fill a gap before an audit. A missing record is a finding; a backdated one is an integrity problem.
Common evidence mistakes
- Drafts or unsigned versions presented as approved documents.
- Evidence from a different site, product or period from the one being audited.
- Large folders with no index, so that nobody can find the record that matters.
- Old revisions of procedures still in circulation alongside the current one.
- Evidence that exists but cannot be found during the audit.
Where DataStruct fits
DataStruct runs a set of requirements against a document set and links each finding to the file and the page, section or spreadsheet rows it came from. Where nothing supports a requirement, the finding says so: the “no evidence located” status in the register above. A reviewer confirms, rejects or flags each finding for follow-up, and the decision is recorded with their name.
It does not judge conformity, and it does not detect contradictions between documents. You write the requirements the way your standard phrases them; audit and quality evidence describes how teams use it before a visit, and how it works shows a review from upload to decision.
Questions
What is the difference between audit evidence and an audit finding?
Evidence is the information the auditor collects. A finding is the result of comparing that evidence with the audit criteria: conformity, a nonconformity, or an opportunity for improvement.
Does an interview count as audit evidence?
Yes. Statements made in interviews are evidence, but they carry more weight when a record or an observation corroborates them.
What is objective evidence?
Facts that can be checked independently of anyone’s opinion: a record, a measurement, a test result or an observation. A statement that something is done, with nothing to show for it, is not objective evidence.
Are screenshots acceptable audit evidence?
They can be, if they show which system they came from, when they were taken and enough context to be checked. An export from the source system, with its dates and author, is usually stronger.
How long should audit evidence be kept?
There is no single period. Retention is set by law for some records, by contracts and certification schemes for others, and by your own retention policy for the rest. Keep records at least long enough to cover the periods your audits sample.